Re: compress(vul) + ftpd(?)

[H D Moore <hdm () digitaloffense net>]

On Thursday 07 March 2002 09:30 am, HypH wrote:
> On Thu  7. March 2002 15:18, H D Moore wrote:
> > YES.  wu-ftpd will call compress with the file name as an argument if you
> > request the file name ending in .Z. You have to be able to write out a
> > file name containing the shell code to exploit the bug.
>
> The problem is that the file have to be 1100 chars long , with the
> shellcode within. But wu-ftpd doesn`t allow/handle so long filenames.

Hmm.. What about splitting the shellcode into different directories and the 
requesting the full path to the file (directories and all) ending in .Z?