60 lines
2.7 KiB
Plaintext
60 lines
2.7 KiB
Plaintext
gatling now also speaks FTP, and it is enabled per default.
|
|
Disable it with -F.
|
|
|
|
Working around itojun's disabled IPv4-mapped IPv6 addresses is even
|
|
worse for FTP than it is for HTTP. I'm not going to waste my time on
|
|
this for now. Please ask itojun himself to prove how "easy" or even
|
|
"trivial" it is to do this, as he always claims it is.
|
|
|
|
Like HTTP will bind to port 80 if running as root, or 8000 otherwise,
|
|
FTP will bind to port 21 and 2121. To specify the FTP port, use
|
|
-f -p [port]. Example:
|
|
|
|
gatling -p 81 -f -p 2100
|
|
|
|
would run a HTTP server on port 81 and an FTP server on port 2100. For
|
|
now, HTTP and FTP will always bind to the same IP number.
|
|
|
|
Please note:
|
|
|
|
a) No TELNET sequences.
|
|
These are _really_ obsolete, a pain in the ass to implement, and
|
|
have even been used as means to avoid intrusion detection systems
|
|
due to the obscurity.
|
|
|
|
b) The path checking deliberately _allows_ to leave the file system,
|
|
as long as you follow a symbolic link in the process. That means,
|
|
if you symlink out of the FTP file system (and the destination is in
|
|
the chroot jail), gatling will allow FTP (and HTTP!) users to
|
|
follow the symlink. However, following a directory symlink and
|
|
appending "/../" will not follow the .. directory entry from the
|
|
target directory of the symlink, as an attacker may hope.
|
|
|
|
The idea is to make it easy to create an FTP Server by putting a
|
|
few symlinks to directories you want to export in an empty
|
|
directory and starting gatling there.
|
|
|
|
c) Like for HTTP, gatling will do virtual hosting, i.e. if the client
|
|
connected to IP 10.1.1.23 on port 21, gatling will look for the
|
|
exported data in the directory "10.1.1.23:21".
|
|
|
|
d) gatling will not let users download files that are not world
|
|
readable, even if the permissions would normally allow the gatling
|
|
process to read the files. This is to prevent accidental
|
|
publication of sensitive files.
|
|
|
|
e) gatling accepts uploads per anonymous FTP, but only to directories
|
|
that are world writable. Since there normally are no world
|
|
writable directories, this should not pose much of a threat to
|
|
anyone. Please note that the files are created with mode 600,
|
|
which means gatling will not let others download uploaded files, so
|
|
it cannot be exploited as warez dump.
|
|
|
|
You can disable uploads altogether with -U, or you can allow
|
|
anonymous downloaders to download just uploaded files with -a.
|
|
|
|
f) gatling's directory listings will always claim files are owned by
|
|
root. The local accounts on FTP sites are ignored by software and
|
|
not normally useful to outsiders anyway, but revealing them may
|
|
expose more of your organisation to FTP users than you want.
|