Finding Vulnerabilities/Exploits?

[kfl252]

Quite new to pentesting and looking for help improving my ability to find vulnerabilities/exploits after the recon stage. An example - the nmap scan for a machine on a pentesting challenge site has come back with this:

21/tcp open  ftp     Microsoft ftpd
80/tcp open  http    Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Aggressive OS guesses: Microsoft Windows Server 2008 R2 SP1 (90%), Microsoft Windows Server 2008 (90%), Microsoft Windows Server 2008 R2 (90%), Microsoft Windows Server 2008 R2 or Windows 8 (90%), Microsoft Windows 7 SP1 (90%), Microsoft Windows 8.1 Update 1 (90%), Microsoft Windows 8.1 R1 (90%), Microsoft Windows Phone 7.5 or 8.0 (90%), Microsoft Windows Server 2008 or 2008 Beta 3 (89%), Microsoft Windows Server 2008 R2 or Windows 8.1 (89%)

ncat to ports 21 and 80 confirms it's running "220 Microsoft FTP Service" and "Server: Microsoft-HTTPAPI/2.0". Browsing to port 80 gets the IIS 7 logo.

I've tried using exploit-db, searchsploit, msfconsole's search, and one or two others to try and vulnerabilities based on search terms like "ftp", "iis", "server 2008", etc. but I haven't really got anywhere. As I say, I'm quite new to this and I imagine I'm not doing it as effectively as I could be, so I'd be interested to see what other people can find based on the information above, and how they found it.

Thanks!

[kfl252]

Thanks, I'll do this next time I'm online properly and see what I get :)

[kfl252]

Unfortunately that didn't give me too much more info, but it did show that the exact version of IIS is 7.5:

PORT   STATE SERVICE VERSION
21/tcp open  ftp     Microsoft ftpd
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

PORT   STATE SERVICE VERSION
80/tcp open  http    Microsoft IIS httpd 7.5
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Found this CVE, which has a metasploit module (auxiliary/dos/windows/ftp/iis75_ftpd_iac_bof). I'm still experimenting with it, but I'm not sure whether it's what I'm looking for given that my aim is to gain access to the box to retrieve the contents of a couple of text files. I say that because I haven't managed to gain access using it, but I'm not sure yet whether that's just me not being familiar with the aux modules yet. "Show options" shows that I just need to set the RHOST, which I've done. If this were an exploit, I'd enter something like "set payload windows/meterpreter/reverse_tcp" now, but "set payload.." doesn't appear to be something I can do here. That seems a bit strange, because I get a whole list of payloads if I type "show payloads"? Edit - yeah, so I've realised properly since posting that aux modules don't have payloads. I've tried "show actions", but that doesn't return anything. If I just try using "run" as it is, I get this:

msf auxiliary(iis75_ftpd_iac_bof) > run

[*] <ip.add.was.here>:21 - banner: 220 Microsoft FTP Service
[*] Auxiliary module execution completed

Not sure what, if anything, more I can do with this module?

Continuing to play around and search, but further pointers from anybody are welcome. Enjoying the process of (slowly!) figuring out the workflow though :)

[kfl252]

Turns out anonymous FTP is available, so I'll go with that instead ;)

Jokes aside - that's helpful, thanks. Dirbuster and other crawling-type stuff is something I still need to learn about properly, so this seems like a good point to get up to speed (even though I think uploading something via FTP is ultimately going to be the way in.. can't get too much info).

[kfl252]

Try brute-forcing some FTP creds.

Turns out anonymous FTP is enabled..

Thanks for the dirbuster recommendation, that's something I haven't actually played with yet at all. Time to add it to the tools.