Original subtitles

[MUSIC LOGO]

We're going to jump into our next protocol.

It's FTP, which stands for File Transfer Protocol.

And like you would expect, it's used

for storing files on a server and being

able to access them remotely.

So let's take a look at what that actually means.

We've got our machine.

Check our IP address.

We are 192.213.157.2.

So let's ping 192.213.157.3, and it's up.

Let's run Nmap scan.

And we get back port 21.

And it's says service is FTP.

So let's hone in and do an operating system scan

and a services scan on port 21.

Port 21 is the default FTP port.

You could configure it to be anywhere.

You can only keep it where it's at.

It's running ProFTPD 1.3.5.

And it was able to fingerprint and say that it's Linux.

2.6 is its best guess.

And that's fine.

We can live with that.

It's probably some version of Linux.

So from there, we could try some things.

If we do ftp, which will just run the host

software on our computer to reach out,

we can put in the server.

And it asks for a name.

We can go with nothing.

Try anonymous.

And nothing for the password.

Said login failed.

So we'll just say bye.

Let's try to figure out what some usernames

and passwords would be.

We're going to use Hydra.

Hydra is a brute forcing program that we have

or that we can get.

So with Hydra, you do tack-L for your logins,

uppercase if you want to do a list,

and we do for the user/share/metasploit

framework/data/wordlists/common users.txt.

You'll get familiar with all your wordlists.

They're all in user share.

Tab completion is also your friend.

If you hit Tab twice, it'll show you more information.

So like, I want data wordlists and then unix passwords.

And then, we tell it the IP address that we're attacking

and the service, ftp.

That's it.

Hydra capital L, the login wordlist, capital P,

the password wordlist, our ip and ftp.

Then we'll let it go.

And that went pretty fast.

The login sysadmin has a password of 654321.

And what it's doing is, it's trying a username

and then it tries passwords.

It tries all the passwords for that username.

And then it'll try the next username.

It'll try all those passwords.

So it worked.

We got quite a list.

We would want to write all these down and save them

because now what we can do is ftpd.

Let's just hit up a few times.

Sysadmin and 654321.

And it says that we're logged in.

We can do an ls.

You can run help if you want to know all the commands.

But ls shows you the list and their secret.txt.

So we can get secret.txt and it says it sent it.

So then, we can say goodbye.

We'll look at ours, and we have secret.txt.

And it's that code right there.

Another way we can go about this is using an Nmap brute forcer

So what we'll do is, we know sysadmin was in there.

Let's put it in this little single wordlist called users.

I cat it out, and it's there.

OK.

Let's go back to our Nmap scan.

And what we can do is script.

We'll do the ftp-brute with script-args userdb equals

root/users.

We'll do port 21 on that machine.

And let's see what the Nmap FTP brute forcer

script returns for us using that username of sysadmin.

And it came back that sysadmin 654321 were valid credentials.

Fairly straightforward.

So it utilizes a username and password.

And then, you can get files.

Depending on how it's configured,

there might be anonymous login, which we'll look at next.

But that's FTP in a nutshell and how we can use it.

Could we put files there?

Could we find useful files that were just not stored securely?

And that may or may not be the pen test itself.

It's really not.

Usually, that's going to be a foothold or enumeration

to then gain full access.

Because that's what we want.

We want full access.

And if you're thinking like a defender,

then you want to block all that.

You want to lock this stuff down.

So let's move on.