ptsrvtester 1.3.1

PTSRVTESTER - Server Penetration Testing Tool

Installation

pip install ptsrvtester

Adding to PATH

If you're unable to invoke the script from your terminal, it's likely because it's not included in your PATH. You can resolve this issue by executing the following commands, depending on the shell you're using:

For Bash Users

echo "export PATH=\"`python3 -m site --user-base`/bin:\$PATH\"" >> ~/.bashrc
source ~/.bashrc

For ZSH Users

echo "export PATH=\"`python3 -m site --user-base`/bin:\$PATH\"" >> ~/.zshrc
source ~/.zshrc

Usage examples

ptsrvtester snmp detection --ip 192.168.1.1
ptsrvtester dns whois -d example.com
ptsrvtester ldap banner -ip 192.168.1.1
ptsrvtester dhcp info --interface eth0
ptsrvtester xrdp bruteforce --target 192.168.1.1 --username admin --wordlist passwords.txt
ptsrvtester smtp --spoof-headers -r victim@example.com -u user -p pass smtp.example.com:587
ptsrvtester smtp --bcc-test -r to@example.com --cc cc@example.com --bcc bcc@example.com smtp.example.com:25
ptsrvtester smtp -al -r admin@example.com smtp.example.com:25
ptsrvtester smtp -id mail.example.com:25
ptsrvtester smtp -id --id-aggressive smtp.example.com:25
ptsrvtester <module> -h     for help for module use

Available Modules:

   <module>                     Select module to use
                         snmp   SNMP testing module
                         dns    DNS testing module
                         ldap   LDAP testing module
                         msrpc  MSRPC testing module
                         ftp    FTP testing module
                         ssh    SSH testing module
                         smtp   SMTP testing module
                         pop3   POP3 testing module
                         imap   IMAP testing module
                         dhcp   DHCP testing module
                         xrdp   XRDP testing module

   -v        --version          Show script version and exit
   -h        --help             Show this help message and exit
   -j        --json             Output in JSON format
             --debug            Enable debug messages

Module Descriptions:

SNMP Module

• Version detection (SNMPv1, SNMPv2c, SNMPv3)
• SNMPv2 community string brute-force
• SNMPv3 user enumeration and credential brute-force
• Write permission testing
• MIB walking (SNMPv2/SNMPv3)

DNS Module

• DNS server information retrieval
• Reverse DNS lookup
• Zone transfer attempts
• DNS record lookup
• WHOIS queries
• Subdomain brute-forcing
• DNSSEC verification
• Zone walking (NSEC/NSEC3)

LDAP Module

• Server banner retrieval
• LDAP search queries
• User enumeration
• Credential brute-force
• Write permission testing

MSRPC Module

• Endpoint mapper enumeration
• MGMT interface enumeration
• Named pipe brute-force
• SMB/TCP/HTTP credential brute-force
• Anonymous SMB access testing
• Named pipe enumeration

FTP Module

• Banner and Service Identification
• Anonymous authentication testing
• Known-account login or credential brute-force
• Read/write access testing
• Path enumeration
• Data mode test
• Active mode policy audit
• Command surface audit
• Invalid-command resilience
• Username enumeration
• Bounce attack testing

SSH Module

• Banner, Service Identification and host key retrieval
• Authentication method detection
• Bad public key detection
• SSH audit (CVE identification)
• Credential and private key brute-force

SMTP Module

• Banner and Service Identification
• Server identification
• Server information gathering
• Encryption testing (plaintext, STARTTLS, TLS); port 465 implicit TLS
• User enumeration (VRFY, EXPN, RCPT)
• AUTH user enumeration (each advertised LOGIN / PLAIN / NTLM; 2 synthetic baselines + -u/-U or default_logins)
• HELO/EHLO hostname validation
• AUTH downgrade test
• Invalid/non-standard SMTP commands
• HELO-only test
• HELO/EHLO bypass test
• Bounce replay / backscatter test
• Mail bomb / rate limiting test
• Antivirus/antispam protection test
• SSRF test
• Queue flood, SIZE extension test
• Zip Bomb, Billion Laughs, XXE in attachments test
• Spoof headers test
• BCC disclosure test
• Alias & addressing bypass test
• NTLM information disclosure
• Open relay testing
• Catch-all mailbox detection
• RCPT TO limit test
• Credential brute-force
• Blacklist testing

POP3 Module

• Banner, Service Identification and capabilities retrieval
• Help/Implementation info disclosure test (HELP command, IMPLEMENTATION from CAPA)
• Encryption testing (plaintext, STLS, TLS); port 995 implicit TLS
• Anonymous authentication testing
• NTLM authentication inspection
• Credential brute-force

IMAP Module

• Banner, Service Identification and capabilities retrieval
• Anonymous authentication testing
• NTLM authentication inspection
• Credential brute-force

DHCP Module

• DHCP server information retrieval
• DHCP starvation attack testing
• DHCP DoS/flood attack testing
• Network interface based testing

XRDP Module

• XRDP server brute-force testing
• Credential testing via GUI automation
• Multi-threaded password testing
• CVE-2024-39917 exploitation (no rate limiting)
• Requires Linux with Xorg, xfreerdp3, and wmctrl

## Dependencies

cryptography>=42.0.8 dnspython>=2.7.0 impacket>=0.12.0 ldap3>=2.9.1 ptlibs>=1.0.20,<2 pysnmp>=7.1.20 python-whois>=0.9.5 paramiko>=4.0.0 beautifulsoup4>=4.14.0 httpx>=0.28.0 h2>=4.3.0 lxml>=6.0.0 ssh_audit>=3.3.0 ntlm-auth>=1.5.0 scapy>=2.6.1 dhcppython>=0.1.4 pillow>=12.0.0 python-xlib>=0.33 pynput>=1.8.0 XWindows>=0.0.7

### Additional System Requirements

For DHCP module:
- Root/sudo privileges (for network packet manipulation)

For XRDP module:
- Linux with Xorg (not Wayland)
- `xfreerdp3` command available
- `wmctrl` command available
- Disable screen saver/lock during use


## License

Copyright (c) 2024 Penterep Security s.r.o.

ptsrvtester is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

ptsrvtester is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with ptsrvtester. If not, see https://www.gnu.org/licenses/.

## Warning

You are only allowed to run the tool against the servers and systems which
you have been given permission to pentest. We do not accept any
responsibility for any damage/harm that this application causes to your
computer, or your network. Penterep is not responsible for any illegal
or malicious use of this code. Be Ethical!