Home page logo

bugtraq logo Bugtraq mailing list archives

Re: ftp conversions exploit
From: lex () TWILIGHT TELCO MD (Alexey Chetroi)
Date: Fri, 24 Dec 1999 08:51:21 +0200

On Wed, 22 Dec 1999, David Malone wrote:

On Wed, Dec 22, 1999 at 04:47:25AM +0000, Desi Hacker wrote:

during the exploiting process.. the final step as instructed by the auther
doesn't work

ftp> get "--use-compress-program=sh blah".tar
ftp> get "--use-compress-program=sh blah".tar

instead is gives a warning of permission denied!
in case of anon ftp logging

The ftpaccess man page contains the following example line:

      path-filter anonymous /etc/pathmsg ^[-A-Za-z0-9._]*$ ^\. ^-

which disallows filenames starting with . or - to anonymous users.
Maybe your ftpaccess line contains this?

it doesn't disallow filenames starting with . or -, it disallows filenames
with spaces


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]