Skip to content

Commit 24004f1

Browse files
committed
Land rapid7#8298, docs for aux scanner finger
2 parents 5450e96 + 1843f03 commit 24004f1

File tree

1 file changed

+58
-0
lines changed

1 file changed

+58
-0
lines changed
Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
## Vulnerable Application
2+
3+
Finger is an older protocol which displays information about users on a machine. This can be abused to verify if a user is valid on that machine.
4+
The protocol itself was designed in the 1970s, and is run in cleartext.
5+
6+
The following was done on Kali linux:
7+
8+
1. `apt-get install inetutils-inetd fingerd`
9+
2. Start the service: `/etc/init.d/inetutils-inetd start`
10+
11+
## Verification Steps
12+
13+
1. Install fingerd
14+
2. Start msfconsole
15+
3. Do: `use auxiliary/scanner/finger/finger_users`
16+
4. Do: `set rhosts`
17+
5. Do: `run`
18+
19+
## Options
20+
21+
**USERS_FILE**
22+
23+
The USERS_FILE is a newline delimited list of users and defaults to `unix_users.txt` included with metasploit.
24+
25+
## Scenarios
26+
27+
A run against the configuration from these docs
28+
29+
```
30+
msf > use auxiliary/scanner/finger/finger_users
31+
msf auxiliary(finger_users) > set rhosts 127.0.0.1
32+
rhosts => 127.0.0.1
33+
msf auxiliary(finger_users) > run
34+
35+
[+] 127.0.0.1:79 - 127.0.0.1:79 - Found user: root
36+
[+] 127.0.0.1:79 - 127.0.0.1:79 Users found: root
37+
[*] Scanned 1 of 1 hosts (100% complete)
38+
[*] Auxiliary module execution completed
39+
```
40+
41+
## Confirming using NMAP
42+
43+
Utilizing the [finger](https://nmap.org/nsedoc/scripts/finger.html) script
44+
45+
```
46+
# nmap -p 79 -sC 127.0.0.1
47+
48+
Starting Nmap 7.40 ( https://nmap.org ) at 2017-04-26 19:35 EDT
49+
Nmap scan report for localhost (127.0.0.1)
50+
Host is up (0.000039s latency).
51+
PORT STATE SERVICE
52+
79/tcp open finger
53+
| finger: Login Name Tty Idle Login Time Office Office Phone\x0D
54+
| root root tty2 16d Apr 10 19:17 (:0)\x0D
55+
|_root root *pts/3 1d Apr 25 19:11 (192.168.2.175)\x0D
56+
57+
Nmap done: 1 IP address (1 host up) scanned in 0.42 seconds
58+
```

0 commit comments

Comments
 (0)