hacktricks/network-services-pentesting/69-udp-tftp.md

{% hint style="success" %}
Leer & oefen AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
Leer & oefen GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)

<details>

<summary>Ondersteun HackTricks</summary>

* Kyk na die [**subskripsie planne**](https://github.com/sponsors/carlospolop)!
* **Sluit aan by die** 💬 [**Discord groep**](https://discord.gg/hRep4RUj7f) of die [**telegram groep**](https://t.me/peass) of **volg** ons op **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
* **Deel hacking truuks deur PRs in te dien na die** [**HackTricks**](https://github.com/carlospolop/hacktricks) en [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.

</details>
{% endhint %}

<figure><img src="https://pentest.eu/RENDER_WebSec_10fps_21sec_9MB_29042024.gif" alt=""><figcaption></figcaption></figure>

{% embed url="https://websec.nl/" %}


# Basiese Inligting

**Triviale Lêer Oordrag Protokol (TFTP)** is 'n eenvoudige protokol wat op **UDP poort 69** gebruik word wat lêeroordragte toelaat sonder om verifikasie te benodig. Dit word beklemtoon in **RFC 1350**, en sy eenvoud beteken dat dit belangrike sekuriteitskenmerke ontbreek, wat lei tot beperkte gebruik op die openbare Internet. Tog word **TFTP** wyd gebruik binne groot interne netwerke om **konfigurasielêers** en **ROM-beelde** na toestelle soos **VoIP-handsets** te versprei, danksy sy doeltreffendheid in hierdie spesifieke scenario's.

**TODO**: Verskaf inligting oor wat 'n Bittorrent-tracker is (Shodan identifiseer hierdie poort met daardie naam). As jy meer inligting hieroor het, laat weet ons asseblief byvoorbeeld in die [**HackTricks telegram groep**](https://t.me/peass) (of in 'n github probleem in [PEASS](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite)).

**Standaard Poort:** 69/UDP
```
PORT   STATE SERVICE REASON
69/udp open  tftp    script-set
```
# Enumerasie

TFTP bied nie 'n gidslys nie, so die skrif `tftp-enum` van `nmap` sal probeer om standaardpade te brute-force.
```bash
nmap -n -Pn -sU -p69 -sV --script tftp-enum <IP>
```
## Laai Af/Laai Op

Jy kan Metasploit of Python gebruik om te kyk of jy lêers kan aflaai/oplaai:
```bash
msf5> auxiliary/admin/tftp/tftp_transfer_util
```

```bash
import tftpy
client = tftpy.TftpClient(<ip>, <port>)
client.download("filename in server", "/tmp/filename", timeout=5)
client.upload("filename to upload", "/local/path/file", timeout=5)
```
## Shodan

* `port:69`


<figure><img src="https://pentest.eu/RENDER_WebSec_10fps_21sec_9MB_29042024.gif" alt=""><figcaption></figcaption></figure>

{% embed url="https://websec.nl/" %}


{% hint style="success" %}
Leer & oefen AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
Leer & oefen GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)

<details>

<summary>Ondersteun HackTricks</summary>

* Kyk na die [**subskripsie planne**](https://github.com/sponsors/carlospolop)!
* **Sluit aan by die** 💬 [**Discord groep**](https://discord.gg/hRep4RUj7f) of die [**telegram groep**](https://t.me/peass) of **volg** ons op **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
* **Deel hacking truuks deur PRs in te dien na die** [**HackTricks**](https://github.com/carlospolop/hacktricks) en [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.

</details>
{% endhint %}