Posts for: #Ftp-Anonymous

PG: AuthBy

2023-03-07

ターゲット // AuthBy
Platform	OffSec Proving Grounds
OS	Windows
Difficulty	Medium
IP	`192.168.100.46`

Enumeration

Nmap

▶ Nmap output

PORT     STATE SERVICE            VERSION
21/tcp   open  ftp                zFTPServer 6.0 build 2011-10-17
242/tcp  open  http               Apache httpd 2.2.21 ((Win32) PHP/5.3.8)
3145/tcp open  zftp-admin         zFTPServer admin
3389/tcp open  ssl/ms-wbt-server?

Windows Server 2008 box. An ancient zFTPServer on 21, an HTTP app on the non-standard port 242 sitting behind HTTP Basic auth, the zFTPServer admin interface on 3145, and RDP on 3389. The name of the box is the hint: authentication is the whole game here.

[]

PG: MeatHead

2023-03-07

#offsec #proving-grounds #hard #windows #ftp-anonymous #password-cracking #mssql #xp-cmdshell #seimpersonate #printspoofer

ターゲット // MeatHead
Platform	OffSec Proving Grounds
OS	Windows
Difficulty	Hard
IP	`192.168.206.70`

Enumeration

Nmap

▶ Nmap output

PORT     STATE SERVICE       VERSION
80/tcp   open  http          Microsoft IIS httpd 10.0
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp  open  microsoft-ds  Microsoft Windows Server 2008 R2 - 2012 microsoft-ds
1221/tcp open  ftp           Microsoft ftpd
1435/tcp open  ms-sql-s      Microsoft SQL Server 2017 14.00.1000.00; RTM
3389/tcp open  ms-wbt-server Microsoft Terminal Services
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (WinRM)

Windows Server 2019 box — the 445 fingerprint reads 2008 R2 - 2012, but that SMB banner is unreliable; systeminfo from the shell later confirms Server 2019. The interesting detail is the two services parked on non-standard ports: FTP on 1221 and MSSQL on 1435. IIS on 80 serves nothing useful, so the FTP is the way in.

[]