diff --git a/lib/metasploit/framework/ftp/client.rb b/lib/metasploit/framework/ftp/client.rb index 4523fd056be55..ce873401144a1 100644 --- a/lib/metasploit/framework/ftp/client.rb +++ b/lib/metasploit/framework/ftp/client.rb @@ -68,7 +68,7 @@ def data_disconnect def connect_login(user,pass,global = true) ftpsock = connect(global) - if !(user and pass) + if !(user and pass) && !(user == '' && pass == '') return false end diff --git a/modules/auxiliary/scanner/ftp/ftp_login.rb b/modules/auxiliary/scanner/ftp/ftp_login.rb index 093eb163a587f..b8d4c01c53d70 100644 --- a/modules/auxiliary/scanner/ftp/ftp_login.rb +++ b/modules/auxiliary/scanner/ftp/ftp_login.rb @@ -105,14 +105,18 @@ def run_host(ip) end end - # Always check for anonymous access by pretending to be a browser. def anonymous_creds anon_creds = [ ] + # Support both ANONYMOUS_LOGIN option and RECORD_GUEST option if datastore['RECORD_GUEST'] ['IEUser@', 'User@', 'mozilla@example.com', 'chrome@example.com' ].each do |password| anon_creds << Metasploit::Framework::Credential.new(public: 'anonymous', private: password) end end + # Also add blank username/password when ANONYMOUS_LOGIN is enabled + if datastore['ANONYMOUS_LOGIN'] + anon_creds << Metasploit::Framework::Credential.new(public: '', private: '', realm: nil, private_type: :password) + end anon_creds end