Tryhackme – Network Exploitation Basics – Network Services- Task 8

The Tryhackme Network Exploitation Basics Network Services is a room that teaches us how to enumerate and exploit a variety of network services and misconfigurations. Lets Start by Solving the Task 8.

Tryhackme Network Services: Understanding FTP – FTP, or File Transfer Protocol, is a standard network protocol used for transferring files between a client and a server on a computer network. It operates on the client-server model, where the client initiates a connection to the server to send or receive files. FTP is commonly used for uploading website files to a web server, downloading files from an FTP server, or transferring large files between computers on a network. It typically runs on port 21 for control connections and port 20 for data connections, although it can be configured to use different ports.

While FTP is widely used, it lacks built-in encryption, making it vulnerable to security threats such as eavesdropping and data interception. As a result, secure alternatives like FTPS (FTP Secure) and SFTP (SSH File Transfer Protocol) are often preferred for transferring files over secure connections.

Q1. What communications model does FTP use?.

Answer: Client Server.

Q2. What’s the standard FTP port? This Question is somehow cunny. It simply asks what is the default FTP Port?

Answer: Port 21

Q3. How many modes of FTP connection are there?. The modes are the states FTP can be utilized.

Answer: From the Illustration above You can see the answer. Passive Mode and Active Mode which is 2.

TASK 9 : Enumerating FTP

In The task 9 we will notice that this is enumeration stage which means gathering information on the server about the FTP port and services. We will make use of nmap in this task. We will use Nmap to enumerate the services on this target machine.

Run an nmap scan of your choice to determine open ports on the target machine:

Q4. How many ports are open on the target machine? 

Following Our Enumeration below you can see we had to use the syn scan
nmap -sS -Pn -A 10.10.119.122 -v
-sS – means syn scan which is half open scan
-Pn – means nmap should take it that the target machine is online
-A – is an agressive flag that probes nmap to give us the OS, Scripts scan and version detection on the services running on the targetmachine.
-v – means nmap should increase verbosity to the understanding of the attacker. which we can also say that nmap should print the results in a way the attacker can understand it.

Answer: 2. You can see the results above in the first image by the left screen.

Q5. What port is ftp running on?.

Answer: Port 21. You can see the answer above in the Second image by your right.

Q6. What variant of FTP is running on it?.

Answer: VSFTPD. This is the type of FTP running on the machine. and the version is 2.0.8 or later version.

Now that we’ve identified the FTP server type, let’s verify if anonymous login is permitted. Simply enter “ftp [IP]” in the console, then input “anonymous” with no password when prompted to proceed.

Target IP = 10.10.119.122, Port = 21, Name/Username = anonymous
To login to the ftp we do this from our local machine – ftp 10.10.119.122 21
Once we hit the enter key we will be prompted to enter the username/name, then we enter the anonymous as instructed, then it prompts with password we ignore it and hit enter key again. Boom! we’re in the ftp server.

Q7. What is the name of the file in the anonymous FTP directory?

Answer: PUBLIC_NOTICE.txt. If you look at the image above, it has a directory/File that says PUBLIC_NOTICE.txt in the Target machine.

Q8. What do we think a possible username could be?

Answer: MIKE. As a hacker in general, one of the skills you should have or the things you should know is the ability to gather as much information as possible from your target. As a whitehat Hacker hired to penetrate or hack a machine, All you need to do is to gather as much information and find means to get the information from the target, one reason for that is evidence, the other reason is proof. I bet, you didn’t know that these two words are not thesame in meaning.

So we found out the owners username was mike by downloading the PUBLIC_NOTICE.txt file and reading the file on our local machine. This happens when the service is poorly configured with weak passwords.

Downloading the file to our local machine, we use the get command
get PUBLIC_NOTICE.txt

To read the file we open another terminal in our local machine and either find the file or use the command line to navigate to the download directory using the cd Downloads command.
To find the file in Our Local machine we do this find PUBLIC_NOTICE.txt as shown below

To Read the file we do this on our local machine also cat PUBLIC_NOTICE.txt and it opens the file for us to read the contents as seen below.

Now you can see where we got the name of the user and owner of the FTP machine.

Great! Now we’ve got details about the FTP server and, a possible username. Let’s see what we can do with those information.

TASK 10: Exploiting FTP

Considering our current vantage point, one potential vulnerability of the FTP server on this machine lies in weak or default password configurations.

Here’s a breakdown:

During our enumeration stage, we’ve determined that:

• An FTP server is operational on this machine
• We possess a potential username

Armed with this information, let’s proceed with attempting to brute-force the password of the FTP server.

HYDRA

Hydra stands as a formidable online password cracking tool renowned for its lightning-fast capabilities. It specializes in executing swift dictionary attacks across a vast spectrum of over 50 protocols, encompassing Telnet, RDP, SSH, FTP, HTTP, HTTPS, SMB, numerous databases, and beyond. Hydra’s inclusion as a default tool in both Parrot and Kali distributions underscores its significance in the realm of cybersecurity.

Here’s the syntax for the command we’ll employ to uncover the passwords:

hydra -t 4 -l mike -P /usr/share/wordlists/rockyou.txt -vV 10.10.119.122 ftp

Here’s a breakdown of the functions and parameters for running the Hydra tool:

hydra: Executes the Hydra tool.
-t 4: Specifies the number of parallel connections per target (in this case, 4).
-l [mike]: Indicates the username whose account you aim to compromise.
-P [/usr/share/wordlists/rockyou.txt]: Directs to the file containing a list of potential passwords.
-vV: Activates verbose mode, displaying detailed login and password combinations for each attempt.[10.10.119.122]: Refers to the target machine’s IP address.
ftp 21: Sets the protocol (e.g., FTP) for the attack

Q9. What is the password for the user “mike”?

Answer: “password” as you can see it above. It was easy to guess because the password was weak.

Excellent! Next, we’ll establish a connection to the FTP server using the command “ftp [target machine IP][port]”, and then input the credentials we discovered so far when prompted. Below is our Login process again to the ftp server, recall that we logged in anonymously initially, but after our enumeration, and exploitation, we received some credentials and we are about to use them now.

You already know how to connect to FTP server by using – ftp [Target machine IP] [port number]

When prompted with name/username – Enter the name “mike”
When prompted with password – Enter the password “password” hit enter.
And Hoolalaa!! We’re in.

When you compare the 2 images from the intial login you will notice the name difference, and if you carried out the exercises as instructed, you will notice we logged in without password at first anonymously, but currently we logged in with the username “mike” and password as “password”.

Q10. What is ftp.txt?

In this aspect as we’re logged in as the user mike already, we will now have to check the list of directories and files by using the ls -la command or ls only as shown below:

As you can see from the above image we have listed the ftp.txt file using the ls command. Now we will have to download and read the file to see the contents…..

To download the ftp.txt file to our local machine from the ftp server we do this:
get ftp.txt

After we download it, we know we will have to open another terminal and check our download directory by using the cd Downloads or we can aswell use the find command to find the file on our local machine. Lets go!

In the image above you can see that we used the find command and confirmed the file is in our root directory, and we used the cat command to read the content of the file that gave us the answer.

Answer: THM{y0u_g0t_th3_ftp_fl4g}

In Summary, the remedy to FTP breach is the use of SFTP SSH or FTPS protocols. These protocols are more secure and are encrypted.

See you in Our next Class. Stay Guarded

CC – Promise Charles
Ethical Hacker | Certified Cybersecurity Specialist | QA Engineer

Please Subscribe to get more of this awareness.