I needed to scan all my subnets for FTP’s that had annoymus FTP access enabled. Below is the script I used this requires nmap.
Nmap can be downloaded from this site: https://nmap.org/download.html
I useally add nmap as a system variable so I can call the exe without specifying path.
- From the desktop, right click on This PC and then click “properties”.
- In the System Properties window, click the “Advanced” tab.
- Click the “Environment Variables” button.
- Choose path from the system variables section, then hit edit.
- Add a semi-colon and then your Nmap directory (e.g. C:\Program Files (x86)\Nmap) to the end of the value.
You can add or remove subnets ranges by changing the subnets variable (which is marked as red in the script below). The range can be specified by setting the range variable this can be set from 1 to 254 to restrict the scan. Below are two examples:
Example for a Single range
.\FTPCheck.ps1 -exportpath c:\temp -Range 20 -subnets 192.168.0.
Example for Multiple ranges
.\FTPCheck.ps1 -exportpath c:\temp -Range 254 -subnets 192.168.0.,10.10.10.
<#.SYNOPSISScan for Open FTP sites on subnets.DESCRIPTIONThe script will run through each address on the specified subnetsand scan for any open FTP sites and output any sites to a csv files.PARAMETER exportpathThe export parameter is used to specify the export path location..PARAMETER RangeThis parameter is used to set the scan range this can be set from 1 to 254 depending ofhow much of the subnet range needs to be scanned..PARAMETER SubnetsThis parameter is used to specify the subnets to be scanned..EXAMPLE.\FTPCheck.ps1 -exportpath c:\temp -Range 20 -subnets 192.168.0..\FTPCheck.ps1 -exportpath c:\temp -Range 20 -subnets 192.168.0.,10.10.10.Scan-FTP -exportpath c:\temp\export -Range 254.NOTESThis script requires nmap to check for Open FTP sites#>param ([parameter(Mandatory = $true)][String]$exportpath,[parameter(Mandatory = $true)][String]$Range,[parameter(Mandatory = $true)][string[]]$subnets)if(Test-Path $exportpath){foreach($subnet in $subnets){$i = 1while($i -le $Range){$results = $subnet + $iforeach ($result in $results){$report = @()Write-Host “Checking IP” $result -ForegroundColor DarkGreen$Scan = nmap -p 21 -v –open –script ftp-anon $result -A$report1 = $Scan | Select-String -Pattern “Nmap scan report for “$report2 = $Scan | Select-String -Pattern “21/tcp open ftp”$report3 = $Scan | Select-String -Pattern “(FTP code 230)”$report4 = $Scan | Select-String -Pattern “MAC Address:”$Properties = @{“FTP Site” = $report1“FTP Site Responses” = $report2“FTP Site Access” = $report3“FTP MAC” = $report4}$report += New-Object psobject -Property $propertiesif ($report1 -ne $null){$report | select “FTP Site”,”FTP Site Responses”,”FTP Site Access”,”FTP MAC” | Export-Csv “$exportpath\FTPScan.csv” -Append -NoClobber -NoTypeInformationWrite-Warning “FTP site responded”}$i++}}}}else{Write-Warning “Path does not exist”exit}
TheSleepyAdmins 