id: mikrotik-ftp-detect

info:
  name: MikroTik FTP Service - Detect
  author: pussycat0x
  severity: info
  description: |
    MikroTik FTP server was detected.
  metadata:
    verified: true
    shodan-query:
      - "MikroTik FTP"
  tags: network,ftp,mikrotik,detect,detection,tcp,discovery

tcp:
  - inputs:
      - data: 00000000
        type: hex

    host:
      - "{{Hostname}}"
    port: 21
    read-size: 1024

    matchers:
      - type: word
        words:
          - "FTP server (MikroTik"

    extractors:
      - type: regex
        group: 1
        name: version
        regex:
          - "MikroTik ([0-9.]+)"
# digest: 4a0a0047304502207a324e90c8e2311e4f2947773a66a87751e98567bb57077f602afec18cf2934e02210094afaf9ea4ee947bdb403e6cc6d6d29ed3855765a85ea7732f468a88efd59a0e:922c64590222798bb761d5b6d8e72950