Setup
- Target: Metasploitable 2:
10.0.0.10
$ msfconsole -q -x 'db_status; set VERBOSE true; setg RHOSTS 10.0.0.10; setg LHOST tap0'
[*] Connected to msf. Connection type: postgresql.
VERBOSE => true
RHOSTS => 10.0.0.10
LHOST => tap0
msf >
auxiliary/scanner/ftp/anonymous
This works as expected, and is able to detect anonymous FTP login successfully
msf > use auxiliary/scanner/ftp/anonymous
msf auxiliary(scanner/ftp/anonymous) >
msf auxiliary(scanner/ftp/anonymous) > options
Module options (auxiliary/scanner/ftp/anonymous):
Name Current Setting Required Description
---- --------------- -------- -----------
FTPPASS mozilla@example.com no The password for the specified username
FTPUSER anonymous no The username to authenticate as
RHOSTS 10.0.0.10 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
RPORT 21 yes The target port (TCP)
THREADS 1 yes The number of concurrent threads (max one per host)
View the full module info with the info, or info -d command.
msf auxiliary(scanner/ftp/anonymous) > run
[*] 10.0.0.10:21 - Connecting to FTP server 10.0.0.10:21...
[*] 10.0.0.10:21 - Connected to target FTP server.
[*] 10.0.0.10:21 - Authenticating as anonymous with password mozilla@example.com...
[*] 10.0.0.10:21 - Sending password...
[+] 10.0.0.10:21 - 10.0.0.10:21 - Anonymous READ (220 (vsFTPd 2.3.4))
[*] 10.0.0.10:21 - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(scanner/ftp/anonymous) >
msf auxiliary(scanner/ftp/anonymous) > creds
Credentials
===========
id host origin service public private realm private_type JtR Format cracked_password
-- ---- ------ ------- ------ ------- ----- ------------ ---------- ----------------
3 10.0.0.10 10.0.0.10 21/tcp (ftp) anonymous mozilla@example.com Password
msf auxiliary(scanner/ftp/anonymous) >
msf auxiliary(scanner/ftp/anonymous) > creds -d
[...]
[*] Deleted 1 creds
msf auxiliary(scanner/ftp/anonymous) >
auxiliary/scanner/ftp/ftp_login
Fails to successfully detect anonymous FTP login successfully:
msf auxiliary(scanner/ftp/anonymous) > use auxiliary/scanner/ftp/ftp_login
msf auxiliary(scanner/ftp/ftp_login) >
msf auxiliary(scanner/ftp/ftp_login) > set ANONYMOUS_LOGIN true
ANONYMOUS_LOGIN => true
msf auxiliary(scanner/ftp/ftp_login) >
msf auxiliary(scanner/ftp/ftp_login) > options
Module options (auxiliary/scanner/ftp/ftp_login):
Name Current Setting Required Description
---- --------------- -------- -----------
ANONYMOUS_LOGIN true yes Attempt to login with a blank username and password
BLANK_PASSWORDS false no Try blank passwords for all users
BRUTEFORCE_SPEED 5 yes How fast to bruteforce, from 0 to 5
DB_ALL_CREDS false no Try each user/password couple stored in the current database
DB_ALL_PASS false no Add all passwords in the current database to the list
DB_ALL_USERS false no Add all users in the current database to the list
DB_SKIP_EXISTING none no Skip existing credentials stored in the current database (Accepted: none, user, user&realm)
PASSWORD no A specific password to authenticate with
PASS_FILE no File containing passwords, one per line
Proxies no A proxy chain of format type:host:port[,type:host:port][...]. Supported proxies: sapni, socks4, socks5, socks5h, http
RECORD_GUEST false no Record anonymous/guest logins to the database
RHOSTS 10.0.0.10 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
RPORT 21 yes The target port (TCP)
STOP_ON_SUCCESS false yes Stop guessing when a credential works for a host
THREADS 1 yes The number of concurrent threads (max one per host)
USERNAME no A specific username to authenticate as
USERPASS_FILE no File containing users and passwords separated by space, one pair per line
USER_AS_PASS false no Try the username as the password for all users
USER_FILE no File containing usernames, one per line
VERBOSE true yes Whether to print output for all attempts
View the full module info with the info, or info -d command.
msf auxiliary(scanner/ftp/ftp_login) >
msf auxiliary(scanner/ftp/ftp_login) > run
[*] 10.0.0.10:21 - 10.0.0.10:21 - Starting FTP login sweep
[-] 10.0.0.10:21 - 10.0.0.10:21 - LOGIN FAILED: : (Incorrect: )
[*] 10.0.0.10:21 - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(scanner/ftp/ftp_login) >
msf auxiliary(scanner/ftp/ftp_login) > creds
Credentials
===========
id host origin service public private realm private_type JtR Format cracked_password
-- ---- ------ ------- ------ ------- ----- ------------ ---------- ----------------
msf auxiliary(scanner/ftp/ftp_login) >
Setup
10.0.0.10auxiliary/scanner/ftp/anonymous
This works as expected, and is able to detect anonymous FTP login successfully
auxiliary/scanner/ftp/ftp_login
Fails to successfully detect anonymous FTP login successfully: