MPEi/X Default FTP Accounts - Nessus

Critical   Plugin ID: 11000

---

This page contains detailed information about the MPEi/X Default FTP Accounts Nessus plugin including available exploits and PoCs found on GitHub, in Metasploit or Exploit-DB for verifying of this vulnerability.

Plugin Overview

---

ID: 11000
Name: MPEi/X Default FTP Accounts
Filename: DDI_MPEiX_FTP_Accounts.nasl
Vulnerability Published: 2001-01-01
This Plugin Published: 2002-06-05
Last Modification Time: 2018-07-25
Plugin Version: 1.22
Plugin Type: remote
Plugin Family: FTP
Dependencies: find_service1.nasl, ftpserver_detect_type_nd_version.nasl

Vulnerability Information

---

Severity: Critical
Vulnerability Published: 2001-01-01
Patch Published: N/A
CVE [?]: CVE-1999-0502
CPE [?]: N/A

Synopsis

The remote FTP server has one or more account with a blank password.

Description

The remote FTP server has one or more accounts with a blank password.

Solution

Apply complex passwords to all accounts.

Public Exploits

---

Target Network Port(s): 21
Target Asset(s): Services/ftp
Exploit Available: True (Metasploit Framework, Exploit-DB)
Exploit Ease: No exploit is required

Here's the list of publicly known exploits and PoCs for verifying the MPEi/X Default FTP Accounts vulnerability:

1. Metasploit: exploit/multi/ssh/sshexec
   [SSH User Code Execution]
2. Metasploit: auxiliary/scanner/telnet/brocade_enable_login
   [Brocade Enable Login Check Scanner]
3. Metasploit: auxiliary/scanner/db2/db2_auth
   [DB2 Authentication Brute Force Utility]
4. Metasploit: auxiliary/scanner/http/dell_idrac
   [Dell iDRAC Default Login]
5. Metasploit: auxiliary/scanner/http/dlink_dir_300_615_http_login
   [D-Link DIR-300A / DIR-320 / DIR-615D HTTP Login Utility]
6. Metasploit: auxiliary/scanner/http/dlink_dir_615h_http_login
   [D-Link DIR-615H HTTP Login Utility]
7. Metasploit: auxiliary/scanner/http/dlink_dir_session_cgi_http_login
   [D-Link DIR-300B / DIR-600B / DIR-815 / DIR-645 HTTP Login Utility]
8. Metasploit: auxiliary/scanner/ftp/ftp_login
   [FTP Authentication Scanner]
9. Metasploit: auxiliary/scanner/http/http_login
   [HTTP Login Utility]
10. Metasploit: auxiliary/scanner/http/joomla_bruteforce_login
    [Joomla Bruteforce Login Utility]
11. Metasploit: auxiliary/scanner/mysql/mysql_login
    [MySQL Login Utility]
12. Metasploit: auxiliary/scanner/nntp/nntp_login
    [NNTP Login Utility]
13. Metasploit: auxiliary/scanner/oracle/oracle_login
    [Oracle RDBMS Login Utility]
14. Metasploit: auxiliary/scanner/pcanywhere/pcanywhere_login
    [PcAnywhere Login Scanner]
15. Metasploit: auxiliary/scanner/postgres/postgres_login
    [PostgreSQL Login Utility]
16. Metasploit: auxiliary/scanner/rservices/rexec_login
    [rexec Authentication Scanner]
17. Metasploit: auxiliary/scanner/rservices/rlogin_login
    [rlogin Authentication Scanner]
18. Metasploit: auxiliary/scanner/rservices/rsh_login
    [rsh Authentication Scanner]
19. Metasploit: auxiliary/scanner/ssh/ssh_login
    [SSH Login Check Scanner]
20. Metasploit: auxiliary/scanner/telnet/telnet_login
    [Telnet Login Check Scanner]
21. Metasploit: auxiliary/scanner/http/tomcat_mgr_login
    [Tomcat Application Manager Login Utility]
22. Metasploit: auxiliary/scanner/vmware/vmauthd_login
    [VMWare Authentication Daemon Login Scanner]
23. Metasploit: auxiliary/scanner/vmware/vmware_http_login
    [VMWare Web Login Scanner]
24. Metasploit: auxiliary/scanner/winrm/winrm_login
    [WinRM Login Utility]
25. Metasploit: auxiliary/scanner/http/wordpress_xmlrpc_login
    [Wordpress XML-RPC Username/Password Login Scanner]
26. Exploit-DB: exploits/linux/remote/35581.rb
    [EDB-35581: Varnish Cache CLI Interface - Remote Code Execution (Metasploit)]
27. Exploit-DB: exploits/multiple/remote/41694.rb
    [EDB-41694: SSH - User Code Execution (Metasploit)]

Before running any exploit against any system, make sure you are authorized by the owner of the target system(s) to perform such activity. In any other case, this would be considered as an illegal activity.

WARNING: Beware of using unverified exploits from sources such as GitHub or Exploit-DB. These exploits and PoCs could contain malware. For more information, see how to use exploits safely.

Risk Information

---

CVSS V2 Vector [?]: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:TF/RC:C

CVSS Base Score:	10.0 (High)
Impact Subscore:	10.0
Exploitability Subscore:	10.0
CVSS Temporal Score:	8.1 (High)
CVSS Environmental Score:	NA (None)
Modified Impact Subscore:	NA
Overall CVSS Score:	8.1 (High)

Go back to menu.

Plugin Source

---

This is the DDI_MPEiX_FTP_Accounts.nasl nessus plugin source code. This script is Copyright (C) 2002-2018 H D Moore

# This script was written by H D Moore <[email protected]>
#
# See the Nessus Scripts License for details
#

# Changes by Tenable:
# - Revised plugin title, changed family (11/04/10)

include("compat.inc");

if(description)
{
 script_id(11000); 
 script_version ("1.22");
 script_cvs_date("Date: 2018/07/25 16:19:22");

 script_cve_id("CVE-1999-0502");

 script_name(english:"MPEi/X Default FTP Accounts");
 script_summary(english:"Checks for open accounts");

 script_set_attribute(attribute:"synopsis", value:
"The remote FTP server has one or more account with a blank
password.");
 script_set_attribute(attribute:"description", value:
"The remote FTP server has one or more accounts with a blank
password.");
 script_set_attribute(attribute:"solution", value:
"Apply complex passwords to all accounts.");
 script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
 script_set_cvss_temporal_vector("CVSS2#E:POC/RL:TF/RC:C");
 script_set_attribute(attribute:"exploitability_ease", value:"No exploit is required");
 script_set_attribute(attribute:"exploit_available", value:"false");
 script_set_attribute(attribute:"metasploit_name", value:'SSH User Code Execution');
 script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
script_set_attribute(attribute:"plugin_publication_date", value:
"2002/06/05");
 script_set_attribute(attribute:"vuln_publication_date", value: "2001/01/01");
 script_set_attribute(attribute:"plugin_type", value:"remote");
 script_end_attributes();
 
 script_category(ACT_GATHER_INFO);
 
 script_copyright(english:"This script is Copyright (C) 2002-2018 H D Moore");
 script_family(english:"FTP");
 script_dependencie("find_service1.nasl", "ftpserver_detect_type_nd_version.nasl");
 script_require_ports("Services/ftp", 21);
 exit(0);
}

include("ftp_func.inc");

#
# default account listing
#
accounts[0] = "OPERATOR.SYS";
accounts[1] = "MANAGER.SYS";
accounts[2] = "SPECTRUM.CU1";
accounts[3] = "CU1.DBA";
accounts[4] = "CU1.MANAGER";
accounts[5] = "CU1.MGR";
accounts[6] = "CUTEST1.MANAGER";
accounts[7] = "CUTEST1.MGR";
accounts[8] = "CUTRAIN.MANAGER";
accounts[9] = "CUTRAIN.MGR";
accounts[10] = "SUPPORT.FIELD";
accounts[11] = "SUPPORT.MANAGER";
accounts[12] = "SUPPORT.MGR";
accounts[13] = "SUPPORT.OPERATOR";
accounts[14] = "SYS.MANAGER";
accounts[15] = "SYS.MGR";
accounts[16] = "SYS.NWIXUSER";
accounts[17] = "SYS.OPERATOR";
accounts[18] = "SYS.PCUSER";
accounts[19] = "SYS.RSBCMON";
accounts[20] = "SYSMGR.MANAGER";
accounts[21] = "SYSMGR.MGR";
accounts[22] = "TELAMON.MANAGER";
accounts[23] = "TELAMON.MGR";
accounts[24] = "TELESUP.FIELD";
accounts[25] = "TELESUP.MAIL";
accounts[26] = "TELESUP.MANAGER";
accounts[27] = "TELESUP.MGR";
accounts[28] = "VECSL.MANAGER";
accounts[29] = "VECSL.MGR";
accounts[30] = "VESOFT.MANAGER";
accounts[31] = "VESOFT.MGR";
accounts[32] = "BIND.MANAGER";
accounts[33] = "BIND.MGR";
accounts[34] = "CAROLIAN.MANAGER";
accounts[35] = "CAROLIAN.MGR";
accounts[36] = "CCC.MANAGER";
accounts[37] = "CCC.MGR";
accounts[38] = "CCC.SPOOL";
accounts[39] = "CNAS.MGR";
accounts[40] = "COGNOS.MANAGER";
accounts[41] = "COGNOS.MGR";
accounts[42] = "COGNOS.OPERATOR";
accounts[43] = "CONV.MANAGER";
accounts[44] = "CONV.MGR";
accounts[45] = "HPLANMANAGER.MANAGER";
accounts[46] = "HPLANMANAGER.MGR";
accounts[47] = "HPNCS.FIELD";
accounts[48] = "HPNCS.MANAGER";
accounts[49] = "HPNCS.MGR";
accounts[50] = "HPOFFICE.ADVMAIL";
accounts[51] = "HPOFFICE.DESKMON";
accounts[52] = "HPOFFICE.MAIL";
accounts[53] = "HPOFFICE.MAILMAN";
accounts[54] = "HPOFFICE.MAILROOM";
accounts[55] = "HPOFFICE.MAILTRCK";
accounts[56] = "HPOFFICE.MANAGER";
accounts[57] = "HPOFFICE.MGR";
accounts[58] = "HPOFFICE.OPENMAIL";
accounts[59] = "HPOFFICE.PCUSER";
accounts[60] = "HPOFFICE.SPOOLMAN";
accounts[61] = "HPOFFICE.WP";
accounts[62] = "HPOFFICE.X400FER";
accounts[63] = "HPOPTMGT.MANAGER";
accounts[64] = "HPOPTMGT.MGR";
accounts[65] = "HPPL85.FIELD";
accounts[66] = "HPPL85.MANAGER";
accounts[67] = "HPPL85.MGR";
accounts[68] = "HPPL87.FIELD";
accounts[69] = "HPPL87.MANAGER";
accounts[70] = "HPPL87.MGR";
accounts[71] = "HPPL89.FIELD";
accounts[72] = "HPPL89.MANAGER";
accounts[73] = "HPPL89.MGR";
accounts[74] = "HPSKTS.MANAGER";
accounts[75] = "HPSKTS.MGR";
accounts[76] = "HPWORD.MANAGER";
accounts[77] = "HPWORD.MGR";
accounts[78] = "INFOSYS.MANAGER";
accounts[79] = "INFOSYS.MGR";
accounts[80] = "ITF3000.MANAGER";
accounts[81] = "ITF3000.MGR";
accounts[82] = "JAVA.MANAGER";
accounts[83] = "JAVA.MGR";
accounts[84] = "RJE.MANAGER";
accounts[85] = "RJE.MGR";
accounts[86] = "ROBELLE.MANAGER";
accounts[87] = "ROBELLE.MGR";
accounts[88] = "SNADS.MANAGER";
accounts[89] = "SNADS.MGR";

#
# The script code starts here
#

# open the connection
port = get_ftp_port(default:21);

# exit if this is a JetDirect
JD = get_kb_item("ftp/"+port+"/JetDirect");
if (JD)exit(0);


banner = get_ftp_banner(port:port);

# check for HP ftp service
if("HP ARPA FTP" >< banner)
{
    # do nothing
} else {
    exit(0);
}

soc = open_sock_tcp(port);
if (!soc) exit(1, "Cannot connect to TCP port "+port+".");
d = ftp_recv_line(socket:soc);

CRLF = raw_string(0x0d, 0x0a);
cracked = string("");

for(i=0; accounts[i]; i = i +1)
{
    username = accounts[i];
    user = string("USER ", username, CRLF); 
    
    send(socket:soc, data:user);
    resp = ftp_recv_line(socket:soc);
    
    if ("230 User logged on" >< resp)
    {
        cracked = string(cracked, username, "\n");
    }
}
ftp_close(socket:soc);

if (strlen(cracked))
{
    report = string("\nThese accounts have no passwords:\n\n", cracked);
    security_hole(port:port, extra:report);
}

The latest version of this script can be found in these locations depending on your platform:

• Linux / Unix:
  /opt/nessus/lib/nessus/plugins/DDI_MPEiX_FTP_Accounts.nasl
• Windows:
  C:\ProgramData\Tenable\Nessus\nessus\plugins\DDI_MPEiX_FTP_Accounts.nasl
• Mac OS X:
  /Library/Nessus/run/lib/nessus/plugins/DDI_MPEiX_FTP_Accounts.nasl

Go back to menu.

How to Run

---

Here is how to run the MPEi/X Default FTP Accounts as a standalone plugin via the Nessus web user interface (https://localhost:8834/):

1. Click to start a New Scan.
2. Select Advanced Scan.
3. Navigate to the Plugins tab.
4. On the top right corner click to Disable All plugins.
5. On the left side table select FTP plugin family.
6. On the right side table select MPEi/X Default FTP Accounts plugin ID 11000.
7. Specify the target on the Settings tab and click to Save the scan.
8. Run the scan.

Here are a few examples of how to run the plugin in the command line. Note that the examples below demonstrate the usage on the Linux / Unix platform.

Basic usage:

/opt/nessus/bin/nasl DDI_MPEiX_FTP_Accounts.nasl -t <IP/HOST>

Run the plugin with audit trail message on the console:

/opt/nessus/bin/nasl -a DDI_MPEiX_FTP_Accounts.nasl -t <IP/HOST>

Run the plugin with trace script execution written to the console (useful for debugging):

/opt/nessus/bin/nasl -T - DDI_MPEiX_FTP_Accounts.nasl -t <IP/HOST>

Run the plugin with using a state file for the target and updating it (useful for running multiple plugins on the target):

/opt/nessus/bin/nasl -K /tmp/state DDI_MPEiX_FTP_Accounts.nasl -t <IP/HOST>

Go back to menu.

References

---

See also:

• https://www.tenable.com/plugins/nessus/11000
• https://vulners.com/nessus/DDI_MPEIX_FTP_ACCOUNTS.NASL

Similar and related Nessus plugins:

• 11205 - WarFTPd CWD/MKD Command Overflow
• 11207 - WarFTPd USER/PASS Command Remote Overflow
• 10961 - AirConnect Default Password
• 11202 - Enhydra Multiserver Default Password
• 10820 - F5 Device Default Support Password
• 10995 - Sun JavaServer Default Admin Password
• 10998 - Shiva LanRover Blank Password
• 10999 - Linksys Router Default Password
• 11203 - Motorola Vanguard with No Password (telnet check)
• 11208 - Netscape Enterprise Default Administrative Password
• 10798 - Symantec pcAnywhere Service Unrestricted Access
• 10778 - SiteScope Web Service Unpassworded Access
• 11004 - Ipswitch WhatsUp Gold Default Admin Account

Version

---

This page has been produced using Nessus Professional 10.1.2 (#68) LINUX, Plugin set 202205072148.
Plugin file DDI_MPEiX_FTP_Accounts.nasl version 1.22. For more plugins, visit the Nessus Plugin Library.

Go back to menu.