DIR Return Create A Forum - Home
---------------------------------------------------------
Pakleetz
HTML https://pakleetz.createaforum.com
---------------------------------------------------------
*****************************************************
DIR Return to: Hacking Tutorials
*****************************************************
#Post#: 10--------------------------------------------------
FTP | Hacking FTP Service Using Backtrack/Kali linux
DIR By: D4rkF34r
Date: July 11, 2014, 1:54 pm
---------------------------------------------------------
FTP Actually means File Transfer Protocol,it is commonly used in
Web Servers from Webmasters for accessing the files remotely.So
it is almost impossible not to find this service in one of our
Clients systems during an angagement.
For that reason i will try to cover in this article a scenario
of a possible attack against FTP Server.
Requirements are:
1.Backtrack/Kali Linux
The first thing that we need to do is to find which system is
running the FTP service.We can do a simple scan with Nmap in
order to find the open ports.
HTML https://imagizer.imageshack.us/v2/492x335q50/849/vppz.jpg
We can see that FTP port is open.Now we will use FTP Banner
Grabbing method to identify the FTP application version.
We can use Nmap for discovery of the remote operating system and
the service fingerprinting but in this tutorial we will not take
advantage of that.
Banner Grabbing is a technique that someone can use in order to
extract information from application banners.For example if the
remote host is a web server,we can try to connect through
telnet.The banner results will give us an indication about the
operating system and the type of the web server (Apache or IIS).
Command: telnet Target_IP 80
In order to do a banner grabbing in the FTP service we will just
try to connect through Terminal to the FTP server.
HTML https://imagizer.imageshack.us/v2/485x135q90/853/51lo.jpg
From the above image we can see that the version is 1.3.1 and
the operating system is Debian.First we can try to find any
Public Exploit for the ProFTPD 1.3.1 version.if there is any
exploit for this version then we can launch it against the FTP
service.
If there is no public exploit for the specific version then we
will try to find valid username and password using dictionary
attack. We can use any tool like THC Hydra for this job but in
this article we will see how it could be achieved through
Metasploit.
Metasploit framework has a specific module for attacking FTP
Servers.so we will search on the metasploit for the module
ftp_login
HTML https://imagizer.imageshack.us/v2/617x171q90/822/nqbw.jpg
Now that we have found the FTP Scanner it is time to configure
it.we need a good wordlist.Metasploit has a folder with various
wordlists.here we will use the wordlist that contains unix
usernames and passwords.
we are setting the scanner according to the following image and
we type run in order to the scanner to start:
HTML https://imagizer.imageshack.us/v2/645x118q90/855/wlpk.jpg
The scanner has discovered 3 valid login credentials as you can
see from the next 3 images.
HTML https://imagizer.imageshack.us/v2/645x209q90/823/f2ad0.jpg
Discovery of the postgres username/password
HTML https://imagizer.imageshack.us/v2/600x180q50/820/vkr5.jpg
Discovery of the service username/password
HTML https://imagizer.imageshack.us/v2/611x135q90/822/jm25.jpg
Discovery of the user username/password
So now we have three valid logins to choose in order to connect
to the FTP server.lets try the last one which is user as
username and user as password.
HTML https://imagizer.imageshack.us/v2/424x180q90/849/dze2.jpg
we can see that we have successfully managed to login to the FTP
server.Now we can execute the command ls -lat to the server in
order to display the
list with the current directories and sub-dir and the
permissions that we have on directories.
HTML https://imagizer.imageshack.us/v2/497x184q90/855/3lb8o.jpg
There are 2 directories that are important here.The SSH and
Bash_history.
We will download the bash_history file to our computer with the
command GET as you can see it in the image below
HTML https://imagizer.imageshack.us/v2/497x108q90/841/0cdkl.jpg
Except of the console for the connection to the ftp server we
can use also our browser.we will try to login with the same
credentials user/user
HTML https://imagizer.imageshack.us/v2/446x199q90/856/vhme.jpg
After some searching in the directories we have found a
directory which contained the following
HTML https://imagizer.imageshack.us/v2/645x369q90/856/l8v03.jpg
We can see that there are 4 folders.user,service and msfadmin.
This is an indication that another account exists under the
username msfadmin which probably is an administrator’s account
and has more privileges.The reason that we assumed that is
because the folders names are the same with the usernames that
we have discovered previously.
The previous accounts had passwords same with the usernames.So
we will try to login with the following credentials:
Username: msfadmin
Password: msfadmin
HTML https://imagizer.imageshack.us/v2/404x171q90/829/gqi0.jpg
The image above is showing that our try to login with the
username/password msfadmin was successful.If the password was
different then we could have tried another dictionary attack
against the FTP server in order to find and the password.
So we have managed to login to the FTP server with an
administrator’s account.
-D4rk F34r
*****************************************************
Page 1 of 1