I am analysing an old attack and I got a scenario which does not really make sense to me.

The attacker connects to the ftp service and runs a bunch "FTP RNFR ././ attempt". This is caught by snort as alert with sid 1:1622 I do not understand why attacker does that. His next step is PWD followed by CWD (snort sid 1:1672)

I do not understand the steps and the purpose of them by the attacker, what he was looking for.


The attacker was trying to exploit the CVE-1999-0081 vulnerability of unpatched WU-FTPD installations, where a software bug allows RNFR Rename From commands to overwrite or rename files, even if these commands are violating file permissions and when an unescaped input parameter using relative path pointing to directory root (././) is used. The following commands (PWD Print Working Directory, and CWD Change Working Directory) suggest the exploit attempt was unsuccessful, otherwise the RNFR (Rename From specifying a file to rename) would most probably be followed by RNTO (Rename To) command (probably to rename the root path and remove file permissions on the whole FTP directory structure?). The attacker then retrieved his current position within your FTP directories structure (PWD) and navigated to another location within it (CWD). CWD however takes an argument for the new location, so I can't say what his next step might have been based on information you provide.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.