{"id":106,"date":"2007-03-17T16:59:39","date_gmt":"2007-03-17T16:59:39","guid":{"rendered":"http:\/\/pentestmonkey.net\/?p=106"},"modified":"2011-08-31T16:12:28","modified_gmt":"2011-08-31T16:12:28","slug":"ftp-user-enum","status":"publish","type":"post","link":"https:\/\/pentestmonkey.net\/tools\/user-enumeration\/ftp-user-enum","title":{"rendered":"ftp-user-enum"},"content":{"rendered":"<p>Username guessing tool for use against the default Solaris ftp service and GNU inetutils ftpd.\u00a0 Recent changes are detailed in the <a href=\"..\/tools\/ftp-user-enum\/CHANGELOG\">CHANGELOG.<\/a><\/p>\n<p>Download ftp-user-enum v1.0 <a href=\"\/tools\/ftp-user-enum\/ftp-user-enum-1.0.tar.gz\">here<\/a>.<\/p>\n<p>SHA1sum: 2fbd86dba9f701627d415ed76100b2768b271862<\/p>\n<p>MD51sum: c19ec3eb1eab6282a16514b51eb5f1c6<\/p>\n<p>User documentation are also avaialble in <a href=\"\/tools\/ftp-user-enum\/ftp-user-enum-user-docs.pdf\">PDF<\/a> format.<\/p>\n<p><!--more--><\/p>\n<p>&nbsp;<\/p>\n<h1 align=\"center\">ftp-user-enum User Documentation<\/h1>\n<p>&nbsp;<\/p>\n<h2><a title=\"SECTION00010000000000000000\" name=\"SECTION00010000000000000000\"><\/a> Contents<\/h2>\n<ul>\n<li><a title=\"tex2html11\" name=\"tex2html11\" href=\"ftp-user-enum-user-docs.html#SECTION00020000000000000000\"><\/a>Overview<\/li>\n<li><a title=\"tex2html12\" name=\"tex2html12\" href=\"ftp-user-enum-user-docs.html#SECTION00030000000000000000\"><\/a>Installation<\/li>\n<li><a title=\"tex2html13\" name=\"tex2html13\" href=\"ftp-user-enum-user-docs.html#SECTION00040000000000000000\"><\/a>Usage<\/li>\n<li><a title=\"tex2html14\" name=\"tex2html14\" href=\"ftp-user-enum-user-docs.html#SECTION00050000000000000000\"><\/a>Some Examples\n<ul>\n<li><a title=\"tex2html15\" name=\"tex2html15\" href=\"ftp-user-enum-user-docs.html#SECTION00051000000000000000\"><\/a>Against Solaris in.ftpd<\/li>\n<li><a title=\"tex2html16\" name=\"tex2html16\" href=\"ftp-user-enum-user-docs.html#SECTION00052000000000000000\"><\/a>Against GNU inetutils ftpd<\/li>\n<\/ul>\n<\/li>\n<li><a title=\"tex2html17\" name=\"tex2html17\" href=\"ftp-user-enum-user-docs.html#SECTION00060000000000000000\"><\/a>License<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<h1><a title=\"SECTION00020000000000000000\" name=\"SECTION00020000000000000000\"><\/a>Overview<\/h1>\n<p>ftp-user-enum is a tool for enumerating OS-level user accounts via the ftp service. As of release v1.0 it is known to work against the default Solaris in.ftpd and GNU inetutils ftpd. It should be fairly simple to modify to script to work against other vulnerable ftp servers such as:<\/p>\n<div align=\"center\">\n<table border=\"0\" cellpadding=\"3\">\n<tbody>\n<tr>\n<td align=\"left\">BlackMoon FTP Server<\/td>\n<td align=\"left\">http:\/\/xforce.iss.net\/xforce\/xfdb\/12046<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">ArGoSoft FTP Server<\/td>\n<td align=\"left\">http:\/\/xforce.iss.net\/xforce\/xfdb\/18721<\/td>\n<\/tr>\n<tr>\n<td align=\"left\">MegaBrowser FTP Server<\/td>\n<td align=\"left\">http:\/\/www.securityfocus.com\/archive\/1\/323813<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<h1><a title=\"SECTION00030000000000000000\" name=\"SECTION00030000000000000000\"><\/a>Installation<\/h1>\n<p>ftp-user-enum is just a stand alone PERL script, so installation is as simple as copying it to your path (e.g. \/usr\/local\/bin). It has only been tested under Linux so far.<\/p>\n<p>It depends on the following PERL modules which you may need to install them first:<\/p>\n<ul>\n<li>Socket<\/li>\n<li>IO::Handle<\/li>\n<li>IO::Select<\/li>\n<li>IO::Socket::INET<\/li>\n<li>Getopt::Std<\/li>\n<\/ul>\n<p>If you have PERL installed, you should be able to install the modules from CPAN:<\/p>\n<pre> # perl -MCPAN -e shell\r\n cpan&gt; install Getopt::Std<\/pre>\n<h1><a title=\"SECTION00040000000000000000\" name=\"SECTION00040000000000000000\"><\/a>Usage<\/h1>\n<p>ftp-user-enum simply needs to be passed a list of users and at least one target running an ftp service. Here&#8217;s the usage message:<\/p>\n<pre> Usage: ftp-user-enum.pl [options] (-u username|-U file-of-usernames) (-t host|-T file-of-targets) \r\n\r\n Enumerates users via FTP daemon specific bugs:\r\n - Solaris FTPd responds differently to \"CWD ~user\" and \"CWD ~nosuchuser\" commands\r\n - GNU Inetutils responds differently \"USER user\" and \"USER nosuchuser\" commands \r\n\r\n options are:\r\n         -m n     Maximum number of resolver processes (default: 5)\r\n         -u user  Check if user exists on remote system\r\n         -U file  File of usernames to check via ftp service\r\n         -M mode  Mode for enumerating users: \"sol\" for Solaris FTPd or\r\n                 \"iu\" GNU Inetutils ftpd.  Default (default: sol)\r\n         -t host  Server host running ftp service\r\n         -T file  File of hostnames running the ftp service\r\n         -p port  TCP port on which ftp service runs (default: 21)\r\n         -d       Debugging output\r\n         -t n     Wait a maximum of n seconds for reply (default: 15)\r\n         -v       Verbose\r\n         -h       This help message \r\n\r\n Also see ftp-user-enum-user-docs.pdf in the ftp-user-enum tar ball. \r\n\r\n Examples: \r\n\r\n 1) Enumerate users on a vulnerable Solaris host: \r\n\r\n $ ftp-user-enum.pl -M sol -U users.txt -t 10.0.0.1 \r\n\r\n 2) Enumerate users on a list of hosts running vulnerable Inetutils FTPd: \r\n\r\n $ ftp-user-enum.pl -M iu -U users.txt -T ips.txt<\/pre>\n<h1><a title=\"SECTION00050000000000000000\" name=\"SECTION00050000000000000000\"><\/a>Some Examples<\/h1>\n<p>For the examples below we need a list of potential usernames. The following output demostrates the format for this list:<\/p>\n<pre> $ head users.txt\r\n root\r\n bin\r\n daemon\r\n adm\r\n lp\r\n sync\r\n shutdown\r\n halt\r\n mail\r\n news<\/pre>\n<h2><a title=\"SECTION00051000000000000000\" name=\"SECTION00051000000000000000\"><\/a> Against Solaris in.ftpd<\/h2>\n<p>Vulnerable versions of in.ftpd return different responses to the CWD for home directories which exist and those that don&#8217;t. CWD commands can be issued before authentication:<\/p>\n<pre>  $ telnet 10.0.0.1 21\r\n Trying 10.0.0.1...\r\n Connected to 10.0.0.1.\r\n Escape character is '^]'.\r\n 220 test FTP server (SunOS 5.7) ready.\r\n CWD ~root\r\n 530 Please login with USER and PASS.\r\n CWD ~notexist\r\n 530 Please login with USER and PASS.\r\n 550 Unknown user name after ~<\/pre>\n<p>This vulnerability is documented at: http:\/\/www.securityfocus.com\/bid\/2564\/info<\/p>\n<p>Below is an example showing how to use ftp-user-enum to enumerate users using a vulnerable solaris FTP daemon:<\/p>\n<pre> $ ftp-user-enum.pl -U users.txt -t 10.0.0.1\r\n Starting ftp-user-enum v1.0 ( http:\/\/pentestmonkey.net\/tools\/ftp-user-enum ) \r\n\r\n  ----------------------------------------------------------\r\n |                   Scan Information                       |\r\n  ---------------------------------------------------------- \r\n\r\n Mode ..................... sol\r\n Worker Processes ......... 5\r\n Usernames file ........... users.txt\r\n Target count ............. 1\r\n Username count ........... 149\r\n Target TCP port .......... 21\r\n Query timeout ............ 15 secs \r\n\r\n ######## Scan started at Sat Mar 17 16:23:35 2007 #########\r\n root@10.0.0.1: root\r\n bin@10.0.0.1: bin\r\n daemon@10.0.0.1: daemon\r\n adm@10.0.0.1: adm\r\n lp@10.0.0.1: lp\r\n uucp@10.0.0.1: uucp\r\n nobody@10.0.0.1: nobody\r\n ftp@10.0.0.1: ftp\r\n ######## Scan completed at Sat Mar 17 16:24:06 2007 #########\r\n 8 results. \r\n\r\n 149 queries in 31 seconds (4.8 queries \/ sec)<\/pre>\n<h2><a title=\"SECTION00052000000000000000\" name=\"SECTION00052000000000000000\"><\/a> Against GNU inetutils ftpd<\/h2>\n<p>Vulnerable versions of GNU inetutils ftpd respond to the USER command differently depending on whether it is used with a username that exists or one that doesn&#8217;t exist:<\/p>\n<pre> $ telnet 10.0.0.2 21\r\n Trying 10.0.0.2...\r\n Connected to 10.0.0.2.\r\n Escape character is '^]'.\r\n 220 localhost.localdomain FTP server (GNU inetutils 1.4.2) ready.\r\n USER root\r\n 331 Password required for root.\r\n USER notexist\r\n 530 44<\/pre>\n<p>Here&#8217;s an example showing how to use ftp-user-enum to enumerate users using a vulnerable GNU inetutils daemon:<\/p>\n<pre> $ .\/ftp-user-enum.pl -M iu -U users.txt -t 10.0.0.2\r\n Starting ftp-user-enum v1.0 ( http:\/\/pentestmonkey.net\/tools\/ftp-user-enum ) \r\n\r\n  ----------------------------------------------------------\r\n |                   Scan Information                       |\r\n  ---------------------------------------------------------- \r\n\r\n Mode ..................... iu\r\n Worker Processes ......... 5\r\n Usernames file ........... users.txt\r\n Target count ............. 1\r\n Username count ........... 149\r\n Target TCP port .......... 21\r\n Query timeout ............ 15 secs \r\n\r\n ######## Scan started at Sat Mar 17 16:29:28 2007 #########\r\n lp@10.0.0.2: lp\r\n sync@10.0.0.2: sync\r\n mail@10.0.0.2: mail\r\n root@10.0.0.2: root\r\n news@10.0.0.2: news\r\n uucp@10.0.0.2: uucp\r\n man@10.0.0.2: man\r\n user@10.0.0.2: user\r\n postgres@10.0.0.2: postgres\r\n nobody@10.0.0.2: nobody\r\n sshd@10.0.0.2: sshd\r\n games@10.0.0.2: games\r\n bin@10.0.0.2: bin\r\n daemon@10.0.0.2: daemon\r\n ######## Scan completed at Sat Mar 17 16:29:29 2007 #########\r\n 14 results. \r\n\r\n 149 queries in 1 seconds (149.0 queries \/ sec)<\/pre>\n<p>Performance note: The FTP server tries to do a reverse lookup on the IP address of the client. If the lookup is slow, your scan will be slow too.<\/p>\n<h1><a title=\"SECTION00060000000000000000\" name=\"SECTION00060000000000000000\"><\/a>License<\/h1>\n<p>This tool may be used for legal purposes only. Users take full responsibility for any actions performed using this tool. The author accepts no liability for damage caused by this tool. If these terms are not acceptable to you, then do not use this tool.<\/p>\n<p>In all other respects the GPL version 2 applies:<\/p>\n<pre> This program is free software; you can redistribute it and\/or modify\r\n it under the terms of the GNU General Public License version 2 as\r\n published by the Free Software Foundation. \r\n\r\n This program is distributed in the hope that it will be useful,\r\n but WITHOUT ANY WARRANTY; without even the implied warranty of\r\n MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the\r\n GNU General Public License for more details. \r\n\r\n You should have received a copy of the GNU General Public License along\r\n with this program; if not, write to the Free Software Foundation, Inc.,\r\n 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>Username guessing tool for use against the default Solaris ftp service and GNU inetutils ftpd.\u00a0 Recent changes are detailed in the CHANGELOG. Download ftp-user-enum v1.0 here. SHA1sum: 2fbd86dba9f701627d415ed76100b2768b271862 MD51sum: c19ec3eb1eab6282a16514b51eb5f1c6 User documentation are also avaialble in PDF format.<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[13],"tags":[116,19,76,114],"_links":{"self":[{"href":"https:\/\/pentestmonkey.net\/wp-json\/wp\/v2\/posts\/106"}],"collection":[{"href":"https:\/\/pentestmonkey.net\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pentestmonkey.net\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pentestmonkey.net\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/pentestmonkey.net\/wp-json\/wp\/v2\/comments?post=106"}],"version-history":[{"count":4,"href":"https:\/\/pentestmonkey.net\/wp-json\/wp\/v2\/posts\/106\/revisions"}],"predecessor-version":[{"id":571,"href":"https:\/\/pentestmonkey.net\/wp-json\/wp\/v2\/posts\/106\/revisions\/571"}],"wp:attachment":[{"href":"https:\/\/pentestmonkey.net\/wp-json\/wp\/v2\/media?parent=106"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pentestmonkey.net\/wp-json\/wp\/v2\/categories?post=106"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pentestmonkey.net\/wp-json\/wp\/v2\/tags?post=106"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}