ptsrvtester 1.4.8

PTSRVTESTER - Server Penetration Testing Tool

Installation

pip install ptsrvtester

Adding to PATH

If you're unable to invoke the script from your terminal, it's likely because it's not included in your PATH. You can resolve this issue by executing the following commands, depending on the shell you're using:

For Bash Users

echo "export PATH=\"`python3 -m site --user-base`/bin:\$PATH\"" >> ~/.bashrc
source ~/.bashrc

For ZSH Users

echo "export PATH=\"`python3 -m site --user-base`/bin:\$PATH\"" >> ~/.zshrc
source ~/.zshrc

Usage examples

ptsrvtester smtp -ts BANNER,EHLO -tg mail.example.com:25
ptsrvtester smtp -ts ALL -tg mail.example.com:25
ptsrvtester smtp -ts SPOOF -r victim@example.com -tg smtp.example.com:25
ptsrvtester smtp -ts BCC -r to@example.com --cc cc@example.com --bcc bcc@example.com -tg smtp.example.com:25
ptsrvtester pop3 -ts BANNER,CAPA -tg 127.0.0.1
ptsrvtester pop3 -ts ALL --tls -tg 127.0.0.1:995
ptsrvtester pop3 -ts BRUTE -u admin -P passwords.txt -tg 127.0.0.1:110
ptsrvtester imap -ts BANNER,CAPA -tg 127.0.0.1
ptsrvtester ftp -ts BANNER,CMD,ANON -tg 127.0.0.1
ptsrvtester ftp -ts ALL -tg 127.0.0.1
ptsrvtester ftp -ts EICAR -A -tg 127.0.0.1
ptsrvtester ftp -ts BRUTE -u admin -P passwords.txt -tg 127.0.0.1:21
ptsrvtester msrpc -ts ALL -tg 192.168.1.10
ptsrvtester msrpc -ts SAMRPOLICY -tg 192.168.1.10 -u auditor -pw secret
ptsrvtester msrpc -ts SAMRUSERS -tg 192.168.1.10 -u auditor -pw secret
ptsrvtester msrpc -ts SAMRGROUPS -tg 192.168.1.10 -u auditor -pw secret
ptsrvtester msrpc -ts SAMRUSERINFO -tg 192.168.1.10 -u auditor -pw secret --samr-user alice
ptsrvtester msrpc -ts BRUTEPIPE -tg 192.168.1.10 --pipe svcctl -u auditor -pw secret
ptsrvtester upnp -ts ALL -tg 192.168.1.1
ptsrvtester upnp -ts DISCOVER -tg 192.168.1.1 --multicast -i 192.168.1.10
ptsrvtester upnp -ts SCPD,PORTMAPS -tg 192.168.1.1
ptsrvtester upnp -ts NOTIFY -tg 192.168.1.1 -i 192.168.1.10
ptsrvtester upnp -ts EVENTS -tg 192.168.1.1 -i 192.168.1.10
ptsrvtester upnp -ts DISCOVER -tg '[fe80::1%Ethernet]:1900'
ptsrvtester <module> -h     for help for module use

Available Modules:

   <module>                     Select module to use
                         snmp   SNMP testing module
                         dns    DNS testing module
                         ldap   LDAP testing module
                         msrpc  MSRPC testing module
                         ftp    FTP testing module
                         ssh    SSH testing module
                         smtp   SMTP testing module
                         pop3   POP3 testing module
                         imap   IMAP testing module
                         dhcp   DHCP testing module
                         xrdp   XRDP testing module
                         rdp    RDP testing module
                         upnp   UPnP/SSDP testing module

   -v        --version          Show script version and exit
   -h        --help             Show this help message and exit
   -j        --json             Output in JSON format
             --debug            Enable debug messages

Module Descriptions:

SNMP Module

• Version detection
• SNMPv2 community string brute-force
• SNMPv3 user enumeration and credential brute-force
• Write permission testing
• MIB walking

DNS Module

• DNS server information retrieval
• Reverse DNS lookup
• Zone transfer attempts
• DNS record lookup
• WHOIS queries
• Subdomain brute-forcing
• DNSSEC verification
• Zone walking

LDAP Module

• Server banner retrieval
• LDAP search queries
• User enumeration
• Credential brute-force
• Write permission testing

MSRPC Module

• Endpoint Mapper, MGMT interface and named-pipe enumeration
• Anonymous SMB and IPC$ access testing
• Password and account-lockout policy retrieval
• SAM user, group and membership enumeration
• User account details and logon statistics
• Named-pipe, SMB, RPC/TCP and RPC-over-HTTP credential testing

UPnP/SSDP Module

• Targeted IPv4/IPv6 SSDP discovery and multicast search
• UPnP device and service description retrieval
• Read-only IGD status and external IP inspection
• Service action and state variable enumeration (SCPD)
• Read-only existing port mapping enumeration (PORTMAPS)
• Passive SSDP notifications and temporary GENA subscriptions

FTP Module

• Banner and Service Identification
• Anonymous authentication testing
• Known-account login or credential brute-force
• Read/write access testing
• Path enumeration
• Data mode test
• Active mode policy audit
• Command surface audit
• Invalid-command resilience
• Username enumeration
• Bounce attack testing

SSH Module

• Banner, Service Identification and host key retrieval
• Authentication method detection
• Bad public key detection
• SSH audit
• Credential and private key brute-force

SMTP Module

• Banner and Service Identification
• Server identification
• Server information gathering
• Encryption testing
• User enumeration
• AUTH user enumeration
• HELO/EHLO hostname validation
• AUTH downgrade test
• Invalid/non-standard SMTP commands
• HELO-only test
• HELO/EHLO bypass test
• Bounce replay / backscatter test
• Mail bomb / rate limiting test
• Antivirus/antispam protection test
• SSRF test
• Queue flood, SIZE extension test
• Zip Bomb, Billion Laughs, XXE in attachments test
• Spoof headers test
• BCC disclosure test
• Alias & addressing bypass test
• NTLM information disclosure
• Open relay testing
• Catch-all mailbox detection
• RCPT TO limit test
• Credential brute-force
• Blacklist testing

POP3 Module

• Banner and Service Identification
• CAPA
• Help/Implementation info disclosure
• Encryption testing
• Anonymous authentication testing
• NTLM authentication inspection
• Credential brute-force

IMAP Module

• Banner and Service Identification
• CAPA
• Encryption testing
• Anonymous authentication testing
• NTLM authentication inspection
• Credential brute-force

DHCP Module

• DHCP server information retrieval
• DHCP starvation attack testing
• DHCP DoS/flood attack testing
• Network interface based testing

RDP Module

• TLS and certificate inspection
• RDP version detection
• NLA and CredSSP detection
• Security protocol detection
• Legacy RDP encryption testing
• NTLM information disclosure
• Server capability enumeration
• NLA/CredSSP password authentication through NTLM and Kerberos
• Username enumeration testing
• Password-guessing protection and account lockout testing
• Connection rate limiting testing

XRDP Module

• XRDP server brute-force testing
• Credential testing via GUI automation
• Multi-threaded password testing
• CVE-2024-39917 exploitation

## Dependencies

aardwolf==0.2.13 asyauth==0.0.23 asysocks==0.2.18 cryptography>=42.0.8 dnspython>=2.7.0 impacket>=0.12.0 ldap3>=2.9.1 ptlibs>=1.0.20,<2 pysnmp>=7.1.20 python-whois>=0.9.5 paramiko>=4.0.0 beautifulsoup4>=4.14.0 httpx>=0.28.0 h2>=4.3.0 lxml>=6.0.0 ssh_audit>=3.3.0 ntlm-auth>=1.5.0 scapy>=2.6.1 dhcppython>=0.1.4 pillow>=12.0.0 python-xlib>=0.33 pynput>=1.8.0 XWindows>=0.0.7

### Additional System Requirements

For DHCP module:
- Root/sudo privileges (for network packet manipulation)

For XRDP module:
- Linux with Xorg (not Wayland)
- `xfreerdp3` command available
- `wmctrl` command available
- Disable screen saver/lock during use


## License

Copyright (c) 2024 Penterep Security s.r.o.

ptsrvtester is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

ptsrvtester is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with ptsrvtester. If not, see https://www.gnu.org/licenses/.

## Warning

You are only allowed to run the tool against the servers and systems which
you have been given permission to pentest. We do not accept any
responsibility for any damage/harm that this application causes to your
computer, or your network. Penterep is not responsible for any illegal
or malicious use of this code. Be Ethical!