FTP mixin: Fixes & improvements

[g0tmi1k]

This started from @cdelafuente-r7's feedback in #21380 (comment)

This PR fixes a few things:

• Use recog (fall back to regex) with banner_version
• If pointed at a non-ftp service, but one which is up, record
• Check for complete response (e.g. two responses in one TCP burst - issue found when using STAT/FEAT with ftp_fingerprint)
• Add ftp_fingerprint() & ftp_list_directory() to help enum targets.

---

Use recog

Target is Metasploitable 2.

After

$ ./msfconsole -q -x 'db_status; workspace -D;
setg VERBOSE true; setg RHOSTS 10.0.0.10; setg LHOST tap0'
[*] Connected to msf. Connection type: postgresql.
[*] Deleted workspace: default
[*] Recreated the default workspace
VERBOSE => true
RHOSTS => 10.0.0.10
LHOST => tap0
msf > use ftp_anonymous

Matching Modules
================

   #  Name                                 Disclosure Date  Rank    Check  Description
   -  ----                                 ---------------  ----    -----  -----------
   0  auxiliary/scanner/ftp/ftp_anonymous  .                normal  No     Anonymous FTP Access Detection


Interact with a module by name or index. For example info 0, use 0 or use auxiliary/scanner/ftp/ftp_anonymous

[*] Using auxiliary/scanner/ftp/ftp_anonymous
msf auxiliary(scanner/ftp/ftp_anonymous) > run
[*] 10.0.0.10:21          - Testing write access, creating test directory: fzgzOlMG
[+] 10.0.0.10:21          - Anonymous Read-only access (vsFTPd 2.3.4)
[*] 10.0.0.10:21          - Listing directory contents
[*] 10.0.0.10:21          - Directory listing: (empty)
[*] 10.0.0.10:21          - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(scanner/ftp/ftp_anonymous) >

---

Proof

$ git diff ./lib/msf/core/exploit/remote/ftp.rb
diff --git a/lib/msf/core/exploit/remote/ftp.rb b/lib/msf/core/exploit/remote/ftp.rb
index a2a8855f6d..15a2ca2da9 100644
--- a/lib/msf/core/exploit/remote/ftp.rb
+++ b/lib/msf/core/exploit/remote/ftp.rb
@@ -119,7 +119,7 @@ module Exploit::Remote::Ftp
   #
   def banner_version
    info = recog_banner
-   return [info['service.product'], info['service.version']].compact.join(' ') if info
+   return [info['service.product'], info['service.product'], info['service.version']].compact.join(' ') if info

     # 220 (vsFTPd 2.3.4)\x0d\x0a                                   -> vsFTPd 2.3.4
     # 220 ProFTPD 1.3.1 Server (Debian) [::ffff:10.0.0.10]\x0d\x0a -> ProFTPD 1.3.1 Server (Debian)
$ ./msfconsole -q -x 'db_status; workspace -D;
setg VERBOSE true; setg RHOSTS 10.0.0.10; setg LHOST tap0; use ftp_anonymous; run'
[...]
[+] 10.0.0.10:21          - Anonymous Read-only access (vsFTPd vsFTPd 2.3.4)
[...]
msf auxiliary(scanner/ftp/ftp_anonymous) >

[g0tmi1k]

Thanks for the feedback @adfoster-r7 - Forced pushed with changes.

[g0tmi1k]

Its now able to report_service on a non-ftp service, as well as report_host on a service that is down.

Before

$ git checkout master
Already on 'master'
Your branch is up to date with 'origin/master'.
$ ./msfconsole -q -x 'workspace -D;
use auxiliary/scanner/ftp/ftp_version;
set RHOSTS 10.0.0.10;'
[*] Deleted workspace: default
[*] Recreated the default workspace
RHOSTS => 10.0.0.10
msf auxiliary(scanner/ftp/ftp_version) > set RPORT 22
RPORT => 22
msf auxiliary(scanner/ftp/ftp_version) > run
[*] 10.0.0.10:22          - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(scanner/ftp/ftp_version) > workspace -v

Workspaces
==========

current  name     hosts  services  vulns  creds  loots  notes
-------  ----     -----  --------  -----  -----  -----  -----
*        default  0      0         0      0      0      0

msf auxiliary(scanner/ftp/ftp_version) >
msf auxiliary(scanner/ftp/ftp_version) >
msf auxiliary(scanner/ftp/ftp_version) >
msf auxiliary(scanner/ftp/ftp_version) >
msf auxiliary(scanner/ftp/ftp_version) > set RPORT 999
RPORT => 999
msf auxiliary(scanner/ftp/ftp_version) > run
[*] 10.0.0.10:999         - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(scanner/ftp/ftp_version) >
msf auxiliary(scanner/ftp/ftp_version) > workspace -v

Workspaces
==========

current  name     hosts  services  vulns  creds  loots  notes
-------  ----     -----  --------  -----  -----  -----  -----
*        default  1      0         0      0      0      0

msf auxiliary(scanner/ftp/ftp_version) >

After

$ git checkout ftp_mixin
branch 'ftp_mixin' set up to track 'origin/ftp_mixin'.
Switched to a new branch 'ftp_mixin'
$ ./msfconsole -q -x 'workspace -D;
use auxiliary/scanner/ftp/ftp_version;
set RHOSTS 10.0.0.10;'
[*] Deleted workspace: default
[*] Recreated the default workspace
RHOSTS => 10.0.0.10
msf auxiliary(scanner/ftp/ftp_version) > set RPORT 22
RPORT => 22
msf auxiliary(scanner/ftp/ftp_version) > run
[*] 10.0.0.10:22          - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(scanner/ftp/ftp_version) > workspace -v

Workspaces
==========

current  name     hosts  services  vulns  creds  loots  notes
-------  ----     -----  --------  -----  -----  -----  -----
*        default  1      1         0      0      0      0

msf auxiliary(scanner/ftp/ftp_version) > services
Services
========

host       port  proto  name  state  info  resource  parents
----       ----  -----  ----  -----  ----  --------  -------
10.0.0.10  22    tcp          open         {}

msf auxiliary(scanner/ftp/ftp_version) >
msf auxiliary(scanner/ftp/ftp_version) >
msf auxiliary(scanner/ftp/ftp_version) >
msf auxiliary(scanner/ftp/ftp_version) > workspace -D
[*] Deleted workspace: default
[*] Recreated the default workspace
msf auxiliary(scanner/ftp/ftp_version) > set RPORT 999
RPORT => 999
msf auxiliary(scanner/ftp/ftp_version) > run
[*] 10.0.0.10:999         - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(scanner/ftp/ftp_version) > workspace -v

Workspaces
==========

current  name     hosts  services  vulns  creds  loots  notes
-------  ----     -----  --------  -----  -----  -----  -----
*        default  1      0         0      0      0      0

msf auxiliary(scanner/ftp/ftp_version) >

[g0tmi1k]

Think I've finished tweaking with this PR!

[cdelafuente-r7]

Thanks @g0tmi1k for these updates. I left a few suggestions and comments. Please, add specs to test all these changes. We started to require strict unit tests for library changes.

Also, this PR was suppose to be related to the fingerprinting using Recog, but, it looks like it updates more things in the library. Please, consider splitting it in multiple PR's if there is no dependency between these changes.

[g0tmi1k]

Hello once again @cdelafuente-r7.
I believe everything has been addressed (eview comments, specs etc).
I also have split this PR up into 3 parts now as requested.

Please let me know any other changes that fits!

[cdelafuente-r7]

Thanks @g0tmi1k for your last updates. I left some comments.

[g0tmi1k]

Hi once again @cdelafuente-r7 - think everything as been addressed/answered =)

[cdelafuente-r7]

Specs are failing due to the addition of # frozen_string_literal: true. This is due to an issue in #recv_ftp_resp (lib/msf/core/exploit/remote/ftp.rb): @ftpbuff is now frozen by default and this method tries to modify it. This is not related to this PR. So, please remove the # frozen_string_literal: true directive for now and we will fix the mixin later in an other PR. Sorry about that.

Also, a good practice is to run the specs locally to detect any issue like this, specially if you updated them:

bundle exec rspec spec/lib/msf/core/exploit/remote/ftp_spec.rb

[g0tmi1k]

Noted @cdelafuente-r7.
Reverted.

Think its good now (passing local!)

[cdelafuente-r7]

Thanks @g0tmi1k ! This looks good to me. I'll go ahead and land it.

[cdelafuente-r7]

Release Notes

This updates the Exploit::Remote::Ftp mixin to improve target fingerprinting. It now leverages recog to fingerprint targets from their banners and adds ftp_fingerprint and ftp_list_directory methods to assist with target enumeration.

[g0tmi1k]

Woohoo! Thanks @cdelafuente-r7 🥳