Re: FTP Anon Inquiry (Writeable Directory)

[Rob Nicholls <robert () robnicholls co uk>]

Hi Zack,
> My question is, how can I tell that its writeable? Can I add files to 
> that
> folder since it writeable?

The script is very basic in its check, it doesn't confirm that files 
definitely can be written, it simply checks the returned directory 
listing for a "w" character to indicate that files can potentially be 
written inside that directory.

You can see this in the ftp-anon script:

for _, item in ipairs(listing) do
  -- Just a quick passive check on user rights.
  if string.match(item, "^[d-].......w.") then
    item = item .. " [NSE: writeable]"
  end
  result[#result + 1] = item
end

This means it could potentially be a false positive, but I suspect it's 
generally very unlikely to be wrong. If you want to know for sure you'll 
need to try and manually create a file within the directory, as the 
script currently doesn't appear to be capable of uploading a file to be 
100% sure.

Rob

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/