ProFTPD mod_copy SITE CPFR/CPTO copy of sensitive file (CVE-2015-3306)

ills3c Intel&Coffee@Ills3C

•updated 2 days ago•0•0•1

Detects ProFTPD FTP server commands where an adversary uses SITE CPFR (Copy From) to reference a sensitive file path (such as /etc/passwd or SSH keys) followed by SITE CPTO (Copy To) on the same host within a 10-minute window, which indicates potential staging or unauthorized copying of sensitive system files via FTP.