Hack Like a Pro: Exploring Metasploit Auxiliary Modules (FTP Fuzzing) « Null Byte :: WonderHowTo

Welcome back, my hacker novitiates!In previous guides, we have used one of the most powerful hacking platforms on the planet,Metasploit, to perform numerous hacks. They ranged from exploitingWindows XPandWindows 7/8vulnerabilities, toinstalling a keyloggerandturning on a webcam remotely. We have even been able tosave the world from nuclear annihilation,see if our girlfriend is cheating,spy on suspicious neighbors,evade antivirus detection, and more.In each of those tutorials, we focused primarily on using two types of Metasploit modules, the exploits and the payloads, but Metasploit has several other types including NOPs (no operations), encoders, post (post exploitation), and auxiliary. In this article, I want to introduce you to the auxiliary modules in Metasploit where many powerful tools await our call.Step 1: Fire Up KaliLet's get started. First, fire upKaliand open a terminal like that below.Step 2: Go to Metasploit Framework DirectoryNow, let's navigate to the Metasploit directory in Kali:cd /usr/share/metasploit-frameworkPlease note that we are not invokingthe Metasploit console. We are simply navigating to where Metasploit resides in the file system, so that we can explore what modules exist there.Next, let's list the contents of that directory like that below.kali > ls -lLet's now navigate to the subdirectory modules and do a listing on that subdirectory.kali > cd moduleskali > ls -lAs we can see in the screenshot above, Metasploit has six (6) different types of modules:auxiliaryencodersexploitsnopspayloadspostAs stated before, in nearly every previous Meatsploit tutorial here on Null Byte, we have focused exclusively on the exploits and payloads. I have also done a couple of guides on using theencodersmodule, but we have never explored the NOPs, auxiliary, or post modules. Today, let's examine what is available to us in the auxiliary module.Step 3: Open Auxiliary DirectoryFirst, let change directories to the auxiliary directory and do a directory listing.kali > cd auxiliarykali > ls -lWhen we do so, we can see that the auxiliary module directory is broken down to many sub-directories starting with theadmindirectory and ending through thevspoitdirectory.Step 4: Explore the Auxiliary Sub DirectoriesAs you can see, there are numerous auxiliary directories and modules, but for now, let's focus on one—thefuzzers.FuzzingFuzzing is the practice of attempting random input into a variable area to see whether we can "break" it. That is, if we try to put too much data or a data of a type not expected, we may be able to get the buffer to overflow.Buffer overflows (I'll do a few articles soon on this subject) are among the most serious types of vulnerabilities as they often enable us to execute our own code remotely. Fuzzing is often the first step in finding a vulnerability that may lead to the development of a zero-day exploit.Now let's navigate to the fuzzer directory:kali > cd fuzzersOnce we are in the fuzzer directory, let's look inside with an long listing.kali > ls -lAs you can see, Metasploit has seven (7) types of fuzzers:dnsftphttpsmbsmtpsshtdsEach of these directories include programs or scripts that enable us to fuzz a particular protocol or function. We will focus our attention onftp fuzzingin this tutorial.Step 5: Open the FuzzersLet's look inside the ftp fuzzing directory:kali > cd ftpkali > ls -lAs you can see, there are two fuzzers for ftp, theclient_ft.rband theftp_pre_post.rb. Let's use theftp_pre_post.Step 6: Use the FTP Pre Post FuzzerNow that we have identified an auxiliary module we want to use, let's open the msfconsole and find and use this module. Open the msfconsole by typingmsfconsolein any directory from a terminal. This will open up the msfconsole and provide us with an msf prompt.To find the fuzzer modules in Metasploit, we can use the search function built into msfconsole. We can type:msf > search type:auxiliary fuzzersHere we are asking msfconsole to list us only those modules that are auxiliary (type:auxiliary) and contain the keyword, ftp.The results of that search are listed above. I have highlighted in the screenshot the module we will be using,auxiliary/fuzzers/ftp/ftp_pre_post.Step 7: Load the Fuzzer ModuleTo load the module, simply type:msf > use auxiliary/fuzzers/ftp/ftp_pre_postLet's take a look at the particulars of this module by looking at its info page.msf > infoAlthough this module has many options, to run it we only need to provide a target IP address. In this case, we will run it against a Windows 2003 server with IIS 6.0 and an FTP server. Let's set the IP address:msf > set RHOSTS 191.168.89.191After setting the target IP address, we then only need torunthis ruby script.msf > runAs we can see above, the fuzzer begins by running random input set to size 10 bytes and increments the size by 10 each attempt. The default setting runs to size 20,000, but we can change that to any value that we find appropriate.After attempting random input, it then begins to attempt various command inputs once again beginning at 10 bytes and incrementing by 10 to 20,000 bytes. It will stop when it finds two error messages or comes to the end of all of its attempts. Just a warning, this can take hours.Keep coming back, my hacker novitiates, as we explore more Metasploit auxiliary modules and use them to find unknown vulnerabilities and progress toward developing our own zero-day exploits.Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image viaHack a WeekRelatedHack Like a Pro:Metasploit for the Aspiring Hacker, Part 10 (Finding Deleted Webpages)Hack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPHack Like a Pro:Exploring the Inner Architecture of MetasploitHack Like a Pro:Metasploit for the Aspiring Hacker, Part 1 (Primer & Overview)How to Hack Like a Pro:Hacking Windows Vista by Exploiting SMB2 VulnerabilitiesHack Like a Pro:Metasploit for the Aspiring Hacker, Part 8 (Setting Up a Fake SMB Server to Capture Domain Passwords)Hack Like a Pro:How to Crash Your Roommate's Windows 7 PC with a LinkHack Like a Pro:Hacking the Heartbleed VulnerabilityHow To:Create a Metasploit Exploit in Few MinutesHack Like a Pro:Metasploit for the Aspiring Hacker, Part 4 (Armitage)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 7 (Autopwn)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 2 (Keywords)Hack Like a Pro:How Windows Can Be a Hacking Platform, Pt. 1 (Exploit Pack)How to Hack Databases:Hunting for Microsoft's SQL ServerHow to Hack Databases:Running CMD Commands from an Online MS SQL ServerHack Like a Pro:Metasploit for the Aspiring Hacker, Part 9 (How to Install New Modules)How to Hack Like a Pro:Getting Started with MetasploitHack Like a Pro:How to Hack Windows Vista, 7, & 8 with the New Media Center ExploitHack Like a Pro:How to Hack the Shellshock VulnerabilitySEToolkit:Metasploit's Best FriendHow To:Discover Open Ports Using Metasploit's Built-in Port ScannerHack Like a Pro:How to Hack Facebook (Same-Origin Policy)How to Hack Databases:Cracking SQL Server Passwords & Owning the ServerHack Like a Pro:Metasploit for the Aspiring Hacker, Part 14 (Creating Resource Script Files)Hack Like a Pro:Reconnaissance with Recon-Ng, Part 1 (Getting Started)Hack Like a Pro:How to Use Hacking Team's Adobe Flash ExploitHow To:Use Metasploit's WMAP Module to Scan Web Applications for Common VulnerabilitiesHack Like a Pro:Metasploit for the Aspiring Hacker, Part 3 (Payloads)How To:Use John the Ripper in Metasploit to Quickly Crack Windows HashesHow To:The Art of 0-Day Vulnerabilities, Part2: Manually FuzzingHow To:Run an FTP Server from Home with LinuxHack Like a Pro:Hacking Samba on Ubuntu and Installing the Meterpreter