Exploiting FTP.
All right.
So now that we've taken a look at how
to exploit the shellshock vulnerability,
and that really encapsulated the exploitation of Bash
and Apache, let's turn our attention to FTP
because you will find FTP running on a lot of Linux
servers out there.
All right.
So what is FTP?
FTP stands for the File Transfer Protocol.
It is a protocol that utilizes TCP port 21 by default,
although it can be configured to run on different ports.
So that's something that you want to keep in mind.
And is used to facilitate file sharing between a server
and client or clients and vice versa.
So it is also frequently used as a means
of transferring files to and from the directory of a web
server.
And this comes back to the typical deployment use
case of FTP.
So again, as I mentioned earlier on within this section,
whenever you've bought a domain or you're setting up a website,
the actual hosting company will either provide you with access
to the C panel or will provide you with FTP credentials
that you can then use to upload your website files
and data to the actual directory of the web server.
Now, irregardless of what directory FTP has
been configured to actually provide or to actually serve
in terms of its purpose, really what we're
going to be trying to utilize or what we're really
going to be trying to do is find a way of accessing or gaining
access to the FTP server.
And from that stage or from that point on,
you can actually upload malicious files or binaries
and execute them in order to obtain a reverse shell.
But that is something that we will
be exploring later on and probably in another course.
And again, let's take a look or let's
explore FTP authentication.
So FTP authentication requires a username and password
combination in order to gain access to the FTP server.
And as a result, we can perform a brute force attack
on the FTP server in order to identify
legitimate credentials.
Now, in some cases, and this is very, very, very important,
FTP servers may be configured to allow anonymous access.
What is anonymous access?
Well, anonymous access essentially
allows anyone to access or log into the FTP server
without providing any legitimate credentials.
Now, of course, this is not something
that you will see in the wild a lot
because FTP, whenever it's enabled,
is kept or secured quite well.
And really, the only access vector or exploitation vector
is either to perform a brute force
or to exploit an inherent vulnerability
within the specific version and within the specific service
version of FTP.
Now, in this video, we will not be
exploring the process of exploiting
an inherent vulnerability within FTP for a few reasons.
Unlike Windows, Linux essentially allows or utilizes
services or packages that have been
developed by many individuals, companies,
and essentially utilize third party applications or software,
which means that when it comes down
to inherent vulnerabilities, it will really
depend on the actual version of FTP that's running.
And there are really tons of FTP services
for Linux, ranging from vsftpd to ProFTPd, et cetera, et
cetera.
And I've already covered the process
of exploiting an inherent vulnerability within vsftpd
in my Metasploit course, which you can check out.
In this video, we will be primarily
be focusing on performing a brute force on FTP
and then gaining access to the actual FTP server.
So now that we have an understanding of what FTP is
and how we can exploit it, let's get
started with the practical section of this video.
This video already has a Lab Environment attached to it.
So you can start up the Lab Environment.
And I'll see you within the Lab Environment.
All right.
So I'm back within the Lab Environment.
And in this case, you will not be
provided with a graphical user interface.
You'll just be provided with a terminal interface.
So the first step is to identify the target IP, which
you can easily do by typing in ifconfig and taking
a look at the IP attached to ethernet 1.
The target IP address is going to be on the same subnet.
So it's going to be the next IP.
So your Kali Linux system will be the second IP
within the subnet.
And the target IP will be on the third IP.
So in your case, the subnet will be different.
All you need to do is just change the actual 2 to a 3.
And that is the target IP.
So I'm just going to copy that there.
And I'm going to clear out my terminal.
And we're going to perform an Nmap scan to identify you
what version of FTP is running on the target.
And we can do that by saying Nmap SV to perform a service
version detection scan.
And we can then paste in the target IP.
So I'll change the 2 to 3.
And I'll hit emter.
And there, we are can see the Nmap scan is complete.
And you can see that in this case,
it's running ProFTPd version 1.3.5a.
I do believe there is an inherent vulnerability
pertinent to this particular version of FTP.
But I'll let you explore that and how it can be exploited.
Now, in terms of anonymous access
there are various ways you can actually
check if anonymous access has been configured.
You can either log in directly, so I
can say FTP and then provide the target IP address
and hit enter.
And then I can say anonymous.
And hit enter and hit enter.
And as you can see, login is incorrect.
Login failed.
So anonymous access is disabled.
You can also check whether this particular FTP server supports
anonymous access through the use of an Nmap script
that is called FTP anonymous or anon.
And if I list out the contents of the Directory
or the list of Nmap scripts, you can see under the user share
Nmap scripts directory, I can grip
and say I only want to find Nmap scripts or FTP Nmap scripts.
You can see that you have the FTP anon script.
So you can essentially run that script
to identify whether it is indeed vulnerable.
All right.
So that's how to identify whether anonymous access has
been configured.
In this case, however, we are going
to be performing a brute force.
And probably the most powerful tool that you can do this with
is hydra All right.
So I'm just going to zoom in here.
And in order to perform the brute force with hydra
we simply type in hydra.
And I've already used hydra before within this course,
and it really is very simple.
So the first thing we need to specify
is the usernames that we want to perform the brute force with.
In the case of this lab environment,
the actual username or word list for the usernames
is under user share, metasploit framework,
under data, world lists.
And we are going to be using common underscore users.txt.
Now in a real engagement or pen testing environment,
you obviously want to change this with your own word list.
However, in this case, we're just
going to utilize the common users word list.
And then for the passwords, we are
going to say user share, metasploit framework, data,
word lists.
And under the word list directory,
we are going to use the unix passwords.txt file.
We then need to specify the target IP.
So I'll paste that in there.
And I'll change the actual 2 into a 3.
And then we can specify the amount
of threads we want to run because FTP brute forcing can
actually take or temporarily bring down the FTP server.
So you always want to be cognizant of that.
So I'll set the threads to 4.
And then we specify the protocol.
In this case, the protocol is FTP.
And we can hit enter.
And that is going to begin the brute force.
So we're going to give this a couple of seconds.
And let's see what credentials we're able to identify.
All right.
So the FTP brute force is complete.
And as you can see, it tells us right over here,
seven valid passwords found, which is awesome.
And right over here, you can see we have a few accounts that
look very interesting.
We have sysadmin and administrator.
So again, these are the usernames and the password.
So we can actually try and log in
to verify whether they are indeed legitimate.
So I can say FTP and then specify the target IP
right over here.
And then I can start off with the sysadmin user.
So that we are sysadmin.
And the password is 654321.
Hit enter.
There we are.
We can see we get a 230 response.
User sysadmin logged in.
And we can list out the contents of this directory.
And that is the secret.txt file you are supposed to get.
And there are a few other flags that you can actually
get by accessing all of these other user accounts.
However, for the case of this practical demonstration,
we'll really only be taking a look at a few accounts.
So again, if you want to download a file,
you can simply type in get.
And then we can say get secret.txt.
And if we then exit from our FTP session,
and we list all the contents of our root directory,
you can see we have these secret files here.
So I can say cat secret.txt.
And that's the first flag.
And of course, we can try and log in with the administrator
as well.
So I'll just say FTP.
And then we'll say administrator.
And the password is tweety.
There we are.
And we can list all the contents of this directory.
And we have another secret file.
And so on and so forth.
All right.
So that is how to perform a brute force on an FTP server.
And in this case, we were able to identify
seven valid accounts or rather seven valid passwords
and their user account names, which is excellent.
Now, for this particular version of ProFTPd,
if we just perform an Nmap scan on the target again.
I just want to highlight something here
that could be very interesting to you.
You can see that it's running ProFTPd 1.3.5a.
If we run a searchsploit query.
Searchsploit is a command line utility
that allows you to search for exploits on the ExploitDB
database.
So I can say ProFTPd and hit enter.
And you can see there's a list of exploits
that you can actually use in this case.
And of course, you can test them out.
However, be sure to take note of the actual version.
In this case, it's running ProFTPd 1.3.5.a.
And we have any exploits for that specific version.
No.
Not really.
We have a Metasploit module here.
So you can actually try that out yourself.
And this is how to identify inherent vulnerabilities
within the specific version of FTP that's
running on the target.
And as I said, there's tons of FTP services or softwares
that you can actually find running on a target.
So that is going to conclude the practical demonstration
side of this video.
In the next video, we will be exploring
the process of exploiting SSA in order
to gain remote access to the target system.
So I'll see you there.