#########################################################################################
# FTP Settings
#########################################################################################

[config]
default_port = 21
protocol     = tcp
categories   = recon, vulnscan, vulnlookup, defaultcreds, bruteforce, postexploit

[specific_options]
ftps = boolean

[products]
ftp-server =
    Microsoft/ftpd,
    GNU/Inetutils,
    Proftpd,
    Pureftpd,
    Serv-u,
    Vsftpd


#########################################################################################
# Recon
#########################################################################################
[check_nmap-recon]
name        = nmap-recon
category    = recon
description = Recon using Nmap FTP scripts
tool        = nmap
command_1   = sudo nmap -sT -sV -Pn -vv -p [PORT] --script='banner,ftp-* AND NOT ftp-brute*' --stats-every 10s [IP]


#########################################################################################
# Vulnscan
#########################################################################################
[check_ftpmap-scan]
name        = ftpmap-scan
category    = vulnscan
description = Identify FTP server soft/version and check for known vulns
tool        = ftpmap
command_1   = cd db; ftpmap -s [IP] -p [PORT]
context_1   = { 'ftps': False }


#########################################################################################
# Vulnlookup
#########################################################################################
# [check_vuln-lookup]
# name        = nmap-vuln-lookup
# category    = vulnscan
# description = Vulnerability lookup in Vulners.com (NSE scripts) and exploit-db.com (lots of false positive !)
# tool        = vuln-databases
# command_1   = sudo nmap -sT -sV -T5 -Pn -p [PORT] --script nmap-vulners/vulners.nse --script-args vulscandb=scipvuldb.csv [IP] -oX /tmp/nmaptmp.xml; ./exploit-database/searchsploit --nmap /tmp/nmaptmp.xml; rm -f /tmp/nmaptmp.xml

[check_vulners-lookup]
name        = vulners-lookup
category    = vulnlookup
description = Vulnerabilities lookup on Vulners.com (requires product name+version)
tool        = vulners-lookup
apikey      = vulners
command_1   = python3 vulners-lookup.py --apikey [APIKEY name="vulners"] '[FTP-SERVER-VENDOR] [FTP-SERVER-NAME] [FTP-SERVER-VERSION]'
context_1   = { 'ftp-server': 'any|version_known' }
command_2   = python3 vulners-lookup.py --apikey [APIKEY name="vulners"] 'affectedSoftware.name:"[FTP-SERVER-VENDOR] [FTP-SERVER-NAME]" AND affectedSoftware.version:"[FTP-SERVER-VERSION]"'
context_2   = { 'ftp-server': 'any|version_known' }

[check_cvedetails-lookup]
name        = cvedetails-lookup
category    = vulnlookup
description = Vulnerabilities lookup on Cvedetails.com (requires product name+version)
tool        = cvedetails-lookup
command_1   = python3 cvedetails-lookup.py --vendor "[FTP-SERVER-VENDOR]" --product "[FTP-SERVER-NAME]" --version "[FTP-SERVER-VERSION]"
context_1   = { 'ftp-server': 'any|version_known' }


#########################################################################################
# Bruteforce
#########################################################################################
[check_default-creds]
name        = default-creds
category    = defaultcreds
description = Check default/common credentials on FTP server
# tool        = patator
# command_1   = python2.7 patator.py ftp_login host=[IP] port=[PORT] [FTPS true="tls=1"] user=COMBO00 password=COMBO01 0=[WORDLISTSDIR]/services/ftp/ftp_combo.txt -x ignore:fgrep='failed' -x ignore:mesg='incorrect' -x ignore:mesg='timed out' -x ignore,reset,retry:code=500
tool        = hydra
command_1   = hydra -C "[WORDLISTSDIR]/services/ftp/ftp-default-combo.txt" -s [PORT] -v -V -I [IP] ftp[FTPS true="s"]
#context_1   = { 'auth_status': NO_AUTH }
command_2   = hydra -L "[WORDLISTSDIR]/services/ftp/ftp-common-usernames.txt" -P "[WORDLISTSDIR]/services/ftp/ftp-common-passwords.txt" -e ns -v -V -I [IP] ftp[FTPS true="s"]


#########################################################################################
# Bruteforce
#########################################################################################
[check_bruteforce-creds]
name        = bruteforce-creds
category    = bruteforce
description = Bruteforce FTP accounts
# tool        = patator
# command_1   = python2.7 patator.py ftp_login host=[IP] port=[PORT] [FTPS true="tls=1"] user=FILE0 password=FILE1 0=[WORDLISTSDIR]/services/ftp/ftp_usernames.txt 1=[WORDLISTSDIR]/passwords/pass_short.txt -x ignore:fgrep='failed' -x ignore:mesg='incorrect' -x ignore:mesg='timed out' -x ignore,reset,retry:code=500
tool        = hydra
# Run bruteforce only if no creds found/known
command_1   = hydra -L "[USERLIST default="services/ftp/ftp-usernames-short.txt"]" -P "[PASSLIST default="passwords/pass-short.txt"]" -s [PORT] [FTPS true="-S"] -e nsr -v -V -I [IP] ftp[FTPS true="s"]
context_1   = { 'auth_status': NO_AUTH }
# If a user is known, bruteforce with this account
command_2   = hydra -l '[USERNAME]' -P "[PASSLIST default="passwords/pass-short.txt"]" -s [PORT] [FTPS true="-S"] -e nsr -F -v -V -I [IP] ftp[FTPS true="s"]
context_2   = { 'auth_status': USER_ONLY }


#########################################################################################
# Postexploit
#########################################################################################
[check_ftp-dirlisting]
name        = ftp-dirlisting
category    = postexploit
description = List directories/files on FTP server (maxdepth=4) 
tool        = lftp
command_1   = lftp -u '[USERNAME],[PASSWORD]' -p [PORT] [IP] -e "find -d 4 .;exit"
context_1   = { 'auth_status': POST_AUTH }