SQL injection in ProFTPD mod_sql logging pipeline

This repository is a small standalone Go exploit project centered on main.go, with supporting Markdown documentation (README.md, Build.md, Use.md). The code implements a CLI tool for exploiting the claimed ProFTPD mod_sql SQL injection vulnerability CVE-2026-42167 over the FTP protocol. It is not a framework module. Core exploit flow: the tool opens a raw TCP connection to an FTP service, reads the banner, and sends FTP USER/PASS commands. The USER field carries a crafted SQL injection string intended to abuse vulnerable SQL logging behavior. In backdoor mode, the payload injects an INSERT INTO users statement to create a new account with uid=0, home directory /, and shell /bin/bash, then reconnects and attempts to authenticate with the injected credentials to verify success. In RCE mode, the payload uses PostgreSQL COPY TO PROGRAM to execute a bash reverse shell that connects back to an operator-supplied lhost/lport. Repository structure is simple: main.go contains all exploit logic, argument parsing, network handling, payload construction, and colored console output. README.md and Use.md describe the vulnerability, prerequisites, and usage examples. Build.md gives compilation guidance. The go.mod content appears malformed and the import for the color library is redacted/broken ("://github.com"), so the repository as provided would require cleanup before compiling, but the exploit intent and logic are clear. Main capabilities: - Connect to a target FTP server over TCP - Deliver SQLi via FTP USER command - Trigger vulnerable SQL logging path with PASS - Create a persistent privileged backdoor account - Verify backdoor login success - Execute OS commands through PostgreSQL COPY TO PROGRAM - Launch a bash reverse shell to an attacker-controlled listener Overall, this is an operational proof-of-concept exploit for network-based pre-authentication abuse of a vulnerable ProFTPD deployment, with two offensive modes: account injection and reverse-shell RCE.

Small standalone Go exploit repository with 4 files: README.md, go.mod, empty go.sum, and a single executable source file main.go. The code is not part of a known exploit framework. main.go is the sole entry point and implements a TCP FTP client helper (ftpCmd) plus two exploit modes: backdoorMode and rceMode. Core capability: the exploit targets an alleged pre-authentication SQL injection in ProFTPD mod_sql logging tied to USER input, identified in the README as CVE-2026-42167. It connects directly to an FTP server, reads the banner, and sends crafted USER/PASS sequences. In backdoor mode, it injects an SQL INSERT INTO users statement intended to create a new account with uid/gid 0, home directory /, and shell /bin/bash, then attempts to authenticate with the injected credentials to confirm success. In rce mode, it injects a SQL COPY ... TO PROGRAM statement to execute a bash reverse shell that connects back to an operator-supplied listener. Repository structure and purpose: this is a focused proof-of-concept/operational exploit rather than a library or framework module. There is no scanning, brute force, persistence beyond the inserted account, or post-exploitation automation. The helper function ftpCmd handles raw FTP command exchange over TCP with timeouts and simplistic multiline response parsing. Command-line flags allow operator control over target host/port, exploit mode, injected username/password, and reverse shell callback host/port. Notable endpoints and observables: target FTP service is operator-supplied, defaulting to TCP port 2121; reverse shell callback is operator-supplied, defaulting to port 9998; FTP commands USER, PASS, PWD, and QUIT are used; filesystem artifacts embedded in payloads include / and /bin/bash; the reverse shell uses bash /dev/tcp/<host>/<port>. Overall, this is a real exploit implementation with active exploitation logic and payload delivery, not merely a detector.

Repository is a small standalone Python exploit project for alleged CVE-2026-42167 affecting ProFTPD mod_sql. It contains 4 files: a Python exploit script, README, MIT license, and a text wordlist. The main entry point is proftpd_master_exploit.py. The exploit script connects directly to a target FTP service over TCP using Python's socket library, receives the FTP banner, and sends a crafted USER command containing a SQL injection payload. The payload is designed to break out of expected quoting and execute PostgreSQL-specific logic using pg_sleep() for timing-based inference. Core capability is blind unauthenticated SQL injection over the FTP protocol, not code execution. The script then uses pg_read_file() to test whether remote files are readable, LENGTH() to infer file size, and ASCII(SUBSTRING(...)) to recover file contents one character at a time. Operational flow: 1. Parse CLI arguments for target host, port, sleep interval, optional wordlist, and optional specific file. 2. Verify injection by testing a true condition and measuring response delay. 3. If a specific file is provided, attempt direct exfiltration. 4. If a wordlist is provided, iterate candidate names and append common extensions to discover readable files. 5. For each discovered file, determine length and exfiltrate contents character-by-character. Notable implementation details: - Uses default FTP port 2121 unless overridden. - Uses SQL comment syntax /**/ as a no-space bypass. - Uses a fixed candidate character set for extraction, so unsupported characters become '?'. - Contains a bug: test_breakout() calls _check_condition with an extra argument, which would raise a TypeError at runtime in the current code as written. Aside from that defect, the repository clearly intends to be an exploit rather than a detector. Repository structure and purpose: - proftpd_master_exploit.py: main exploit logic and CLI. - README.md: vulnerability description, usage examples, and feature list. - common.txt: local wordlist used for candidate file discovery. - LICENSE: MIT license. Overall, this is an operational proof-of-concept style exploit for unauthenticated file disclosure via blind SQL injection against a PostgreSQL-backed ProFTPD mod_sql deployment, with built-in scanning and exfiltration workflow.

Repository contains a single Python proof-of-concept exploit and a detailed README. The Python script is the operational entry point: it connects to a target FTP service, validates the banner, constructs a SQL injection payload that satisfies the documented is_escaped_text() bypass constraints, starts a local TCP listener, and sends the payload in the FTP USER command from a background thread. The injected SQL uses stacked PostgreSQL queries and COPY TO PROGRAM to execute a bash command on the PostgreSQL host. In its active form, the exploit reads an arbitrary file from the target-side host and exfiltrates it to the attacker over a raw TCP callback; the script also defines but does not use a reverse-shell bash command variant. The exploit is pre-authentication and network-based, targeting ProFTPD mod_sql/mod_sql_postgres deployments where SQL logging includes %U before authentication and the PostgreSQL role is overly privileged. The README provides vulnerability background, affected versions, root-cause explanation, prerequisites, and references, but the actual exploit logic resides entirely in CVE-2026-42167-preauth-user-rce.py.

Repository is a full standalone exploit lab and PoC suite for CVE-2026-42167 in ProFTPD mod_sql. The core issue is an escaping bypass in contrib/mod_sql.c where is_escaped_text() treats attacker-controlled values that begin and end with a single quote and contain no internal quotes as already escaped, causing sql_escapestring() to be skipped. The repository demonstrates that when admins follow documented SQLNamedQuery patterns that wrap variables like %U or %{basename} in single quotes, attacker input can break out of the intended SQL context and execute arbitrary SQL. Structure: top-level README.md provides root-cause analysis, exposure discussion, and reproduction notes; logs/ contains captured proof outputs for successful exploitation; poc/pocs/ contains four Python exploit scripts plus one non-interactive RCE marker script; poc/setup/ contains Docker-based lab automation (Dockerfile, docker-compose, ProFTPD config, seed SQL, setup/teardown scripts); render_screenshot.py is an auxiliary utility for rendering logs to PNG. Main exploit capabilities: (1) pre-auth SQL injection via FTP USER combined with SQLLog ERR_* and %U, allowing unauthenticated arbitrary SQL execution; (2) post-auth SQL injection via crafted STOR filename combined with %{basename}, allowing any authenticated FTP user to execute arbitrary SQL; (3) insertion of a privileged SQL-authenticated FTP backdoor account into the users table, demonstrated as backdoor/pwned123 with uid=0 and homedir=/; (4) PostgreSQL-host OS command execution via stacked SQL and COPY TO PROGRAM; (5) interactive reverse shell with PTY upgrade in the RCE scripts; (6) non-interactive marker-file proof of RCE in preauth_rce_marker.py. The Python PoCs are self-contained and use standard library networking/FTP modules. preauth_user_backdoor.py and postauth_stor_backdoor.py verify target reachability, confirm the backdoor account does not already exist, send the SQLi payload, then authenticate as the injected user to prove compromise. preauth_user_rce.py and postauth_stor_rce.py build COPY TO PROGRAM payloads that launch a bash reverse shell back to a local listener and then upgrade the shell using util-linux script. preauth_rce_marker.py is a safer validation variant that writes /tmp/cve-2026-42167-rce.txt on the PostgreSQL host instead of opening an interactive shell. The setup environment intentionally builds a vulnerable ProFTPD commit (ae25959adb05ae1d6ebfa1f36bf778c9c34e9410) with mod_sql_postgres, seeds a PostgreSQL 15 database, and configures vulnerable SQLLog directives in proftpd.conf. Exposed lab services are FTP on 2121, passive FTP ports 60000-60010, and PostgreSQL on 15432. Overall, this is a real exploit repository, not just documentation: it contains working exploit code, environment provisioning, and captured evidence of successful auth bypass, privilege escalation, and DB-host RCE.

Repository contains a self-contained proof-of-concept lab and four Python exploit scripts for CVE-2026-42167 in ProFTPD mod_sql. The vulnerability is an SQL escaping bypass in mod_sql logging where attacker-controlled values that begin and end with a single quote and contain no internal single quotes are treated as already escaped. When administrators use documented SQLNamedQuery patterns that wrap variables such as %U or %{basename} in single quotes, the attacker can break out of the intended string context and inject raw SQL. Structure: README.md documents the bug, exploitation conditions, and impact. The pocs/ directory contains four standalone Python scripts: preauth_user_backdoor.py and preauth_user_rce.py exploit the pre-auth USER/%U path; postauth_stor_backdoor.py and postauth_stor_rce.py exploit the authenticated STOR/%{basename} path. The setup/ directory builds a Docker lab with ProFTPD and PostgreSQL, seeds a vulnerable schema, and exposes FTP on localhost:2121 and PostgreSQL on localhost:15432. Main capabilities: (1) unauthenticated SQL injection via FTP USER when SQLLog ERR_* logs %U; (2) authenticated SQL injection via crafted STOR filename when SQLLog logs %{basename}; (3) insertion of a backdoor FTP account into the SQL auth table with uid/gid 0 and homedir /; and (4) PostgreSQL-host RCE via stacked queries using COPY TO PROGRAM, delivering a bash reverse shell and upgrading it to an interactive PTY using util-linux script. The exploit code is real and operational, not merely detection logic. It performs banner checks, verifies whether the backdoor account already exists, sends crafted FTP commands or uploads, and validates success by logging in as the injected user or waiting for a reverse-shell callback. The lab configuration in setup/proftpd.conf intentionally enables the vulnerable SQLLog patterns, and seed.sql creates users, groups, activity_log, xfer_log, and secrets tables to demonstrate impact.