I am implementing the ftpd exploit found here in a Docker container. I have downloaded the rpm, and I install it with the following dockerfile:

FROM centos:7

WORKDIR /ftpd/
COPY ab8aee4863a3d4eb80111d05db103d55-wu-ftpd-2.4.2b18-2.1.i386.rpm /ftpd/
RUN yum install -y ab8aee4863a3d4eb80111d05db103d55-wu-ftpd-2.4.2b18-2.1.i386.rpm

CMD sh

The install seems to work fine, and I think the command to start the ftpd is /usr/sbin/wu.ftpd, but when I run that command it silently exits with the status code 1.

If I run the command with strace I get the following (abridged) output:

open("/etc/localtime", O_RDONLY|O_CLOEXEC) = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=118, ...}) = 0
fstat64(3, {st_mode=S_IFREG|0644, st_size=118, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xf7f4f000
read(3, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0"..., 4096) = 118
_llseek(3, -6, [112], SEEK_CUR)         = 0
read(3, "\nUTC0\n", 4096)               = 6
close(3)                                = 0
munmap(0xf7f4f000, 4096)                = 0
getpid()                                = 53
connect(3, {sa_family=AF_LOCAL, sun_path="/dev/log"}, 110) = -1 ENOENT (No such file or directory)
close(3)                                = 0
exit_group(1)                           = ?
+++ exited with 1 +++

It seems pretty clear that it is failing while attempting to connect to /dev/log which doesn't exist in the docker image. After some research I learned that that file has to do with a GNU program called syslog. I followed the instructions here to start rsyslogd and can confirm that it is running, but the strace remains the same, and there is no /dev/log file.

One other thing I tried was making a /dev/log file with touch, but that just results in an ECONNREFUSED instead of ENOENT.

Any ideas?

Edit: I don't know if it's relevant, but at least two other binaries (ftpcount,ftpwho) that were installed from that RPM seem to work fine.

Edit 2: This is the command I use to start the container:

docker build -t wuftpd . && docker run --security-opt seccomp:unconfined -p21:21 -it wuftpd

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.