Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

I currently have a machine (set by another person) that has (according to nmap) open ports as:

  • FreeBSD ftpd 6.00LS where anonymous login is possible
  • OpenSSH 4.5p1 (FreeBSD 20061110; protocol 2.0)
  • FreeBSD fingerd
  • Apache httpd 2.2.6 ((FreeBSD) DAV/2 PHP/4.4.7 with Suhosin-Patch mod_ssl/2.2.6 OpenSSL/0.9.8e) | http-methods: GET HEAD POST OPTIONS TRACE
  • cvs pserver
  • mysql (unauthorized).

The OS is FreeBSD 8.1-release.

I use a VPN to connect to my server, and every time I use vulnerability scanners, the connection freezes. Not sure if this is due to the size of packets, but they do not work. Acunetix web scanner does work, but it is irrelevant with what I am trying to test, as there is no web application on the server. I am assuming that the machine is set to detect vulnerability scanners, so I cannot use vulnerability scanners to check how the machine would be vulnerable.

Is there any vulnerability that a hacker might use to gain the command shell of the system?

Also, would there be any way to gain the command shell of the system using finger (command finger @my-machine-IP-address says access denied.)

Add: what does "MySQL (unauthorized)" mean?

share|improve this question
"what does "MySQL (unauthorized)" mean?" - I think you'll need to provide more context. More broadly, please read our faq for information about how to ask a good question, then edit your question accordingly. That will increase the likelihood that you will receive useful answers. As it stands, the question may be of too narrow applicability to be a good fit for this site. – D.W. Aug 21 '12 at 6:30
@D.W. The problem is, VPN credidential is shared with some people. – Dao Ziang Aug 21 '12 at 6:32
1  
I suspect your VPN-management issues are outside the scope of the IT Security site. Perhaps you should consider migrating your question to Serverfault instead of IT Security? – D.W. Aug 21 '12 at 6:41
I think @D.W. has answered the part of the question which is on topic here as best he can with the information you have given. The rest seems to be a configuration or management issue - do you want to remove those aspects from the question and ask that bit on serverfault? – Rory Alsop♦ Aug 21 '12 at 9:17
If you're using an automated scanner like McAfee Vulnerability Manager, there may be some options for performance throttling you could try tweaking. Set it to the lowest bandwidth usage possible, and see what happens. – Iszi Aug 22 '12 at 19:23

2 Answers

up vote 1 down vote accepted

Is there any vulnerability that a hacker might use to gain the command shell of the system?

That depends upon whether any of the software on your system is vulnerable. We probably cannot answer that for you, and in any case, any answer would be too specific to your particular system to be of relevance to others and too limited in time to be of broad interest.

If you are unable to scan your machine with nmap, I suggest you check whether you have a firewall set up that might be blocking nmap.

For information about how to secure your server, I suggest you search on server hardening on this site. I think you'll find a good bit of information about how to lock down a server to reduce the likelihood of vulnerability.

P.S. Generally speaking, I would turn off fingerd or configure my firewall to block all connections to it. Almost no one uses finger these days, so there is not much reason to be running an Internet-facing fingerd server -- it's just unnecessary risk.

share|improve this answer
up vote 1 down vote

Some scanners do not support the scanning over a VPN tunnel for numerous reasons. For some scanners that do, some VPN's have issues. A few things to consider: If you are configuring your scanner to detect UDP, then I would recommend throttling the scan speed down as it is slow in nature in and of itself. For TCP, try configuring your scanner to use SYN vs. a Full Connect for your 1st test. Many other items to consider as well but the above may help. Also if it is a Windows or OSX system, you can run a free scan on the www.iscanonline.com (No registration needed and will provide you all ports, configs, vulns and missing patches.)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.