FTP

TL;DR

FTP (File Transfer Protocol). Control channel on TCP 21, data channel on TCP 20. Cleartext by default. FTPS adds TLS. SFTP is a separate protocol (an SSH subsystem on port 22).

Two data modes decide which side opens the data channel:

• Active: the server opens the data channel back to the client from port 20. A client-side firewall blocks it.
• Passive: the server gives the client a port and the client opens the data channel. This works through a client firewall. Most clients default to passive.

First three checks: anonymous login, the software and version, and whether you can write.

Enumeration

Service scan with the default FTP scripts ftp-anon and ftp-syst:

sudo nmap -p21 -sC -sV -oA scans/ftp $TARGET

ftp-anon tests anonymous login and prints the root listing. ftp-syst runs the STAT command, which returns the server version and config.

Grab the banner by hand:

nc -nv $TARGET 21

-n skips DNS resolution. -v prints the connection status.

Read the TLS certificate on an FTPS server:

openssl s_client -connect $TARGET:21 -starttls ftp

-starttls ftp upgrades the plain connection before the handshake. The certificate often leaks the hostname and an admin email.

Log in anonymously (user anonymous or ftp, blank password):

ftp $TARGET

List before you download. On a large tree, a recursive listing shows everything without pulling a single file:

ftp> ls -R

Then get <file> only what matters. For server detail, status, debug, and trace inside the client show the version, the transfer mode, and the raw commands.

Mirror the whole tree when it is small or you want it offline:

wget -m --no-passive ftp://anonymous:anonymous@$TARGET

-m mirrors (recursive download that keeps timestamps and structure). --no-passive forces active mode when the server’s passive mode fails. wget writes everything under a folder named after the target IP. This is slow on big trees, so list first.

The FTP NSE scripts beyond the two defaults:

ls /usr/share/nmap/scripts | grep ftp

Useful ones: ftp-brute, ftp-bounce, ftp-vsftpd-backdoor, ftp-proftpd-backdoor, ftp-vuln-cve2010-4221.

Common misconfigurations

• Allows anonymous read.
• Allows anonymous write.
• Weak or default credentials.
• Credentials reused on other services.
• Cleartext login on an untrusted network.

Version exploits

Match the exact version from -sV before trusting any of these.

• vsftpd 2.3.4 backdoor: a username ending in :) opens a root shell on port 6200. NSE ftp-vsftpd-backdoor, or Metasploit exploit/unix/ftp/vsftpd_234_backdoor.
• ProFTPd 1.3.5 mod_copy (CVE-2015-3306): unauthenticated SITE CPFR/CPTO copies any file. Write to a web root for RCE.
• ProFTPd 1.3.3c backdoor: the release shipped with a command backdoor.

Attack playbook

1. Loot readable files. Anonymous or weak creds let you read. Pull configs, source, and notes for credentials and host detail. The usual FTP win. Listing and download are in Enumeration.
2. Reuse credentials. Creds found over FTP, and the FTP login itself, often work on SSH, SMB, or the web app. Try them on every service.
3. Write for code execution. If you can upload and the FTP root serves another process, drop a payload: a webshell in a web root, a file an LFI includes, or a scheduled task.
4. Version exploit. Only a few daemons are vulnerable. Match the -sV version against the Version exploits above.
5. Brute or spray. Last resort. Slow, noisy, and fail2ban blocks it. Spray one password across a user list instead of hammering one account.

Upload a payload to a writable root that serves the web directory:

ftp $TARGET
ftp> put shell.aspx

Brute-force credentials:

hydra -L users.txt -P passwords.txt ftp://$TARGET

-L reads a username list. -P a password list. Lowercase -l/-p take a single value.

Scan a third host through the FTP server (FTP bounce):

sudo nmap -Pn -b anonymous:anonymous@$TARGET 127.0.0.1

-b user:pass@server relays the scan through the FTP server, so Nmap scans 127.0.0.1 from the server’s view. This reaches ports a firewall blocks from your host.

TFTP

Trivial FTP. UDP 69, no authentication, no directory listing. You must know the filename. Found on internal networks and embedded devices.

sudo nmap -sU -p69 --script tftp-enum $TARGET

tftp $TARGET
tftp> get <known-file>
tftp> put <file>

Practice boxes

On easy boxes FTP is often the whole foothold. On harder ones it is a stepping stone: a file leak or an upload that enables the real attack elsewhere.