Date: Tue, 06 Mar 2001 10:23:32 -0800 From: "Riley J. McIntire" <rjmcintire@earthlink.net> To: Peter Pentchev <roam@orbitel.bg>, Dag-Erling Smorgrav <des@ofug.org> Cc: Adam <bsdx@looksharp.net>, "Aaron D.Gifford" <agifford@infowest.com>, freebsd-security@FreeBSD.ORG Subject: RE: ftp access Message-ID: <NCBBLBILEPCHLFJAPIIPEEJDFGAA.rjmcintire@earthlink.net> In-Reply-To: <20010306092420.A17428@ringworld.oblivion.bg>
next in thread | previous in thread | raw e-mail | index | archive | help
>
> On Tue, Mar 06, 2001 at 03:59:52AM +0100, Dag-Erling Smorgrav wrote:
> > Adam <bsdx@looksharp.net> writes:
> > > What happens if they have a valid ftp account, login, and run !sh ?
> >
> > They get a shell on the box they're FTPing from.
>
> ..which happens to be the box they logged in *to*, since /usr/bin/ftp
> is effectively their login shell. Yes, that's bad.
>
> G'luck,
> Peter
No, looks to me like the shell is piped (not sure this is exactly how it
works...) through the login shell (ftp_only). It gives an error:
root@worm# telnet aji
Trying 10.100.100.100...
Connected to aji
Escape character is '^]'.
FreeBSD/i386 (aji) (ttyp2)
login: rjm
Password:
Last login: Tue Mar 6 10:06:20 from worm
Copyright (c) 1980, 1983, 1986, 1988, 1990, 1991, 1993, 1994
The Regents of the University of California. All rights reserved.
FreeBSD 4.2-RELEASE (AJI) #0: Sat Dec 9 13:27:56 PST 2000
// motd display snipped
You have new mail.
This account is for ftp only
Connected to localhost.
220 aji FTP server (Version 6.00LS) ready.
Name (localhost:rjm):
331 Password required for rjm.
Password:
230 User rjm logged in.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> !/bin/sh
ftp: /sbin/ftp_only: Exec format error
ftp> !
ftp: /sbin/ftp_only: Exec format error
Riley
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?NCBBLBILEPCHLFJAPIIPEEJDFGAA.rjmcintire>