|
| 1 | +## Vulnerable Application |
| 2 | + |
| 3 | +Finger is an older protocol which displays information about users on a machine. This can be abused to verify if a user is valid on that machine. |
| 4 | +The protocol itself was designed in the 1970s, and is run in cleartext. |
| 5 | + |
| 6 | +The following was done on Kali linux: |
| 7 | + |
| 8 | + 1. `apt-get install inetutils-inetd fingerd` |
| 9 | + 2. Start the service: `/etc/init.d/inetutils-inetd start` |
| 10 | + |
| 11 | +## Verification Steps |
| 12 | + |
| 13 | + 1. Install fingerd |
| 14 | + 2. Start msfconsole |
| 15 | + 3. Do: `use auxiliary/scanner/finger/finger_users` |
| 16 | + 4. Do: `set rhosts` |
| 17 | + 5. Do: `run` |
| 18 | + |
| 19 | +## Options |
| 20 | + |
| 21 | +**USERS_FILE** |
| 22 | + |
| 23 | +The USERS_FILE is a newline delimited list of users and defaults to `unix_users.txt` included with metasploit. |
| 24 | + |
| 25 | +## Scenarios |
| 26 | + |
| 27 | + A run against the configuration from these docs |
| 28 | + |
| 29 | + ``` |
| 30 | + msf > use auxiliary/scanner/finger/finger_users |
| 31 | + msf auxiliary(finger_users) > set rhosts 127.0.0.1 |
| 32 | + rhosts => 127.0.0.1 |
| 33 | + msf auxiliary(finger_users) > run |
| 34 | + |
| 35 | + [+] 127.0.0.1:79 - 127.0.0.1:79 - Found user: root |
| 36 | + [+] 127.0.0.1:79 - 127.0.0.1:79 Users found: root |
| 37 | + [*] Scanned 1 of 1 hosts (100% complete) |
| 38 | + [*] Auxiliary module execution completed |
| 39 | + ``` |
| 40 | + |
| 41 | +## Confirming using NMAP |
| 42 | + |
| 43 | +Utilizing the [finger](https://nmap.org/nsedoc/scripts/finger.html) script |
| 44 | + |
| 45 | + ``` |
| 46 | + # nmap -p 79 -sC 127.0.0.1 |
| 47 | + |
| 48 | + Starting Nmap 7.40 ( https://nmap.org ) at 2017-04-26 19:35 EDT |
| 49 | + Nmap scan report for localhost (127.0.0.1) |
| 50 | + Host is up (0.000039s latency). |
| 51 | + PORT STATE SERVICE |
| 52 | + 79/tcp open finger |
| 53 | + | finger: Login Name Tty Idle Login Time Office Office Phone\x0D |
| 54 | + | root root tty2 16d Apr 10 19:17 (:0)\x0D |
| 55 | + |_root root *pts/3 1d Apr 25 19:11 (192.168.2.175)\x0D |
| 56 | + |
| 57 | + Nmap done: 1 IP address (1 host up) scanned in 0.42 seconds |
| 58 | + ``` |
0 commit comments