02.FAWN (FTP)
OVERVIEW
Target Service: FTP
Attack: Brute Force
Vulnerability: Authentication Vulnerability – Weak Credentials
MITRE Tactics & Technques: TA0001: Initial Access
- T1078: Valid Accounts
T1110.001: Brute Force – Password Guessing
- TA0006: Credential Access
Summary: The target system exposed an FTP service with no authentication hardening,
allowing access via default or easily guessable credentials. A brute-force
attempt using common username-password combinations succeeded, revealing a
serious authentication misconfiguration.root@oco:~$ sudo openvpn ~/Downloads/starting_point.ovpnENUMERATE SERVICES
root@htb:~$ nmap -sV -T4 10.129.188.72 -p-
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 3.0.3VULNERABILITY SCANNING
root@htb:~$ nmap -sV -sC -T4 10.129.188.72 -p 21
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 3.0.3
| ftp-syst:
| STAT:
| FTP server status:
| Connected to ::ffff:10.10.14.16
| Logged in as ftp
| TYPE: ASCII
| No session bandwidth limit
| Session timeout in seconds is 300
| Control connection is plain text
| Data connections will be plain text
| At session startup, client count was 5
| vsFTPd 3.0.3 - secure, fast, stable
|_End of status
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_-rw-r--r-- 1 0 0 32 Jun 04 2021 flag.txt
Service Info: OS: Unix
* the -SC runs the default set of Nmap scripts (NSE scripts), which typically include
scripts for service enumeration, version detection, and other basic checks.
root@htb:~$ sudo nmap --script=vuln 10.129.188.72 -p 21
* the --script=vuln will run scripts that focus specifically on detecting known
vulnerabilities in the service running on port 21
- e.g., weak FTP configurations, or known vulnerabilities in the FTP service
- if no results are found then the service may be fully patched!FOOTHOLD/COMPROMISE
Last updated