I currently have a machine (set by another person) that has (according to nmap) open ports as:

  • FreeBSD ftpd 6.00LS where anonymous login is possible
  • OpenSSH 4.5p1 (FreeBSD 20061110; protocol 2.0)
  • FreeBSD fingerd
  • Apache httpd 2.2.6 ((FreeBSD) DAV/2 PHP/4.4.7 with Suhosin-Patch mod_ssl/2.2.6 OpenSSL/0.9.8e) | http-methods: GET HEAD POST OPTIONS TRACE
  • cvs pserver
  • mysql (unauthorized).

The OS is FreeBSD 8.1-release.

I use a VPN to connect to my server, and every time I use vulnerability scanners, the connection freezes. Not sure if this is due to the size of packets, but they do not work. Acunetix web scanner does work, but it is irrelevant with what I am trying to test, as there is no web application on the server. I am assuming that the machine is set to detect vulnerability scanners, so I cannot use vulnerability scanners to check how the machine would be vulnerable.

Is there any vulnerability that a hacker might use to gain the command shell of the system?

Also, would there be any way to gain the command shell of the system using finger (command finger @my-machine-IP-address says access denied.)

Add: what does "MySQL (unauthorized)" mean?

  • "what does "MySQL (unauthorized)" mean?" - I think you'll need to provide more context. More broadly, please read our faq for information about how to ask a good question, then edit your question accordingly. That will increase the likelihood that you will receive useful answers. As it stands, the question may be of too narrow applicability to be a good fit for this site.
    – D.W.
    Aug 21, 2012 at 6:30
  • @D.W. The problem is, VPN credidential is shared with some people.
    – Dao Ziang
    Aug 21, 2012 at 6:32
  • 1
    I suspect your VPN-management issues are outside the scope of the IT Security site. Perhaps you should consider migrating your question to Serverfault instead of IT Security?
    – D.W.
    Aug 21, 2012 at 6:41
  • If you're using an automated scanner like McAfee Vulnerability Manager, there may be some options for performance throttling you could try tweaking. Set it to the lowest bandwidth usage possible, and see what happens.
    – Iszi
    Aug 22, 2012 at 19:23

2 Answers 2


Is there any vulnerability that a hacker might use to gain the command shell of the system?

That depends upon whether any of the software on your system is vulnerable. We probably cannot answer that for you, and in any case, any answer would be too specific to your particular system to be of relevance to others and too limited in time to be of broad interest.

If you are unable to scan your machine with nmap, I suggest you check whether you have a firewall set up that might be blocking nmap.

For information about how to secure your server, I suggest you search on server hardening on this site. I think you'll find a good bit of information about how to lock down a server to reduce the likelihood of vulnerability.

P.S. Generally speaking, I would turn off fingerd or configure my firewall to block all connections to it. Almost no one uses finger these days, so there is not much reason to be running an Internet-facing fingerd server -- it's just unnecessary risk.


Some scanners do not support the scanning over a VPN tunnel for numerous reasons. For some scanners that do, some VPN's have issues. A few things to consider: If you are configuring your scanner to detect UDP, then I would recommend throttling the scan speed down as it is slow in nature in and of itself. For TCP, try configuring your scanner to use SYN vs. a Full Connect for your 1st test. Many other items to consider as well but the above may help. Also if it is a Windows or OSX system, you can run a free scan on the www.iscanonline.com (No registration needed and will provide you all ports, configs, vulns and missing patches.)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .