http-userdir-enum usage example gives no results
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 13.6k
- Forks
- 2.9k
- PR merge metrics
- No merged PRs in 30d
Description
While working on the metasploit documentation for the equivalent module, we've been adding 'how to confirm' sections for other tools (usually nmap scripts). We attempted to use scripts/http-userdir-enum.nse based on the usage example from https://nmap.org/nsedoc/scripts/http-userdir-enum.html however it outputs nothing (no errors, no output from script). I've confirmed the setup is vulnerable through the metasploit module.
See https://github.com/rapid7/metasploit-framework/pull/12706/files#r373152822
Example here is an Ubuntu 18.04 fresh apache install w/ only change being userdir enabled.
Metasploit
used as confirmation of vuln server.
msf5 auxiliary(scanner/http/apache_userdir_enum) > exploit
[*] http://1.1.1.1/~ - Trying UserDir: ''
[*] http://1.1.1.1/ - Apache UserDir: '' not found
[*] http://1.1.1.1/~4Dgifts - Trying UserDir: '4Dgifts'
[*] http://1.1.1.1/ - Apache UserDir: '4Dgifts' not found
[*] http://1.1.1.1/~EZsetup - Trying UserDir: 'EZsetup'
[*] http://1.1.1.1/ - Apache UserDir: 'EZsetup' not found
[*] http://1.1.1.1/~OutOfBox - Trying UserDir: 'OutOfBox'
[*] http://1.1.1.1/ - Apache UserDir: 'OutOfBox' not found
[*] http://1.1.1.1/~ROOT - Trying UserDir: 'ROOT'
[*] http://1.1.1.1/ - Apache UserDir: 'ROOT' not found
[*] http://1.1.1.1/~adm - Trying UserDir: 'adm'
[*] http://1.1.1.1/ - Apache UserDir: 'adm' not found
[*] http://1.1.1.1/~admin - Trying UserDir: 'admin'
[*] http://1.1.1.1/ - Apache UserDir: 'admin' not found
[*] http://1.1.1.1/~administrator - Trying UserDir: 'administrator'
[*] http://1.1.1.1/ - Apache UserDir: 'administrator' not found
[*] http://1.1.1.1/~anon - Trying UserDir: 'anon'
[*] http://1.1.1.1/ - Apache UserDir: 'anon' not found
[*] http://1.1.1.1/~auditor - Trying UserDir: 'auditor'
[*] http://1.1.1.1/ - Apache UserDir: 'auditor' not found
[*] http://1.1.1.1/~avahi - Trying UserDir: 'avahi'
[*] http://1.1.1.1/ - Apache UserDir: 'avahi' not found
[*] http://1.1.1.1/~avahi-autoipd - Trying UserDir: 'avahi-autoipd'
[*] http://1.1.1.1/ - Apache UserDir: 'avahi-autoipd' not found
[*] http://1.1.1.1/~backup - Trying UserDir: 'backup'
[+] http://1.1.1.1/ - Apache UserDir: 'backup' found
[*] http://1.1.1.1/~bbs - Trying UserDir: 'bbs'
[*] http://1.1.1.1/ - Apache UserDir: 'bbs' not found
[*] http://1.1.1.1/~bin - Trying UserDir: 'bin'
[+] http://1.1.1.1/ - Apache UserDir: 'bin' found
...clip...
[+] http://1.1.1.1/ - Users found: backup, bin, daemon, games, gnats, irc, list, lp, mail, man, messagebus, news, nobody, proxy, sshd, sync, sys, syslog, uucp
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
nmap
/metasploit-framework# nmap -sV --script=http-userdir-enum -p 80 1.1.1.1
Starting Nmap 7.80 ( https://nmap.org ) at 2020-01-30 13:31 EST
Nmap scan report for ubuntu1804 (1.1.1.1)
Host is up (0.00064s latency).
PORT STATE SERVICE VERSION
80/tcp open http Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
MAC Address: 00:0C:29:0F:8A:9E (VMware)
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.59 seconds
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with scripts/http-userdir-enum.nse and its usage example, then reproduce the reported command against the Ubuntu 18.04 Apache setup described in the issue. Compare the script's behavior with the Metasploit output; done means the Nmap script reports discovered users or otherwise explains and correctly handles this configuration.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- apache, lua, ubuntu
- Domain
- networking, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100