nmap / nmap/nmap

http-userdir-enum usage example gives no results

Open
#1,902 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement NSE
Dominant language
C
Stars
13.6k
Forks
2.9k
PR merge metrics
No merged PRs in 30d

Description

While working on the metasploit documentation for the equivalent module, we've been adding 'how to confirm' sections for other tools (usually nmap scripts). We attempted to use scripts/http-userdir-enum.nse based on the usage example from https://nmap.org/nsedoc/scripts/http-userdir-enum.html however it outputs nothing (no errors, no output from script). I've confirmed the setup is vulnerable through the metasploit module.
See https://github.com/rapid7/metasploit-framework/pull/12706/files#r373152822

Example here is an Ubuntu 18.04 fresh apache install w/ only change being userdir enabled.

Metasploit

used as confirmation of vuln server.

msf5 auxiliary(scanner/http/apache_userdir_enum) > exploit

[*] http://1.1.1.1/~ - Trying UserDir: ''
[*] http://1.1.1.1/ - Apache UserDir: '' not found
[*] http://1.1.1.1/~4Dgifts - Trying UserDir: '4Dgifts'
[*] http://1.1.1.1/ - Apache UserDir: '4Dgifts' not found
[*] http://1.1.1.1/~EZsetup - Trying UserDir: 'EZsetup'
[*] http://1.1.1.1/ - Apache UserDir: 'EZsetup' not found
[*] http://1.1.1.1/~OutOfBox - Trying UserDir: 'OutOfBox'
[*] http://1.1.1.1/ - Apache UserDir: 'OutOfBox' not found
[*] http://1.1.1.1/~ROOT - Trying UserDir: 'ROOT'
[*] http://1.1.1.1/ - Apache UserDir: 'ROOT' not found
[*] http://1.1.1.1/~adm - Trying UserDir: 'adm'
[*] http://1.1.1.1/ - Apache UserDir: 'adm' not found
[*] http://1.1.1.1/~admin - Trying UserDir: 'admin'
[*] http://1.1.1.1/ - Apache UserDir: 'admin' not found
[*] http://1.1.1.1/~administrator - Trying UserDir: 'administrator'
[*] http://1.1.1.1/ - Apache UserDir: 'administrator' not found
[*] http://1.1.1.1/~anon - Trying UserDir: 'anon'
[*] http://1.1.1.1/ - Apache UserDir: 'anon' not found
[*] http://1.1.1.1/~auditor - Trying UserDir: 'auditor'
[*] http://1.1.1.1/ - Apache UserDir: 'auditor' not found
[*] http://1.1.1.1/~avahi - Trying UserDir: 'avahi'
[*] http://1.1.1.1/ - Apache UserDir: 'avahi' not found
[*] http://1.1.1.1/~avahi-autoipd - Trying UserDir: 'avahi-autoipd'
[*] http://1.1.1.1/ - Apache UserDir: 'avahi-autoipd' not found
[*] http://1.1.1.1/~backup - Trying UserDir: 'backup'
[+] http://1.1.1.1/ - Apache UserDir: 'backup' found 
[*] http://1.1.1.1/~bbs - Trying UserDir: 'bbs'
[*] http://1.1.1.1/ - Apache UserDir: 'bbs' not found
[*] http://1.1.1.1/~bin - Trying UserDir: 'bin'
[+] http://1.1.1.1/ - Apache UserDir: 'bin' found 
...clip...
[+] http://1.1.1.1/ - Users found: backup, bin, daemon, games, gnats, irc, list, lp, mail, man, messagebus, news, nobody, proxy, sshd, sync, sys, syslog, uucp
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

nmap

/metasploit-framework# nmap -sV --script=http-userdir-enum -p 80 1.1.1.1
Starting Nmap 7.80 ( https://nmap.org ) at 2020-01-30 13:31 EST
Nmap scan report for ubuntu1804 (1.1.1.1)
Host is up (0.00064s latency).

PORT   STATE SERVICE VERSION
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
MAC Address: 00:0C:29:0F:8A:9E (VMware)

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.59 seconds

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with scripts/http-userdir-enum.nse and its usage example, then reproduce the reported command against the Ubuntu 18.04 Apache setup described in the issue. Compare the script's behavior with the Metasploit output; done means the Nmap script reports discovered users or otherwise explains and correctly handles this configuration.

Written by the indexing model from the issue text.

Assessment

Tech stack
apache, lua, ubuntu
Domain
networking, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.