title: Snort rule for wing ftp server authenticated command execution
body: <p>Hi Im writing some custom rules for a university project and I wondered if anyone could check my rule for this vulnerability; 
  <a href="http://www.exploit-db.com/exploits/34517/" rel="nofollow">http://www.exploit-db.com/exploits/34517/</a></p>
  
  <p>here is my rule;</p>
  
  <p>alert tcp any any -> any 5466 \
  (msg: "FTP command execution"; content: " / admin lua script html"; content: "POST"; http_method; content: "os execute";)</p>
  
  <p>Revised rule; alert tcp any any -> any 5466\ 
  (msg: "FTP command execution"; content:"/admin_lua_script.html"; content:"POST"; http_method; content: "os execute";)</p>