wuftpd format string exploit

After successful exploitation an agent will be deployed. This agent will inherit the user identity and capabilities of the abused service, usually those of the user used to login into the ftp server (ftp, for example). However, the uid (as opposite to the euid) of the agent will be that of the super user in most cases (usually 0), and by using the setuid module (see setuid module documentation), it can be changed. When an anonymous user is used, or if the server is configured to do this for other users, the deployed agent will be running in a chroot jail. This situation does not prevent the agent to be used, and after setting the user id to that of the super user, the chroot breaker module (see chroot breaker module documentation) can be used to escape the chroot jail.