> For the complete documentation index, see [llms.txt](https://derek-johnson-1.gitbook.io/welcome/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://derek-johnson-1.gitbook.io/welcome/freshman/security-250/week-6/vulnerability-information-gathering-johnson.md).

# Vulnerability Information Gathering Johnson

1. **Zenmap save of scan in XML format (5 points)**

\<?xml version="1.0" encoding="iso-8859-1"?>

\<?xml-stylesheet href="file:///C:/Program Files (x86)/Nmap/nmap.xsl" type="text/xsl"?>\<nmaprun start="1676312861" profile\_name="Quick scan plus" xmloutputversion="1.04" scanner="nmap" version="7.93" startstr="Mon Feb 13 13:27:41 2023" args="nmap -sV -T4 -O -F --version-light 192.168.3.25">\<scaninfo services="7,9,13,21-23,25-26,37,53,79-81,88,106,110-111,113,119,135,139,143-144,179,199,389,427,443-445,465,513-515,543-544,548,554,587,631,646,873,990,993,995,1025-1029,1110,1433,1720,1723,1755,1900,2000-2001,2049,2121,2717,3000,3128,3306,3389,3986,4899,5000,5009,5051,5060,5101,5190,5357,5432,5631,5666,5800,5900,6000-6001,6646,7070,8000,8008-8009,8080-8081,8443,8888,9100,9999-10000,32768,49152-49157" protocol="tcp" numservices="100" type="syn">\</scaninfo>\<verbose level="0">\</verbose>\<debugging level="0">\</debugging>\<output type="interactive">Starting Nmap 7.93 ( <https://nmap.org> ) at 2023-02-13 13:27 Eastern Standard Time

NSOCK ERROR \[0.2450s] ssl\_init\_helper(): OpenSSL legacy provider failed to load.

Nmap scan report for 192.168.3.25

Host is up (0.0015s latency).

Not shown: 82 closed tcp ports (reset)

PORT STATE SERVICE VERSION

21/tcp open ftp vsftpd 2.3.4

22/tcp open ssh OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)

23/tcp open telnet Linux telnetd

25/tcp open smtp Postfix smtpd

53/tcp open domain ISC BIND 9.4.2

80/tcp open http Apache httpd 2.2.8 ((Ubuntu) DAV/2)

111/tcp open rpcbind

139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)

445/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)

513/tcp open login?

514/tcp open shell?

2049/tcp open rpcbind

2121/tcp open ftp ProFTPD 1.3.1

3306/tcp open mysql MySQL 5.0.51a-3ubuntu5

5432/tcp open postgresql PostgreSQL DB 8.3.0 - 8.3.7

5900/tcp open vnc VNC (protocol 3.3)

6000/tcp open X11 (access denied)

8009/tcp open ajp13 Apache Jserv (Protocol v1.3)

1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at <https://nmap.org/cgi-bin/submit.cgi?new-service> :

SF-Port514-TCP:V=7.93%I=2%D=2/13%Time=63EA8120%P=i686-pc-windows-windows%r

SF:(NULL,42,"\x01Couldn't\x20get\x20address\x20for\x20your\x20host\x20\\(DE

SF:SKTOP-LNDIM9C\\.cyber\\.local\\)\n")%r(GenericLines,42,"\x01Couldn't\x20ge

SF:t\x20address\x20for\x20your\x20host\x20\\(DESKTOP-LNDIM9C\\.cyber\\.local\\

SF:)\n");

MAC Address: 00:0C:29:52:D7:E0 (VMware)

Device type: general purpose

Running: Linux 2.6.X

OS CPE: cpe:/o:linux:linux\_kernel:2.6

OS details: Linux 2.6.9 - 2.6.33

Network Distance: 1 hop

Service Info: Host: metasploitable.localdomain; OSs: Unix, Linux; CPE: cpe:/o:linux:linux\_kernel

OS and Service detection performed. Please report any incorrect results at <https://nmap.org/submit/> .

Nmap done: 1 IP address (1 host up) scanned in 16.44 seconds

\</output>\<host comment="">\<status state="up">\</status>\<address addrtype="ipv4" vendor="" addr="192.168.3.25">\</address>\<address addrtype="mac" vendor="VMware" addr="00:0C:29:52:D7:E0">\</address>\<hostnames>\</hostnames>\<ports>\<extraports count="82" state="closed">\</extraports>\<port protocol="tcp" portid="21">\<state reason="syn-ack" state="open" reason\_ttl="64">\</state>\<service product="vsftpd" version="2.3.4" method="probed" conf="10" name="ftp">\</service>\</port>\<port protocol="tcp" portid="22">\<state reason="syn-ack" state="open" reason\_ttl="64">\</state>\<service product="OpenSSH" name="ssh" extrainfo="protocol 2.0" version="4.7p1 Debian 8ubuntu1" conf="10" method="probed">\</service>\</port>\<port protocol="tcp" portid="23">\<state reason="syn-ack" state="open" reason\_ttl="64">\</state>\<service product="Linux telnetd" method="probed" conf="10" name="telnet">\</service>\</port>\<port protocol="tcp" portid="25">\<state reason="syn-ack" state="open" reason\_ttl="64">\</state>\<service product="Postfix smtpd" method="probed" conf="10" name="smtp">\</service>\</port>\<port protocol="tcp" portid="53">\<state reason="syn-ack" state="open" reason\_ttl="64">\</state>\<service product="ISC BIND" version="9.4.2" method="probed" conf="10" name="domain">\</service>\</port>\<port protocol="tcp" portid="80">\<state reason="syn-ack" state="open" reason\_ttl="64">\</state>\<service product="Apache httpd" name="http" extrainfo="(Ubuntu) DAV/2" version="2.2.8" conf="10" method="probed">\</service>\</port>\<port protocol="tcp" portid="111">\<state reason="syn-ack" state="open" reason\_ttl="64">\</state>\<service method="probed" conf="10" name="rpcbind">\</service>\</port>\<port protocol="tcp" portid="139">\<state reason="syn-ack" state="open" reason\_ttl="64">\</state>\<service product="Samba smbd" name="netbios-ssn" extrainfo="workgroup: WORKGROUP" version="3.X - 4.X" conf="10" method="probed">\</service>\</port>\<port protocol="tcp" portid="445">\<state reason="syn-ack" state="open" reason\_ttl="64">\</state>\<service product="Samba smbd" name="netbios-ssn" extrainfo="workgroup: WORKGROUP" version="3.X - 4.X" conf="10" method="probed">\</service>\</port>\<port protocol="tcp" portid="513">\<state reason="syn-ack" state="open" reason\_ttl="64">\</state>\<service method="table" conf="3" name="login">\</service>\</port>\<port protocol="tcp" portid="514">\<state reason="syn-ack" state="open" reason\_ttl="64">\</state>\<service method="table" conf="3" name="shell">\</service>\</port>\<port protocol="tcp" portid="2049">\<state reason="syn-ack" state="open" reason\_ttl="64">\</state>\<service method="probed" conf="10" name="rpcbind">\</service>\</port>\<port protocol="tcp" portid="2121">\<state reason="syn-ack" state="open" reason\_ttl="64">\</state>\<service product="ProFTPD" version="1.3.1" method="probed" conf="10" name="ftp">\</service>\</port>\<port protocol="tcp" portid="3306">\<state reason="syn-ack" state="open" reason\_ttl="64">\</state>\<service product="MySQL" version="5.0.51a-3ubuntu5" method="probed" conf="10" name="mysql">\</service>\</port>\<port protocol="tcp" portid="5432">\<state reason="syn-ack" state="open" reason\_ttl="64">\</state>\<service product="PostgreSQL DB" version="8.3.0 - 8.3.7" method="probed" conf="10" name="postgresql">\</service>\</port>\<port protocol="tcp" portid="5900">\<state reason="syn-ack" state="open" reason\_ttl="64">\</state>\<service product="VNC" extrainfo="protocol 3.3" method="probed" conf="10" name="vnc">\</service>\</port>\<port protocol="tcp" portid="6000">\<state reason="syn-ack" state="open" reason\_ttl="64">\</state>\<service extrainfo="access denied" method="probed" conf="10" name="X11">\</service>\</port>\<port protocol="tcp" portid="8009">\<state reason="syn-ack" state="open" reason\_ttl="64">\</state>\<service product="Apache Jserv" extrainfo="Protocol v1.3" method="probed" conf="10" name="ajp13">\</service>\</port>\</ports>\<os>\<portused state="open" portid="21" proto="tcp">\</portused>\<portused state="closed" portid="7" proto="tcp">\</portused>\<portused state="closed" portid="30097" proto="udp">\</portused>\<osmatch line="59343" name="Linux 2.6.9 - 2.6.33" accuracy="100">\<osclass type="general purpose" osfamily="Linux" vendor="Linux" osgen="2.6.X" accuracy="100">\</osclass>\</osmatch>\</os>\<uptime lastboot="Mon Feb 13 12:51:11 2023" seconds="2206">\</uptime>\<tcpsequence index="205" values="C61AFBB4,C67EA91D,C69AF16F,C715E6A2,C65AFDBE,C752DF81" difficulty="Good luck!">\</tcpsequence>\<ipidsequence values="0,0,0,0,0,0" class="All zeros">\</ipidsequence>\<tcptssequence values="35D91,35D9C,35DA7,35DB2,35DBD,35DC8" class="100HZ">\</tcptssequence>\</host>\<runstats>\<finished timestr="Mon Feb 13 13:27:57 2023" time="1676312877">\</finished>\<hosts down="0" total="1" up="1">\</hosts>\</runstats>\</nmaprun>

1. **Document with all results from zenmap scan and a table of the 5 researched vulnerabilities including the port number, the service, the service version of the vulnerability, and the fix if one exists. (5 points)**

| Port 21   | FTP                | ProFTPD 1.3.1               | Multiple stack-based buffer overflows in the pr\_netio\_telnet\_gets function in netio.c in ProFTPD before 1.3.3c allow remote attackers to execute arbitrary code via vectors involving a TELNET IAC escape character to a (1) FTP or (2) FTPS server.                                                                                                         | Update to a supported version of Linux.                                                                                                                |
| --------- | ------------------ | --------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Port 23   | Telnet             | Linux telnetd, Linux 2.3    | telnet daemon (telnetd) from the Linux netkit package before netkit-telnet-0.16 allows remote attackers to bypass authentication when telnetd is running with the -L command line option.                                                                                                                                                                       | Update to a supported version of linux                                                                                                                 |
| Port 80   | Apache HTTP Server | Apache httpd 2.2.8          | The mod\_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which allows remote attackers to cause a denial of service (process hang) via a request to a CGI script that does not read from its stdin file descriptor.                                                                                                      | Cloudflare DNS protection or upgrade to a newer version of Apache httpd.                                                                               |
| Port 3306 | MySQL              | MySQL 5.0.51a-3ubuntu5      | Stack-based buffer overflow in MySQL 4.1.x before 4.1.3, and 5.0, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long scramble string.                                                                                                                                                                  | Cloudflare DNS protection for the DNS concern, update to a version of MySQL that doesn't allow code execution through arbitrary code scramble strings. |
| Port 5432 | PostgreSQL         | PostgreSQL DB 8.3.0 - 8.3.7 | CRLF injection vulnerability in pg\_dump in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows user-assisted remote attackers to execute arbitrary SQL commands via a crafted file containing object names with newlines, which are inserted into an SQL script that is used when the database is restored. | Before restoring databases run a scan to check for a file containing odd SQL commands or update to a newer version of the service.                     |

1. **Based on your research, which vulnerability would you try to use to gain the greatest access to the system. Explain your reasoning. (5 points)**

Out of all the vulnerable services listed above, I would take advantage of a vulnerability in SSH 4.7. OpenSSH 5.6 and earlier, when J-PAKE is enabled, does not properly validate the public parameters in the J-PAKE protocol, which allows remote attackers to bypass the need for knowledge of the shared secret, and successfully authenticate, by sending crafted values in each round of the protocol, a related issue to CVE-2010-4252. If they had J-PAKE enabled then this would be the easiest way to access the vulnerable system remotely. Use ssh to connect to the machine and bypass the need for a shared secret to authenticate. From there a backdoor with persistence and elevated privileges can be established to do a number of things.