CVE-2010-20103
CRITICAL EXPLOITED NUCLEIProFTPD 1.3.3c - Unauthenticated Remote Code Execution via Hidden FTP Command
Title source: llmExploitation Summary
CVE-2010-20103 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 3 public exploits from researchers including Metasploit, anonymous, MC, darkharper2, including a Metasploit module exploits/unix/ftp/proftpd_133c_backdoor.
A Nuclei detection template is also available.
AI-analyzed exploit summary This exploit targets a backdoor in ProFTPD 1.3.3c, which was present in the source code archive between November 28th and December 2nd, 2010. It sends a specific command to trigger the backdoor and execute arbitrary commands on the target system.
Description
A malicious backdoor was embedded in the official ProFTPD 1.3.3c source tarball distributed between November 28 and December 2, 2010. The backdoor implements a hidden FTP command trigger that, when invoked, causes the server to execute arbitrary shell commands with root privileges. This allows remote, unauthenticated attackers to run any OS command on the FTP server host.
Exploits (3)
This exploit targets a backdoor in ProFTPD 1.3.3c, which was present in the source code archive between November 28th and December 2nd, 2010. It sends a specific command to trigger the backdoor and execute arbitrary commands on the target system.
This is a detailed report and patch analysis of the ProFTPD 1.3.3c backdoor incident from 2010, including the malicious modifications to the source code and the rootkit patch. It provides technical insights into the backdoor mechanism and the compromised distribution process.
This Metasploit module exploits a backdoor in ProFTPD 1.3.3c by sending a specific command to trigger remote command execution. It checks for the backdoor presence and executes the payload if confirmed.
Nuclei Templates (1)
product:\"ProFTPD\"
References (8)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H