Home FTP Server - 'MKD' Directory Traversal

ExploitDBExploitDB exploitExploitEDB-10162

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

This Python script is a proof-of-concept exploit for CVE-2009-4053, a directory traversal vulnerability in Home FTP Server 1.10.1.139. It connects to an FTP server on port 21, authenticates with supplied credentials, and sends an 'MKD ../A' command to create a directory outside the intended FTP root.

Backdoor review

No backdoor observed in reviewed code

The provided Python script is a straightforward proof-of-concept for CVE-2009-4053. It connects to an FTP server, authenticates with user-supplied credentials, and sends a single 'MKD ../A' command to exploit a directory traversal vulnerability. The script contains no obfuscation, no secondary payloads, no network connections to attacker-controlled infrastructure beyond the target FTP server, and no persistence mechanisms. All actions are directly related to demonstrating the vulnerability.

ClassificationExploit
Model confidence100%
AuthenticationRequired
LanguagesPython
Target softwareHome FTP Server
Attack typesdirectory traversal
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively sends a malicious MKD command with a directory traversal sequence ('../A') to a target server, which is intended to create a directory outside the authorized FTP root. This constitutes an exploit because it exercises the vulnerability to achieve an unauthorized action (arbitrary directory creation).

exploits/windows/remote/10162.py:26

Requirements

  • The target must be running a vulnerable version of Home FTP Server (1.10.1.139) with FTP service on port 21.exploits/windows/remote/10162.py:1-28
  • Valid FTP credentials (username and password) are required for authentication.exploits/windows/remote/10162.py:22-25

Observed behavior

  • The script connects to the target FTP server on port 21.exploits/windows/remote/10162.py:15-17
  • It sends USER and PASS commands with the provided credentials.exploits/windows/remote/10162.py:22-25
  • It sends an 'MKD ../A' command to create a directory named 'A' one level above the FTP root, exploiting the directory traversal vulnerability.exploits/windows/remote/10162.py:26
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
The script sends an FTP 'MKD ../A' command to create a directory outside the intended root.This is the core exploit action for CVE-2009-4053, which describes a directory traversal vulnerability in the MKD command.exploits/windows/remote/10162.py:26
Network Connection
Connects to user-supplied hostname on port 21.The script connects to the target FTP server specified by the user. No other network connections are made.exploits/windows/remote/10162.py:15-17
Authentication
Sends user-supplied username and password for FTP authentication.The script uses credentials provided as command-line arguments to log in to the FTP server.exploits/windows/remote/10162.py:22-25
Review boundaries

What the analysis did not establish

  • The review is limited to the provided text of the exploit script. No external tools, libraries, or referenced resources (e.g., the Home FTP Server installer) were analyzed.
  • The script's behavior depends on the target server's vulnerability; the review does not assess whether the exploit is functional or safe to execute.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1