Printable View
While I was playing with one of our town's ISP's mail server, I typed "ftp://mail.the_isp.com" in my browser and get some files, I could see them, I just wonder what this mean: ftp://mail.somewhere.com
is it a security hole? or something else...
may be it is a newbie question or something lame
;)
Most likely ur just login in as a annon. login , or if its ur ISP it might just allow people with that ISP hostmask to get in. It could be many other things also but i highly doubt its any sort of security sploit ;)
cya
No It is not my ISP, but i log in anonymously!Quote:
Originally posted by acidphreak
Most likely ur just login in as a annon. login , or if its ur ISP it might just allow people with that ISP hostmask to get in. It could be many other things also but i highly doubt its any sort of security sploit ;)
cya
I'd have thought this meant the isp's mail server had ftp access as well - which it shouldn't. A company i worked for collected pop mail from a server and i noticed that a pop account also gave you telnet access and read/write ftp access, on a red hat 5.2 box - i changed mail hosts.
there is such a thing as ftp mail, but it sound more like an ftp server is runnung on the mail sever. what rights do you have on it?
What OS and browser are you using? In win98 1st edition there is a setting in IE under tools/internet options/advanced called "let browser log into ftp sites anoymously" if you are using that version of IE check to see if this option is checked.
I don't underestan what u mean by "what rights I have done on it" excuse me for my poor english.Quote:
Originally posted by Tedob1
there is such a thing as ftp mail, but it sound more like an ftp server is runnung on the mail sever. what rights do you have on it?
but if u mean what Ihave done on that server, Ok I didn't do anything, I just take a look at the files , some exe and jpg files.
Are you able to download files from or upload files to the server?
If you are able to upload to the server then you have Read/Write rights to the server. If you can only view files, then you only have Read rights to the server.
I always use opera browser, but I tested that both with opera and IE and I don't think that it depends on my browser , it must be something wrong in the romote server!Quote:
Originally posted by antihaxor
What OS and browser are you using? In win98 1st edition there is a setting in IE under tools/internet options/advanced called "let browser log into ftp sites anoymously" if you are using that version of IE check to see if this option is checked.
No I can only read the filesQuote:
Originally posted by Maverick811
Are you able to download files from or upload files to the server?
If you are able to upload to the server then you have Read/Write rights to the server. If you can only view files, then you only have Read rights to the server.
hmmmm I see. It does look like an exploit could you do a screen capture and post the bitmap image? That way we could all see what you're seeing.
Ok this is what I can see.
excuse me if I hide the domain name.
Should I aware the sys admin?:D :confused:
Quote:
I just wonder what this mean: ftp:// mail.somewhere.com
is it a security hole? or something else...
may be it is a newbie question or something lame
hmm i wonder why no one answered dis question.. hehe but what da heck.. for da record ill answer it..
FTP is short for File Transfer Protocol... its basically self explainatory..
ftp gives u access to a certain directory depending on what rights u are logged on and from there... you can transfer files, add, delete, copy, modify.. as if it was in your own box.. but like i said.. it all depends on what rights u are logged on.
most annonymous login in ftp have full access just to ONE folder.. and only "Read Only" access on the other folders... or even "No Access" at all.. which in some cases u wont see the folder or even if u see it.. u cant open it.
LOL! It looks like an exploit? That's hilarious... He has readonly access to apparently only one directory, and it's an exploit?Quote:
Originally posted by antihaxor
hmmmm I see. It does look like an exploit could you do a screen capture and post the bitmap image? That way we could all see what you're seeing.
Guys guys guys, just because a server has the address mail.mydomain.com doesn't mean it absolutely MUST be a mail server...
I've seen instances where things like www.mydomain.com, mail.mydomain.com, ftp.mydomain.com, irc.mydomain.com, etc., all point to the same ip address.
Take www.dal.net for example. You could use the following services with the target host of www.dal.net:
FTP
SSH
TELNET
SMTP
WWW
POP3
IMAP
IRC
And quite possibly a few others... That means you could issue the command ftp://www.dal.net/ and it would work. There's no exploit there. I would suggest reading up on how DNS resolving works before panicking.
If I were you, unless you actually found a whole (ie: write access to any dir), I wouldn't bother the sysadmin about it.
ADDENDUM: It might be worth letting the sysadmin know, given the names of those files (assuming that wasn't just a crafted image).
Ok CHSh,
did I say that I am going to bother the sysadmin?
I didn't see anything here which is sign of bothering!
by the way , we all are here just for discussing the points, not for claming that we are good guys.
or nobody is here to telling others that : hey my sun , u shouldn't bother your friends, be a good one ok? "
Yes but no one knew what he had access to UNTIL he posted the bitmap. You are right though.Quote:
Originally posted by chsh
LOL! It looks like an exploit? That's hilarious... He has readonly access to apparently only one directory, and it's an exploit?
Ok guys, I guess that I should describe more.
we all know that a domain eg. somewhere.com has an IP like 127.0.0.1
and also we all know that www.somewher.com, ftp.somewhere.co, .....
have all the same ip, but different ports.
I just wonder that how it could be possible for me to log on mail server by port 21 or
how it is possible to run ftp command on mail server (ftp://mail.somewhere.com)
this is the point!
it is not important if I have write acsses or read acsses to the files
Quote:
Ok guys, I guess that I should describe more.
we all know that a domain eg. somewhere.com has an IP like 127.0.0.1
and also we all know that www.somewher.com, ftp.somewhere.co, .....
have all the same ip, but different ports.
I just wonder that how it could be possible for me to log on mail server by port 21 or
how it is possible to run ftp command on mail server (ftp://mail.somewhere.com)
this is the point!
it is not important if I have write acsses or read acsses to the files
Ok, I thought I explained this earlier. There is nothing that states that you MUST run a mail server on mail.somewhere.com.
A mail server is simply a piece of software that listens on a specific port (usually 25 and 110/143). An ftp server is nothing more than software that listens on a specific port as well. Nothing prevents you from running any number of different pieces of server software on your server.
What I'm trying to say is that simply because mail.somewhere.com contains the prefix 'mail', that doesn't mean that it MUST be a mail server.
You're also wrong when you say:
The address ftp.somewhere.com does NOT DENOTE A PORT. It only refers to an IP. Perhaps this is where your thought process has you confused.Quote:
and also we all know that www.somewher.com, ftp.somewhere.co, .....
have all the same ip, but different ports.
I'll give you a brief run-down on what happens:
When you open your web browser and go to http://mail.somewhere.com,
Your web browser creates an outbound TCP connection to mail.somewhere.com:80.
When you open your web browser and go to
ftp://mail.somewhere.com, your browser opens a connection to mail.somewhere.com:21.
When you open your email client, and try to send an email using mail.somewhere.com as your outgoing email server, your email client opens a connection to mail.somewhere.com:25.
When you open your email client and try to read email using mail.somewhere.com as your POP3 or IMAP server, then your email software opens a connection to mail.somewhere.com:110 (POP3), or mail.somewhere.com:143 (IMAP).
So you see, the subdomain naming conventions don't really matter at all, they're just there to give you an indication of the primary role of the server.
Sorry for coming off a bit short. Rough day spent with an NT box trying to be the little computer that could and handle a load it probably wasn't designed for. ;)Quote:
Originally posted by antihaxor
Yes but no one knew what he had access to UNTIL he posted the bitmap. You are right though.
what u mean by:Quote:
Originally posted by chsh
Ok, I thought I explained this earlier. There is nothing that states that you MUST run a mail server on mail.somewhere.com.
A mail server is simply a piece of software that listens on a specific port (usually 25 and 110/143). An ftp server is nothing more than software that listens on a specific port as well. Nothing prevents you from running any number of different pieces of server software on your server.
What I'm trying to say is that simply because mail.somewhere.com contains the prefix 'mail', that doesn't mean that it MUST be a mail server.
You're also wrong when you say:
The address ftp.somewhere.com does NOT DENOTE A PORT. It only refers to an IP. Perhaps this is where your thought process has you confused.
I'll give you a brief run-down on what happens:
When you open your web browser and go to http://mail.somewhere.com,
Your web browser creates an outbound TCP connection to mail.somewhere.com:80.
When you open your web browser and go to
ftp://mail.somewhere.com, your browser opens a connection to mail.somewhere.com:21.
When you open your email client, and try to send an email using mail.somewhere.com as your outgoing email server, your email client opens a connection to mail.somewhere.com:25.
When you open your email client and try to read email using mail.somewhere.com as your POP3 or IMAP server, then your email software opens a connection to mail.somewhere.com:110 (POP3), or mail.somewhere.com:143 (IMAP).
So you see, the subdomain naming conventions don't really matter at all, they're just there to give you an indication of the primary role of the server.
""""""""""""""""""""""""
You're also wrong when you say:
The address ftp.somewhere.com does NOT DENOTE A PORT. It only refers to an IP. Perhaps this is where your thought process has you confused.
"""""""""""""""""""""""""
I am wrong?!!!!!!!!!!
this is what u have said in thae previous page! u can go and see or I have pasted your previous reply here. see
I've seen instances where things like www.mydomain.com, mail.mydomain.com, ftp.mydomain.com, irc.mydomain.com, etc., all point to the same ip address
also test with a DNS lookup
Unleashed,
What is chsh is saying is that it definately is possible for all of those names to point to the same IP address - that's because they could all reside on the same machine. I could be running an email server (software), an ftp server (software), and a web server (software) all from the same box. My box is assigned one IP address, that's why each will have the same IP address, regardless of which service (ftp, email, web) you are using. The only difference is that each of these will connect at a different Port number. By only giving the address ftp.victim.com, then you are not denoting a port number - to denote an exact Port number you would say something like ftp.victim.com:80 <- a colon followed by a number denotes specific port numbers.
Hope this helps...
Ok , Maverick811Quote:
Originally posted by Maverick811
Unleashed,
What is chsh is saying is that it definately is possible for all of those names to point to the same IP address - that's because they could all reside on the same machine. I could be running an email server (software), an ftp server (software), and a web server (software) all from the same box. My box is assigned one IP address, that's why each will have the same IP address, regardless of which service (ftp, email, web) you are using. The only difference is that each of these will connect at a different Port number. By only giving the address ftp.victim.com, then you are not denoting a port number - to denote an exact Port number you would say something like ftp.victim.com:80 <- a colon followed by a number denotes specific port numbers.
Hope this helps...
I am agree , and I have said this too that the ip is the same but the ports are different, take a look at my above post, u will see.
I just didn't know that it may be possible to log on a mail server with port 21 (ftp port)
do u get what I mean?
and also chsh indicate that it might not be a mail servere.
ok may be it is not a mail server.
thank u all
it means that on the machine or a machine with an alias name of "mail" that ftp services are running.
WARNING
If you want to alert them I would do so discreetly because they may come back at you taking a defensive stance and get all angry and bent out of shape and accuse you of all sorts of stuff you had nothing to do with....and if someone else finds an exploit on their system and dicks around with it, you'll get blamed.
So what if they are running ftp on their mail server anyway?! They probably have a size limit on attachments for email and would prefer people to use ftp for large files or perhaps that's where they direct people to download their dialer package.
Just because it's there....in and of itself....doesn't mean anything until it's proved to be exploitable....which may or may not be the case.
Quote:
Originally posted by Unleashed
Ok , Maverick811
I am agree , and I have said this too that the ip is the same but the ports are different, take a look at my above post, u will see.
I just didn't know that it may be possible to log on a mail server with port 21 (ftp port)
do u get what I mean?
and also chsh indicate that it might not be a mail servere.
ok may be it is not a mail server.
thank u all
Alright, if you do a telnet mail.somewhere.com 21, do you get a mail server's response, or an FTP server's response?
Ok I test it by telnet but I didn't get any responseQuote:
Originally posted by chsh
Alright, if you do a telnet mail.somewhere.com 21, do you get a mail server's response, or an FTP server's response?