All language subtitles for 1. FTP

[MUSIC LOGO]

We're going to jump
into our next protocol.

It's FTP, which stands for
File Transfer Protocol.

And like you would
expect, it's used

for storing files on
a server and being

able to access them remotely.

So let's take a look at
what that actually means.

We've got our machine.

Check our IP address.

We are 192.213.157.2.

So let's ping
192.213.157.3, and it's up.

Let's run Nmap scan.

And we get back port 21.

And it's says service is FTP.

So let's hone in and do
an operating system scan

and a services scan on port 21.

Port 21 is the default FTP port.

You could configure
it to be anywhere.

You can only keep
it where it's at.

It's running ProFTPD 1.3.5.

And it was able to fingerprint
and say that it's Linux.

2.6 is its best guess.

And that's fine.

We can live with that.

It's probably some
version of Linux.

So from there, we
could try some things.

If we do ftp, which
will just run the host

software on our
computer to reach out,

we can put in the server.

And it asks for a name.

We can go with nothing.

Try anonymous.

And nothing for the password.

Said login failed.

So we'll just say bye.

Let's try to figure
out what some usernames

and passwords would be.

We're going to use Hydra.

Hydra is a brute forcing
program that we have

or that we can get.

So with Hydra, you do
tack-L for your logins,

uppercase if you
want to do a list,

and we do for the
user/share/metasploit

framework/data/wordlists/common
users.txt.

You'll get familiar
with all your wordlists.

They're all in user share.

Tab completion is
also your friend.

If you hit Tab twice, it'll
show you more information.

So like, I want data wordlists
and then unix passwords.

And then, we tell it the IP
address that we're attacking

and the service, ftp.

That's it.

Hydra capital L, the
login wordlist, capital P,

the password wordlist,
our ip and ftp.

Then we'll let it go.

And that went pretty fast.

The login sysadmin has
a password of 654321.

And what it's doing is,
it's trying a username

and then it tries passwords.

It tries all the passwords
for that username.

And then it'll try
the next username.

It'll try all those passwords.

So it worked.

We got quite a list.

We would want to write all
these down and save them

because now what
we can do is ftpd.

Let's just hit up a few times.

Sysadmin and 654321.

And it says that
we're logged in.

We can do an ls.

You can run help if you want
to know all the commands.

But ls shows you the list
and their secret.txt.

So we can get secret.txt
and it says it sent it.

So then, we can say goodbye.

We'll look at ours,
and we have secret.txt.

And it's that code right there.

Another way we can go about this
is using an Nmap brute forcer

So what we'll do is, we
know sysadmin was in there.

Let's put it in this little
single wordlist called users.

I cat it out, and it's there.

OK.

Let's go back to our Nmap scan.

And what we can do is script.

We'll do the ftp-brute with
script-args userdb equals

root/users.

We'll do port 21
on that machine.

And let's see what the
Nmap FTP brute forcer

script returns for us using
that username of sysadmin.

And it came back that sysadmin
654321 were valid credentials.

Fairly straightforward.

So it utilizes a
username and password.

And then, you can get files.

Depending on how
it's configured,

there might be anonymous login,
which we'll look at next.

But that's FTP in a nutshell
and how we can use it.

Could we put files there?

Could we find useful files that
were just not stored securely?

And that may or may not
be the pen test itself.

It's really not.

Usually, that's going to be
a foothold or enumeration

to then gain full access.

Because that's what we want.

We want full access.

And if you're thinking
like a defender,

then you want to block all that.

You want to lock
this stuff down.

So let's move on.