79 - Finger
Finger is a program you can use to find information about computer users.
Usage
Finger Enumeration
finger @TARGET-IP
Finger a Specific Username
finger [email protected]
Login: admin Name: Jason L. Nawrocki
Directory: /home/admin Shell: /bin/bash
Office: 5877, 989-905-2731 Home Phone: 978-272-5420
Never logged in.
No mail.
No Plan. Solaris
Solaris bug that shows all logged in users:
finger 0@host
SunOS: RPC services allow user enum:
$ rusers # users logged onto LAN
finger 'a b c d e f g h'@sunhost Metasploit
Modules:
Find users:
finger-user-enum
Download script and run it with a wordlist:
http://pentestmonkey.net/tools/finger-user-enum/finger-user-enum-1.0.tar.gz
Overview
finger-user-enum is a tool for enumerating OS-level user accounts via the finger service. As of release v1.0 it is known to work against the default Solaris daemon. It may not yet work against all daemons since there is no defined format for the data returned by the finger service.
Installation
finger-user-enum is just a stand alone PERL script, so installation is as simple as copying it to your path (e.g. /usr/local/bin). It has only been tested under Linux so far.
It depends on the following PERL modules which you may need to install first:
Socket
IO::Handle
IO::Select
IO::Socket::INET
Getopt::Std
If you have PERL installed, you should be able to install the modules from CPAN:
Usage
finger-user-enum simply needs to be passed a list of users and at least one target running an finger service.
finger-user-enum v1.0 ( http://pentestmonkey.net/tools/finger-user-enum )
Usage: finger-user-enum.pl [options] (-u username|-U users.txt) (-t host|-T ips.txt)
options are: -m n Maximum number of resolver processes (default: 5) -u user Check if user exists on remote system -U file File of usernames to check via finger service -t host Server host running finger service -T file File of hostnames running the finger service -r host Relay. Intermediate server which allows relaying of finger requests. -p port TCP port on which finger service runs (default: 79) -d Debugging output -s n Wait a maximum of n seconds for reply (default: 5) -v Verbose -h This help message
Some Examples
For the examples below we need a list of potential usernames. The following output demostrates the format for this list:
$ head users.txt root bin daemon adm lp sync shutdown halt mail news
Normal Usage
The output below shows how the finger daemon responds differently to valid and invalid usernames:
finger-user-enum attempts to automatically parse the results returned by the finger daemon and report only users which exist.
Note: If you ever need to modify the pattern-matching within finger-user-enum (e.g. to support a different finger daemon), you’ll need to base the patterns on positive and negative result like those found above.
Here’s an example of the most common usage of the tool:
Last updated
Was this helpful?