[OPENING MUSIC]
FTP enumeration.
In this video, we are going to be taking a look at how
to utilize the various Metasploit
framework auxiliary modules to enumerate
as much information as possible from FTP.
So first and foremost, what is FTP?
FTP stands for the File Transfer Protocol.
This is a file transfer protocol that is typically
hosted on port 21, and that, of course,
is TCP, and is used to facilitate
file sharing between a server and client or multiple clients.
It is also frequently deployed or used
as a means of transferring files to and from the directory
of a web server.
So if you have ever bought a domain name
and set up a website, you know that you
can utilize FTP to essentially transfer your website
files to the server and you can also do that vice versa,
in that you can download files from the web server
to your system, to your local system.
And of course, in order for you to do this,
you will need to authenticate to the FTP server.
So FTP, essentially, handles authentication
in the form of a username and password combination.
So you log in to the FTP server, you then
provide a username and a password and if successful,
you'll get access to the FTP server and the directory that
has been configured.
And you can then download files from that particular directory,
or you can upload files to it.
You can again work, and essentially, transfer
files between the FTP server and your local system.
Now, we can use multiple auxiliary modules
to enumerate as much information as possible
from the FTP service.
And the type of information that we're after
is typically the version of FTP that's running.
Secondly, we can also perform a brute force attack on it
to try and identify any username and password combinations
that we can use to log in or authenticate to the FTP server.
So we are going to be taking a look at various techniques
and various modules that we can use to essentially enumerate
as much information as possible from an FTP server.
So let's get started with the lab.
All right, so I'm back on the lab environment,
and we can get started now, firstly, by--
first and foremost by starting the PostgreSQL service.
So we can actually do that by typing in service
postgresql start, just to ensure that we can actually
interact with the Metasploit framework database.
Once that is done, as you can see
everything's good on that front, we can now get the target IP.
That can be done by typing in ifconfig.
And of course, we're looking for the ethernet one interface.
And we know that the target IP is always
going to be the following IP address with a three
instead of a two.
So again, we have copied that.
And we can now start up the Metasploit framework console,
which I will do.
And that should just take a few seconds to start up,
after which we can begin creating our workspace
and then begin taking a look at the various modules
that we can use.
So first and foremost, we'll say workspace, add,
and then we'll just call this FTP_enum.
And we are currently within that workspace.
And again, we can confirm that by saying workspace.
There we are.
And let's get started.
So the first module that we want to take a look at
is the auxiliary module FTP version check, right?
And which is, essentially, used to check
for the version of FTP.
However, let us perform a port scan
to ensure that the target is, in fact, running FTP.
So again, I'll just search for port scan.
There we are.
And we will be using the following modules,
so we'll use auxiliary/scanner/portscan/tcp,
which I'll just copy right over there.
There we go.
And we're going to say use, of course.
I'm going to say use, paste that in.
So it's currently active.
I'll just get the target IP again.
So I'll just copy that, make sure that I have it on hand.
There we go, fantastic.
We can now say show options.
And then we're going to set the our RHOST option, which
is the target IP.
And we're just going to type in the IP there.
And of course, remember to change the two to a three, that
is the target IP.
And all we need to do is just hit
Run, because we know that FTP is on port 21.
And that means that we don't have
to increase the port range that's being scanned.
And as you can see, immediately, we're
able to identify that FTP is actually open.
So port 21 open.
However, we don't know what service version is running,
so we can't actually perform any vulnerability identification
or anything like that.
So in order to do this, what we're going to do
is let me just copy the IP there just
so that we have it on hand.
We're just going to go back.
And now, we are going to search for FTP auxiliary modules,
which again, can be done by typing in search FTP.
And in this case, you can see we have quite a few FTP modules
here, and most of them look like their exploits
and of course, we then have the auxiliary modules.
If we want to limit the search results, what we can do
is we can say search and then we can specify the type here.
And the type is going to be auxiliary.
And then we can provide a name, so we can say name FTP.
We hit Enter, and that's going to reduce
the amount of results here that are going to be displayed.
And we are primarily looking for the scan auxiliary modules,
and the one that we're interested in
is this one right over here.
So that is auxiliary/scanner/ftp/ftp
version, and it essentially performs a version scanning
which will allow us to detect what version of FTP is running.
And we can then copy that and we're going to say use.
Paste in the module name right over there,
clear up the options.
Let me just get the target IP because, again, I copied it
to my previous clipboard.
And we can now show the options for this particular module.
Show Options, and what we need to provide is the target IP.
The port has been configured to 21, which is perfectly fine.
If you find a target that is running
FTP on a different port, then you also need to change that.
We don't need to provide the FTP user and password
because we don't have them.
And as you can see, they are not required
under the required column.
So we'll say set our hosts based in the IP.
And of course, change the two to a three.
Hit Enter.
And then hit Run.
And as you can see, it's able to detect the version of FTP
that's running.
And you can see its ProFTPD 1.3.5 A.
And of course, it gives you the other host information.
So this is the FTP banner.
Now, this information is very useful,
because we can use it to identify vulnerabilities
for this specific version of ProFTOP.
So for example, if I say search ProFTDP and I hit Enter,
you can see that we can identify various exploits for ProFTPD.
However, this version of ProFTPD is really not
vulnerable to any particular exploit
apart from this one here, which you can see.
In this case, we're not going to be using this, because we are
not at the exploitation phase.
We're pretty much working with enumeration here.
So that's the FTP version check module,
and it's extremely helpful in identifying the exact version
there.
So we're just going to clear that out.
And I'm going to go back a step, and we
are going to take a look at the next FTP auxiliary module,
which is the FTP brute force module, which essentially
allows us to perform a brute force in order to identify
the username and password.
And of course, this will depend on the strength of the word
list that you utilize.
And in this case, I'm just going to search again for the module.
So I'll use my previous command, search, the type is auxiliary,
and the name is FTP.
And the module that we're looking for is this one right
over here, auxiliary/scanner/ftp/ftp_login.
As you can see, this is an FTP authentication scanner.
So we're just going to copy it right over there.
Just get that information and then paste that in there.
And it's currently active.
If we show the Options, the options that we need to set
are going to be the RHOST option, which is the target IP
address.
The port is configured already, so our port is done.
What we then need to provide is either
a username that we want to test for,
or a user file that contains a list of usernames
that we want to brute force.
And we also need to provide a password file that, again,
is essentially a series of passwords
that we want to perform our brute force with.
We can also change the brute force speed
to, again, as you can see, it says
how fast to brute force from zero to five,
and it's currently set to five.
So again, based on the information,
you have you can either provide a single password that you want
to test or a single username, and in this case
we don't have any, so we're going to provide a user
file and the password file.
Now, the Metasploit framework comes
with a really, really powerful or really good
list of word lists that we can utilize.
However, before we do that, let's, again, paste in the IP
here, the target IP.
So I'll just copy that there.
And we will say set our hosts based on the IP there.
Sorry, let's change that to a three.
There we go.
And now, what we want to do is, of course,
set the user list, or rather the user file,
and then the password file.
So we're going to say set user file
and we then need to specify the location
where the user file is stored.
In this case, we will be utilizing
one of the inbuilt Metasploit framework username lists,
or user lists, as it were.
And this is found under the user share directory
under the Metasploit framework folder,
as we have already taken a look at when
we were exploring the Metasploit framework architecture.
We then want to head over into data, word lists,
and we're looking for common usernames .txt.
So that's the file that contains a list of usernames
that we can use to perform the brute force attack.
I'm going to hit Enter.
As you can see, that's been set successfully.
We are now going to set the password file,
so I'm just going to get rid of user
here and change it to password files.
So pass, set pass file.
And instead of using common users,
we're going to use Unix passwords or the Unix passwords
parse list.
So unix_passwords.txt, hit Enter,
and it has set the password word list there.
All right, excellent.
So we have all the options configured.
We can now hit Run, and that is going to begin the brute force.
Now again, depending on the number
of usernames and passwords within the user
list and the password list, it's going to take time.
So again, as you can see, it's going through each username
and password combination.
And when it actually has a match,
it will be highlighted in green.
And that's what I'm going to wait for.
So I'm just going to let this perform the brute force.
All right, so it looks like we were
able to find a username and password combination that
was successful, or that we can use to log in to the FTP server
and the credentials are listed here.
So sysadmin, and the password is this number combination,
which is essentially one, two, three, four, five,
six in a reversed format.
So what we can do is just terminate it here.
Of course, you can let it run to see whether you will
be able to identify any other usernames and passwords,
and you can see it actually completed
without finding any others.
So these are the credentials that we'll be using.
Now, in order to log in to an FTP server,
we will need to exit or we actually
can try and log in directly from the Metasploit framework
console, but we need the target IP.
So let me just copy that there.
If I just show the options here, let me just show Options.
There we go.
And we'll just copy the IP.
What we can say is let's see if we can log in.
So FTP, and I'll try and open up the docu--
let's see if we can log in.
There we are.
Looks like we can actually interact with FTP.
So I'm going to say FTP, and then we
provide the target IP there.
And we then want to copy the password.
So we know that the username is sysadmin,
and the password is this combination of numbers.
So we'll hit Enter, and it's going
to say service not available, remote servers,
closed connection.
That is probably because of the brute force,
and this is something that you need to keep into consideration
or that you need to keep in mind is that a brute force can
sometimes cause a service to actually be overwhelmed,
or you can actually initiate a DDOS that, again,
will take down the service.
So you want to give that a few seconds.
So while we're waiting for that to reset, what we can do
is take a look at the other modules
that we can use or rather the final module that we'll
be exploring.
And in this case, the module name
or the module that we will be exploring
is the anonymous login module, which will essentially
check whether we can log in to the FTP server anonymously.
So again, I'm just going to give this a few seconds.
I'm just going to clear that out.
There we are.
And let's see if we can access that.
I'm going to hit back.
Let me just terminate there, and we can actually just exit here.
So in order to use the FTP anonymous login module,
again, we can essentially just say search and then the type,
we can set to auxiliary.
And then the name is going to be FTP.
And we're looking for the module that allows us to log in.
So this is the module here.
So auxiliary/scanner/FTP/anonymous,
this will check for anonymous FTP access.
So again, it'll actually detect and tell us
whether we can use this.
So we're just going to copy the module name here and then paste
it.
And that should be active.
So again, let me just get the IP here real quick.
And we can just copy that and then show the options.
There we go.
And we can now, again, set the RHOST option.
And again, we don't need to provide the username
and password.
Although, we'll take a look at how to authenticate
in a few seconds.
If we say set our hosts and we paste in that
and change that to three and then hit Run,
it's going to run the module.
And let's see whether the target FTP
server is vulnerable to an anonymous FTP login.
And as you can see, it is not, which again, we expected.
But in many cases, you always want
to run this particular auxiliary module as it can reveal, again,
quite a bit of important information in regards
to whether or not you can access the FTP server remotely,
or rather, anonymously.
So now that we've done that, we can actually
try and log in to the FTP server as I did previously.
And I'm just going to say FTP, hit Enter, and as you can see,
it says we are connected.
And it looks like we need to provide the username
and password.
So what I'm going to do is I'm just
going to exit from the Metasploit framework console.
So let me just exit.
All right, so once exited, what we can say
is FTP and then paste in the IP there.
And then we'll be prompted to enter
a username, which in this case, we know is sysadmin.
And then we know that the password is six, five, four,
three, two, one.
Hit Enter.
And it says, it gives us a status code 230,
user sysadmin logged in.
Remote system type is unix, so we know it's a Linux system.
And then, of course, we can list out
the contents of the directory.
And you can see that we have a file here called secret.txt.
So we can actually download this file onto our VM
or onto our system by saying get secret.txt.
And that is going to download it for us.
As you can see, that transfer is complete.
And now we can exit from the FTP server,
and if we list out the contents of our directory,
you can see we have the secret.txt file here.
And we can tap out the contents of that file and there you go.
So again, FTP enumeration is extremely important
not only in identifying the service version,
but also identifying potential exploits
for that specific service version.
As I said or as I've mentioned, you
can also perform an FTP brute force
in order to see whether you can identify any username
and password combination.
If you're already able to identify a username,
then the brute force might be more effective.
And in our case, we were able to find a username and password
combination that we actually use to log in.
And as you can see, we were able to get a hold of some data,
and in this case, the lab environment
has been set up to show you that this can be quite dangerous.
And again, as an attacker, this data-- or we
could have had access to the entire web
server or any other directory that,
again, has been configured to be shared via FTP.
You can also use the FTP anonymous login module
to actually check and see whether you
can log in to the FTP server anonymously without providing
any credentials.
And that's an equally important module.
So that is going to be it in regards
to the practical section and the lab environment.
So let me just switch back to my slides.
In the next video, we are going to be taking a look at how
to perform SMB enumeration.
SMB is quite an important protocol to understand
and of course to learn how to perform enumeration on,
so that you can discover various vulnerabilities.
You can also discover the version of SMB that's running,
as well as perform an SMB brute force attack.
So that's what we're going to be taking
a look at in the next video.