zhangmc
Source-scoped identity with 4 associated PoCs and 5 linked vulnerabilities.
Exploit catalog results
Showing 4 PoCs on this page
ExploitDBHome FTP Server - 'MKD' Directory Traversal
ExploitDB exploitPublished 2009-11-17ExploitCVE-2009-40531 file
Analysis
Technical assessment
This Python script is a proof-of-concept exploit for CVE-2009-4053, a directory traversal vulnerability in Home FTP Server 1.10.1.139. It connects to an FTP server on port 21, authenticates with supplied credentials, and sends an 'MKD ../A' command to create a directory outside the intended FTP root.
Backdoor review
No backdoor observed in reviewed code
The provided Python script is a straightforward proof-of-concept for CVE-2009-4053. It connects to an FTP server, authenticates with user-supplied credentials, and sends a single 'MKD ../A' command to exploit a directory traversal vulnerability. The script contains no obfuscation, no secondary payloads, no network connections to attacker-controlled infrastructure beyond the target FTP server, and no persistence mechanisms. All actions are directly related to demonstrating the vulnerability.
Classification basis and observed behavior
Classification basis
The script actively sends a malicious MKD command with a directory traversal sequence ('../A') to a target server, which is intended to create a directory outside the authorized FTP root. This constitutes an exploit because it exercises the vulnerability to achieve an unauthorized action (arbitrary directory creation).
exploits/windows/remote/10162.py:26Requirements
- The target must be running a vulnerable version of Home FTP Server (1.10.1.139) with FTP service on port 21.
exploits/windows/remote/10162.py:1-28 - Valid FTP credentials (username and password) are required for authentication.
exploits/windows/remote/10162.py:22-25
Observed behavior
- The script connects to the target FTP server on port 21.
exploits/windows/remote/10162.py:15-17 - It sends USER and PASS commands with the provided credentials.
exploits/windows/remote/10162.py:22-25 - It sends an 'MKD ../A' command to create a directory named 'A' one level above the FTP root, exploiting the directory traversal vulnerability.
exploits/windows/remote/10162.py:26
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThis is the core exploit action for CVE-2009-4053, which describes a directory traversal vulnerability in the MKD command.
exploits/windows/remote/10162.py:26 - Network Connection
- Payload withheldThe script connects to the target FTP server specified by the user. No other network connections are made.
exploits/windows/remote/10162.py:15-17 - Authentication
- Payload withheldThe script uses credentials provided as command-line arguments to log in to the FTP server.
exploits/windows/remote/10162.py:22-25
What the analysis did not establish
- The review is limited to the provided text of the exploit script. No external tools, libraries, or referenced resources (e.g., the Home FTP Server installer) were analyzed.
- The script's behavior depends on the target server's vulnerability; the review does not assess whether the exploit is functional or safe to execute.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
ExploitDBHome FTP Server 1.10.1.139 - 'SITE INDEX' Remote Denial of Service
ExploitDB exploitPublished 2009-11-16Not analyzedCVE-2009-40511 file
ExploitDBXM Easy Personal FTP Server - 'APPE' / 'DELE' Denial of Service
ExploitDB exploitPublished 2009-11-13ExploitCVE-2009-4048CVE-2009-41081 file
Analysis
Technical assessment
The Python script implements a denial-of-service exploit against XM Easy Personal FTP Server 5.8.0 by sending an APPE command on one connection and a DELE command on a second connection, as described in CVE-2009-4048.
Backdoor review
No backdoor observed in reviewed code
The Python script is a straightforward proof-of-concept for CVE-2009-4048. It opens two FTP control connections, issues an APPE command on the first, closes it, then issues a DELE command on the second to trigger a denial of service. No backdoor, trojan, or deceptive behavior is present.
Classification basis and observed behavior
Classification basis
The script actively sends crafted FTP commands (APPE and DELE) to trigger a denial-of-service condition, which is the definition of an exploit.
exploits/windows/dos/10104.py:42exploits/windows/dos/10104.py:66Requirements
- Valid FTP credentials (username and password) for the target server.
exploits/windows/dos/10104.py:6-7 - Network connectivity to the target FTP server on port 21.
exploits/windows/dos/10104.py:19
Observed behavior
- Authenticates to the FTP server using supplied credentials.
exploits/windows/dos/10104.py:25-32 - Sends an APPE command with a single character argument on the first connection.
exploits/windows/dos/10104.py:42 - Closes the first connection and opens a second authenticated connection.
exploits/windows/dos/10104.py:47-64 - Sends a DELE command with the same single character argument on the second connection.
exploits/windows/dos/10104.py:66
Behaviors behind the backdoor verdict
Observables
- Network Connection
- Payload withheldStandard for an FTP exploit PoC
exploits/windows/dos/10104.py:19 - Network Connection
- Payload withheldUsed for active FTP data transfer, consistent with the PORT command
exploits/windows/dos/10104.py:34 - Ftp Command
- Payload withheldImplements the described denial-of-service trigger
exploits/windows/dos/10104.py:42exploits/windows/dos/10104.py:66
What the analysis did not establish
- Only the exploit script was analyzed; no external dependencies or target server were inspected.
- The script's effectiveness or reliability was not tested.
- Only the supplied text file was reviewed; no binary files or external resources were inspected.
- The script's effect on a live target was not verified.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.