ProFTPD mod_copy (CVE-2015-3306)

The mod_copy module of ProFTPD 1.3.5 adds the FTP commands SITE CPFR (copy from) and SITE CPTO (copy to), meant to copy files within the server itself without downloading and re-uploading them. The problem (CVE-2015-3306) is that, in the vulnerable version, they require no authentication: anyone who can talk to port 21 can copy arbitrary system files, with the FTP process's permissions.

This does not give code execution on its own, but it is a very powerful arbitrary-copy primitive. Two typical uses:

• Read sensitive files by copying them to a reachable path. If the FTP shares (or an SMB/HTTP serves) a directory, copy /etc/shadow, a shadow.bak, a private key, etc. there and read it from that service:

site cpfr /var/backups/shadow.bak
site cpto /home/aeolus/share/shadow.bak    # ...then read it via SMB/HTTP

• RCE by copying a PHP webshell into the docroot if its path is known: SITE CPFR from a file whose content we control (e.g. /proc/self/cmdline or an uploaded file) and SITE CPTO /var/www/html/shell.php.

# the unauthenticated copy, straight over netcat
printf 'site cpfr /etc/passwd\r\nsite cpto /tmp/passwd\r\n' | nc <ip> 21
# metasploit does the webshell -> RCE in one shot
msfconsole -q -x "use exploit/unix/ftp/proftpd_modcopy_exec; set RHOSTS <ip>; set SITEPATH /var/www/html; run"

Discovery usually chains with prior enumeration: a .log or an smb.conf leaked through anonymous SMB that reveals the backup path and the share path turns the copy into a direct route to the hashes.

Requirements. ProFTPD 1.3.5 with mod_copy loaded; the FTP process must be able to read the source and write the destination. Any hashes obtained still need cracking with John/Hashcat.

How to detect it. The signature is in the ProFTPD log: SITE CPFR/SITE CPTO commands, all the more with no prior login (no successful USER/PASS), which almost no legitimate client uses; a destination in the docroot (/var/www) or a share signals a webshell, and a source of /etc/shadow/a private key signals exfiltration. On the host, a new .php appearing in the webroot or a sensitive file copied to a world-readable path (FIM/auditd) confirms the abuse. The ProFTPD 1.3.5 banner on port 21 is the preceding exposure.

Defence. Update ProFTPD, unload mod_copy if unused, and require authentication for SITE CPFR/SITE CPTO. Do not leave backup or share paths exposed in readable logs.