id: ftp-weak-credentials

info:
  name: FTP Service - Credential Weakness
  author: pussycat0x,h3h3qaq,theamanrawat
  severity: high
  description: An FTP service was accessed with easily guessed credentials.
  reference:
    - https://docs.microsoft.com/en-us/iis/configuration/system.applicationhost/sites/sitedefaults/ftpserver/security/authentication/
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
    cvss-score: 8.5
  metadata:
    max-request: 1
  tags: network,ftp,default-login,service,tcp,vuln

tcp:

  - inputs:
      - data: "USER {{username}}\r\n"
        read: 1024
      - data: "PASS {{password}}\r\n"
        read: 1024

    host:
      - "{{Hostname}}"
    port: 21

    attack: clusterbomb
    payloads:
      username:
        - admin
        - root
        - ftp
      password:
        - password
        - toor
        - nas
        - guest
        - default
        - pass1
        - stingray
        - 123456

    matchers:
      - type: word
        part: raw
        words:
          - "230 Login successful"
# digest: 4a0a00473045022013c86177cb7d2887cfbcf4c2cd98d529f975498571f5a72f3bbe7f6c02f41baa02210096c76aac0abeca092720cb0874776bf7dc186e83f2fc619d6df9f363f6bf05d4:922c64590222798bb761d5b6d8e72950