Attacking services always starts out with enumeration. We need to understand what services are running and where they are running to begin attacking them. We would do enumeration using nmap or similar scanning tools. One aspect that makes our jobs easier is that services are known to run on particular ports. Each service has its own default port, which also makes it easier to identify.

Once we’ve identified a service that is running on an open port, we can think about potential attack vectors. Below is the most common way of attacking known services:

• Exploiting common misconfigurations
• Using publicly available exploits

Services are usually set up by administering the computer, and most of the time, these services have weak default configurations. Other times, we would use information such as version numbers and service type to look for public exploits(vulnerabilities other people have found). It is good practise to always start of by exploiting misconfigurations. If public exploits do exist for a running service, it is not advised to carry out destructive testing(exploits may be unreliable and could affect the availability of systems).

We’ll walk through some common services and understand how to exploit common misconfigurations.

FTP

FTP is the file transfer protocol. The protocol usually runs on port 21 on top of the TCP protocol. FTP is a fairly old protocol that is used to transfer files. A user would make a file available by uploading it on the FTP server, and another user would use an FTP client to connect to the server and download the file. Some common misconfigurations for FTP include:

• Anonymous login: FTP servers would usually need users to authenticate themselves to the server to access files. Most FTP servers allow anonymous login where a user can authenticate with the username: anonymous and password: anonymous. While these are the most common anonymous credentials, they can differ depending on the variant of FTP running.
• Cleartext communication: by default, an FTP client does not encrypt its communication when interacting with the FTP server. This means that an attacker at any point on the network can intercept user credentials and downloaded files.
• Poor file system permissions: FTP servers can be configured to allow an FTP user to browse the rest of the file system. This would help an attacker to enumerate the file system to find even more sensitive information e.g. users personal files, credentials and more.

To connect to an FTP server, you can use the command line command ftp:

*ftp ip-address*

Is this realistic:

very.

Even though FTP servers are old, big corporations that have legacy environments still tend to use FTP to store and transfer files.

NFS