Port Scaning Part 6

you could get into some serious trouble. [Well actually not much, only say your account might be disabled. However, it could be worse.]




Ok, you are in, now let us get the FTP client to tell us which commands are available by typing the help command.



ftp> help

Commands may be abbreviated. Commands are:



! delete literal prompt

? debug ls put

append dir mdelete pwd

ascii disconnect mdir quit

bell get mget quote

binary glob mkdir recv

bye hash mls remotehelp

cd help mput rename

close lcd open rmdir



Uhmmm.,.., none of the above commands seem to be or sound to be of use to us. So the ‘help’ command did not reveal any useful commands. However, you see the above list of commands are commands which are offered by the FTP client and almost more often than not, the FTP daemon offers a wider array of commands. To get a complete list of commands offered by the FTP daemon, use the ‘remote help’ command:



Ftp> remote help

214-The following commands are recognized (* =>'s unimplemented).

USER PORT STOR MSAM* RNTO NLST MKD CDUP

PASS PASV APPE MRSQ* ABOR SITE XMKD XCUP

ACCT TYPE MLFL* MRCP* DELE SYST RMD STOU

SMNT* STRU MAIL* ALLO CWD STAT XRMD SIZE

REIN* MODE MSND* REST XCWD HELP PWD MDTM

QUIT RETR MSOM* RNFR LIST NOOP XPWD

214 End of help



Note: To get a single line description of each command, type help followed by a space and the command of which you want a description.



One thing to remember here is that to execute any command from the remote FTP commands list you need to make use of the ‘literal’ keyword. What I mean by that is that all remote FTP commands have to be preceded by the word ‘literal’. For example, say you want to execute the remote FTP command: ‘stat’, then you would type:



ftp> literal stat



***************

HACKING TRUTH: According to FTP help, the literal command is described as:

ftp> help literal

literal send arbitrary ftp command

***************



Anyway, amongst the remote FTP commands, the commands of interest to us are-: ‘stat’ and ‘syst’. Let us see what they return when executed-:



ftp>literal stat

211- ftp2.xxx.bol.net.in FTP server status:

Version 5.60

Connected to 203.xx.251.198 (203.xx.251.198)

Logged in anonymously

TYPE: ASCII, FORM: Nonprint; STRUcture: File; transfer MODE: Stream

211- No data connection

211 End of status



Note: The IP address is of xxx.bol.net.in and not your machine.



ftp> literal syst

215 UNIX Type: L8 Version: BSD-198911



Voila, we get the Operating System name running on ftp2.xxx.bol.net.in. At last some useful information.



Finger and HTTP both failed, what do we do now? Let us turn to the den of the Buggiest daemon on Earth i.e. Sendmail: Port 25, the SMTP port.








Jai Shree Raam