Simple FTP Fuzzer – Metasploit Module

If you want to show your respect for my free tools and free support, please consider a small donation :

Download :
Please log in to download FTP Fuzzer - Metasploit Module (6.9 KiB)

Update (July 2010) : the ftp fuzzer has been merged into the Metasploit tree. You do no longer need to download the script here. If you are using the latest version of Metasploit (svn update), then you can find the fuzzer in the modules/auxiliary/fuzzers/ftp folder (file is called ftp_pre_post.rb.

Usage :

Navigate to the metasploit folder, go into ‘modules’ and then into ‘auxiliary’

Create a subfolder called ‘fuzzer’ and place the fuzz_ftp.rb file in that folder

Open Metasploit console and select the module

                                  _       _
             _                   | |     (_)_
 ____   ____| |_  ____  ___ ____ | | ___  _| |_
|    \ / _  )  _)/ _  |/___)  _ \| |/ _ \| |  _)
| | | ( (/ /| |_( ( | |___ | | | | | |_| | | |__
|_|_|_|\____)\___)_||_(___/| ||_/|_|\___/|_|\___)
                           |_|

       =[ msf v3.3-dev [core:3.3 api:1.0]
+ -- --=[ 429 exploits - 261 payloads
+ -- --=[ 21 encoders - 8 nops
       =[ 199 aux

msf > use auxiliary/fuzzer/fuzz_ftp
msf auxiliary(fuzz_ftp) > show options

Module options:

   Name          Current Setting     Required  Description
   ----          ---------------     --------  -----------
   DELAY         0.5                 no        Delay between connections
   ENDSIZE       20000               no        Fuzzing string endsize
   PASS          anonymous@test.com  no        Password
   RHOSTS                            yes       The target address range or CIDR identifier
   RPORT         21                  yes       The target port
   STARTATSTAGE  1                   no        Start at this test stage
   STARTSIZE     10                  no        Fuzzing string startsize
   STEPSIZE      10                  no        Increase string size each iteration with this number of chars
   THREADS       1                   yes       The number of concurrent threads
   USER          anonymous           no        Username

msf auxiliary(fuzz_ftp) >

Important options are :

RHOSTS = the ip address of the FTP server

USER and PASS = set to a valid/working Username & Password combination

The fuzzer has 5 stages :

  1. Issue no command, only send evil data
  2. Fuzz the USER command
  3. Fuzz the PASS command (after a valid USER command/login was executed)
  4. Fuzz all FTP commands (after a valid login was performed), one command, one fuzz string per session
  5. Fuzz all FTP commands (after a valid login was performed), one command with all fuzz combinations for that command per session

You can edit the fuzz data and FTP commands yourself (if you want to) by editing the fuzz_ftp.rb file

Start fuzzing ?  Just issue the ‘run’ command.  When the fuzzer cannot connect anymore, the fuzzing process will be halted, and the last sent string will be displayed.

One Response to Simple FTP Fuzzer – Metasploit Module

  • albay says:

    Hello Peter,

    When I set DELAY option to 0.5, it sets to 0 because of “OptInt” type. I looked for a data type like OptFloat or OptDouble but no luck.

    How can I achieve to set it to double ?

    Thanks

Corelan Live training

Since 2011, Corelan GCV has been teaching live win32 exploit dev classes at various security cons and private companies & organizations.

You can read more about the training and schedules here

Demand Global Change

The world needs your help !

Please take a few moments to read the "Demand Global Change Call For Action" document at
http://bit.ly/demandglobalchange
Read the full document at
http://bit.ly/demandglobalchange_full and share the message with as many people as possible.

Like the Facebook page, and SHARE it with everyone you know.



Donate

Want to support the Corelan Team community ? Click here to go to our donations page.

Want to donate BTC to Corelan Team?



Your donation will help funding server hosting.

Protected by Copyscape Web Plagiarism Tool

Corelan Team Merchandise

You can support Corelan Team by donating or purchasing items from the official Corelan Team merchandising store.

Corelan on IRC

You can chat with us and our friends on #corelan (freenode IRC)

Categories