ET EXPLOIT Potential RoaringBeast ProFTPd Exploit Specific config files upload

SID: 2015513Rev: 30 viewsHistory

Sourceet/open

CreatedJuly 24, 2012

UpdatedJuly 26, 2019

Classificationtrojan-activity

alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"ET EXPLOIT Potential RoaringBeast ProFTPd Exploit Specific config files upload"; flow:established,to_server; content:"STOR "; content:".conf|0d 0a|"; distance:0; fast_pattern; pcre:"/^\s*?STOR\s+[^\r\n]*?\x2f(tgt|trace|rbp(c|p))\.conf\r$/mi"; reference:url,www.exploit-db.com/exploits/18181/; reference:url,stopmalvertising.com/malware-reports/the-c3284d-malware-network-stats.php.html; classtype:trojan-activity; sid:2015513; rev:3; metadata:created_at 2012_07_24, signature_severity Major, updated_at 2019_07_26;)

References

url	www.exploit-db.com/exploits/18181/
url	stopmalvertising.com/malware-reports/the-c3284d-malware-network-stats.php.html

ET EXPLOIT Potential RoaringBeast ProFTPd Exploit Specific config files upload

References

Metadata

Comments (0)