Bounty Hacker [THM] writeup
Categories:
Mis-configured services
SEVERITY: 10/10
Due to an FTP (File Transfer Protocol) misconfiguration, an attacker could connect, and download a list of passwords. Which can then be used to attempt to login to the SSH (secure shell, a service used for accessing servers/desktops remotely) service, which hosts sensitive information.
My security assessment has revealed security risks that could endanger any, and all sensitive information on the target system. RECOMMENDATIONS:
-Disable anonymous logins in the FTP so only authorized users can access it
-Switch from HTTP to HTTPS with proper TLS configurations and certificates for secure connections
-Store credentials in an authentication based service opposed to plain text which allow easy access
-Remove all credentials stored in plain text files
TIMELINE OF AUDIT
Once given the target, I quickly gained access to a weak File Transfer Protocol service on the server. The service was configured to allow "anonymous" logins. Meaning any unauthorized user, if they had the IP, could login anonymously, and download what was being hosted on this service/server.
The server was hosting sensitive information, a plain text list of potential passwords. Which were used to bruteforce (try every username/password combination) the SSH service on the server.
After a correct username/password combination was found, access was granted, and sensitive system information was extracted.
With these risks, an attacker could find sensitive information, which increases the chances of further unauthorized access to company systems.
Malicious actors could cause downtime, vandalize company internals, extract sensitive data, modify sensitive data, and potentially could compromise the
entire server.
VOCABULARY
SSH (Secure Shell)
SSH is a Remote Access Protocol, which allows you to
connect remotely, and transfer files between your computer, and the
server, at will.
FTP (File Transfer Protocol)
The File Transfer Protocol is a standard communication protocol used for the transfer of computer files from a server to a client over a computer network.
Bruteforce/Brute force
A brute force attack is a hacking method that uses trial and error to crack passwords, login credentials, and encryption keys.
TLS (Transport Layer Security)
Transport Layer Security is a cryptographic protocol designed to provide communications security over a computer network, such as the Internet.