auxiliary/server/capture/XXXX part-1

auxiliary/server/capture/ftp

This module provides a fake FTP service that is designed to capture authentication credentials.
I've used FileZilla for logins

[used FileZilla to pentest login]

auxiliary/server/capture/smb

This module provides a FAKE SMB service that can be used to capture the challenge-response password hashes of SMB client systems.

Responses sent by this service have by default the configurable challenge string (\x11\x22\x33\x44\x55\x66\x77\x88), allowing for easy cracking using Cain & Abel, L0phtcrack or John the ripper (with jumbo patch).

To exploit this, the target system must try to authenticate to this module. The easiest way to force a SMB authentication attempt is by embedding a UNC path (\SERVER\SHARE) into a web page or email message. When the victim views the web page or email, their system will automatically connect to the server specified in the UNC share (the IP address of the system running this module) and attempt to authenticate.

SMB: Server Message Block (SMB), also known as Common Internet File System (CIFS) used for providing shared access to files, printers, serial ports, and miscellaneous communications between nodes on a network.

http://en.wikipedia.org/wiki/Server_Message_Block

http://oss.sgi.com/LDP/HOWTO/SMB-HOWTO-8.html

To test accessing the fake server and put the password »

smbclient -L [serverip] -U [username]
smbclient -L 192.168.45.1 -U test

To crack the password hash »

john JOHNPWFILE

auxiliary/server/capture/pop3

This module provides a fake POP3 service that is designed to capture authentication credentials.

[used Microsoft Outlook for pentest login]

auxiliary/server/capture/telnet

auxiliary/server/capture/smtp

 

auxiliary/scanner/telnet/

setting up the environment:

windows machine:

Control Panel\Programs\Programs and Features >> turn windows features on or off >> check Telnet server
run >> services.msc >> Telnet >> start
Till now you can login with the administrator credential,
to permit another account >> Control Panel\System and Security\Administrative Tools >> computer management >> system tools >> local users and groups >> Groups >> TelnetClients, then add another account
[the server accounts must have password]

Backtrack machine:

you can test the server by :

telnet [server_ip]

scanner/telnet/telnet_version

Used to detect telnet version on remote system

scanner/telnet/telnet_login

This module will test a telnet login on a range of machines and report successful logins

login successful

scanner/telnet/telnet_encrypt_overflow
scanner/telnet/lantronix_telnet_version

auxiliary/scanner/ssh/

Metasploit auxiliray modules come with four SSH scanners namely,

1. scanner/ssh/ssh_version 
2. scanner/ssh/ssh_login 
3. scanner/ssh/ssh_identify_pubkeys 
4. scanner/ssh/ssh_login_pubkey

All are used against a RANGE of IPs, so most of the other modules, and that  is the damn good advantage of auxiliary modules. BUT you need to specify one ip by another, you can't use for example xx.xx.xx.1-254 or xx.xx.xx.1,2,3,4 :(

There are two types of SSH authentication, USERNAME-PASSWORD and PRIVATE-PUBLIC KEYS.

USERNAME-PASSWORD authentication is simply the user and password of a user on the local machine. key authentication is an alternative to user-pass authentication, simply the public key is the server-side and the private key is the remote-side.

auxiliary/scanner/ssh/ssh_version

This module is used to detect SSH version on a range of ip addresses 

auxiliary/scanner/ssh/ssh_login

This module will test ssh logins on a range of machines and report successful logins

[SSH login is simply a server account login]

auxiliary/scanner/ssh/ssh_identify_pubkeys

This module can determine what public keys are configured for key-based authentication across a range of machines, users, and sets of known keys
set KEY_FILE to whether the puplic key path or the private key path

auxiliary/scanner/ssh/ssh_login_pubkey

This module will test ssh logins on a range of machines using a defined private key file, and report successful logins

Puplic-private key authentication is an alternative to Username-password authentication. Demo:

To generate Puplic-private authentication key:

ssh-keygen -t rsa

This will generate 2 files, located in /root/.ssh/

public key "id_rsa.pub" >> for the server
private key "id_rsa" >> for the client

To register that key, you need to add the .pub to /root/.ssh/authorized_keys, automatically by using:

ssh-id-copy -i /root/.ssh/id_rsa.pub [user@server_ip]

To test your registered key:

ssh -i [private_key] [server_ip]


http://linuxconfig.org/Passwordless_ssh

auxiliary/scanner/discovery/arp_sweep

This module scan a range of ip addresses to identify hosts alive and missing on the local Ethernet