Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am analysing an old attack and I got a scenario which does not really make sense to me.

The attacker connects to the ftp service and runs a bunch "FTP RNFR ././ attempt". This is caught by snort as alert with sid 1:1622 I do not understand why attacker does that. His next step is PWD followed by CWD (snort sid 1:1672)

I do not understand the steps and the purpose of them by the attacker, what he was looking for.

share|improve this question
add comment

1 Answer

up vote 5 down vote accepted

The attacker was trying to exploit the CVE-1999-0081 vulnerability of unpatched WU-FTPD installations, where a software bug allows RNFR Rename From commands to overwrite or rename files, even if these commands are violating file permissions and when an unescaped input parameter using relative path pointing to directory root (././) is used. The following commands (PWD Print Working Directory, and CWD Change Working Directory) suggest the exploit attempt was unsuccessful, otherwise the RNFR (Rename From specifying a file to rename) would most probably be followed by RNTO (Rename To) command (probably to rename the root path and remove file permissions on the whole FTP directory structure?). The attacker then retrieved his current position within your FTP directories structure (PWD) and navigated to another location within it (CWD). CWD however takes an argument for the new location, so I can't say what his next step might have been based on information you provide.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.