# 21 - Pentesting FTP {% hint style="success" %} Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ Learn & practice GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte)
Support HackTricks * Check the [**subscription plans**](https://github.com/sponsors/carlospolop)! * **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.** * **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
{% endhint %} ## Basic Information **Protokali ya Uhamishaji wa Faili (FTP)** inatumika kama protokali ya kawaida kwa uhamishaji wa faili kati ya mtandao wa kompyuta kati ya seva na mteja.\ Ni **protokali ya maandiko safi** inayotumia **mhusika mpya `0x0d 0x0a`** hivyo wakati mwingine unahitaji **kuunganisha kwa kutumia `telnet`** au **`nc -C`**. **Bandari ya Kawaida:** 21 ``` PORT STATE SERVICE 21/tcp open ftp ``` ### Connections Active & Passive Katika **Active FTP**, **mteja** wa FTP kwanza **ananzisha** **muunganisho** wa udhibiti kutoka kwenye bandari yake N hadi bandari ya amri ya FTP Server - bandari 21. **Mteja** kisha **anasikiliza** bandari **N+1** na kutuma bandari N+1 kwa FTP Server. FTP **Server** kisha **ananzisha** **muunganisho** wa data, kutoka **bandari yake M hadi bandari N+1** ya Mteja wa FTP. Lakini, ikiwa Mteja wa FTP ana mfumo wa moto (firewall) ulioanzishwa ambao unadhibiti muunganisho wa data unaoingia kutoka nje, basi Active FTP inaweza kuwa tatizo. Na, suluhisho linalowezekana kwa hilo ni Passive FTP. Katika **Passive FTP**, mteja anaanzisha muunganisho wa udhibiti kutoka kwenye bandari yake N hadi bandari 21 ya FTP Server. Baada ya hii, mteja anatoa **amri ya passv**. Server kisha inatuma mteja nambari moja ya bandari yake M. Na **mteja** **ananzisha** **muunganisho** wa data kutoka **bandari yake P hadi bandari M** ya FTP Server. Source: [https://www.thesecuritybuddy.com/vulnerabilities/what-is-ftp-bounce-attack/](https://www.thesecuritybuddy.com/vulnerabilities/what-is-ftp-bounce-attack/) ### Connection debugging Amri za **FTP** **`debug`** na **`trace`** zinaweza kutumika kuona **jinsi mawasiliano yanavyofanyika**. ## Enumeration ### Banner Grabbing ```bash nc -vn 21 openssl s_client -connect crossfit.htb:21 -starttls ftp #Get certificate if any ``` ### Unganisha na FTP kwa kutumia starttls ``` lftp lftp :~> set ftp:ssl-force true lftp :~> set ssl:verify-certificate no lftp :~> connect 10.10.10.208 lftp 10.10.10.208:~> login Usage: login [] lftp 10.10.10.208:~> login username Password ``` ### Unauth enum Na **nmap** ```bash sudo nmap -sV -p21 -sC -A 10.10.10.10 ``` Unaweza kutumia amri `HELP` na `FEAT` kupata taarifa fulani za seva ya FTP: ``` HELP 214-The following commands are recognized (* =>'s unimplemented): 214-CWD XCWD CDUP XCUP SMNT* QUIT PORT PASV 214-EPRT EPSV ALLO* RNFR RNTO DELE MDTM RMD 214-XRMD MKD XMKD PWD XPWD SIZE SYST HELP 214-NOOP FEAT OPTS AUTH CCC* CONF* ENC* MIC* 214-PBSZ PROT TYPE STRU MODE RETR STOR STOU 214-APPE REST ABOR USER PASS ACCT* REIN* LIST 214-NLST STAT SITE MLSD MLST 214 Direct comments to root@drei.work FEAT 211-Features: PROT CCC PBSZ AUTH TLS MFF modify;UNIX.group;UNIX.mode; REST STREAM MLST modify*;perm*;size*;type*;unique*;UNIX.group*;UNIX.mode*;UNIX.owner*; UTF8 EPRT EPSV LANG en-US MDTM SSCN TVFS MFMT SIZE 211 End STAT #Info about the FTP server (version, configs, status...) ``` ### Anonymous login _anonymous : anonymous_\ _anonymous :_\ _ftp : ftp_ ```bash ftp >anonymous >anonymous >ls -a # List all files (even hidden) (yes, they could be hidden) >binary #Set transmission to binary instead of ascii >ascii #Set transmission to ascii instead of binary >bye #exit ``` ### [Brute force](../../generic-methodologies-and-resources/brute-force.md#ftp) Hapa unaweza kupata orodha nzuri ya akauti za ftp za default: [https://github.com/danielmiessler/SecLists/blob/master/Passwords/Default-Credentials/ftp-betterdefaultpasslist.txt](https://github.com/danielmiessler/SecLists/blob/master/Passwords/Default-Credentials/ftp-betterdefaultpasslist.txt) ### Automated Anon login na bounce FTP checks zinafanywa kwa default na nmap kwa kutumia chaguo **-sC** au: ```bash nmap --script ftp-* -p 21 ``` ## Browser connection Unaweza kuungana na seva ya FTP kwa kutumia kivinjari (kama Firefox) kwa kutumia URL kama: ```bash ftp://anonymous:anonymous@10.10.10.98 ``` Kumbuka kwamba ikiwa **programu ya wavuti** inatuma data inayodhibitiwa na mtumiaji **moja kwa moja kwa seva ya FTP** unaweza kutuma double URL encode `%0d%0a` (katika double URL encode hii ni `%250d%250a`) bytes na kufanya **seva ya FTP ifanye vitendo vya kiholela**. Mojawapo ya vitendo hivi vya kiholela ni kupakua maudhui kutoka kwa seva inayodhibitiwa na mtumiaji, kufanya skanning ya bandari au kujaribu kuzungumza na huduma zingine za msingi wa maandiko wazi (kama http). ## Pakua faili zote kutoka FTP ```bash wget -m ftp://anonymous:anonymous@10.10.10.98 #Donwload all wget -m --no-passive ftp://anonymous:anonymous@10.10.10.98 #Download all ``` Ikiwa jina la mtumiaji/siri yako ina wahusika maalum, [amri ifuatayo](https://stackoverflow.com/a/113900/13647948) inaweza kutumika: ```bash wget -r --user="USERNAME" --password="PASSWORD" ftp://server.com/ ``` ## Some FTP commands * **`USER username`** * **`PASS password`** * **`HELP`** Seva inaonyesha amri zipi zinakubaliwa * \*\*`PORT 127,0,0,1,0,80`\*\*Hii itaonyesha seva ya FTP kuanzisha muunganisho na IP 127.0.0.1 kwenye bandari 80 (_unahitaji kuweka herufi ya 5 kama "0" na ya 6 kama bandari kwa desimali au tumia ya 5 na 6 kuonyesha bandari kwa hex_). * \*\*`EPRT |2|127.0.0.1|80|`\*\*Hii itaonyesha seva ya FTP kuanzisha muunganisho wa TCP (_unaonyeshwa na "2"_) na IP 127.0.0.1 kwenye bandari 80. Amri hii **inasaidia IPv6**. * **`LIST`** Hii itatuma orodha ya faili katika folda ya sasa * **`LIST -R`** Orodha kwa njia ya kurudi (ikiwa inaruhusiwa na seva) * **`APPE /path/something.txt`** Hii itaonyesha FTP kuhifadhi data iliyopokelewa kutoka muunganisho wa **passive** au kutoka muunganisho wa **PORT/EPRT** kwenye faili. Ikiwa jina la faili lipo, litazidisha data. * **`STOR /path/something.txt`** Kama `APPE` lakini itafuta faili * **`STOU /path/something.txt`** Kama `APPE`, lakini ikiwa ipo haitafanya chochote. * **`RETR /path/to/file`** Muunganisho wa passive au wa bandari lazima uanzishwe. Kisha, seva ya FTP itatuma faili iliyoonyeshwa kupitia muunganisho huo * **`REST 6`** Hii itaonyesha seva kwamba wakati inatuma kitu kwa kutumia `RETR` inapaswa kuanza kwenye byte ya 6. * **`TYPE i`** Weka uhamishaji kuwa wa binary * **`PASV`** Hii itafungua muunganisho wa passive na itaonyesha mtumiaji wapi anaweza kuunganishwa * **`PUT /tmp/file.txt`** Pakia faili iliyoonyeshwa kwenye FTP ![](<../../.gitbook/assets/image (386).png>) ## FTPBounce attack Seva zingine za FTP zinaruhusu amri ya PORT. Amri hii inaweza kutumika kuonyesha seva kwamba unataka kuungana na seva nyingine ya FTP kwenye bandari fulani. Kisha, unaweza kutumia hii kuchunguza ni bandari zipi za mwenyeji ziko wazi kupitia seva ya FTP. [**Jifunze hapa jinsi ya kutumia seva ya FTP kuchunguza bandari.**](ftp-bounce-attack.md) Unaweza pia kutumia tabia hii kufanya seva ya FTP ishughulike na protokali nyingine. Unaweza **kupakia faili inayoshikilia ombi la HTTP** na kufanya seva ya FTP iliyo hatarini **itume kwa seva ya HTTP isiyo na mpangilio** (_labda kuongeza mtumiaji mpya wa admin?_) au hata kupakia ombi la FTP na kufanya seva ya FTP iliyo hatarini ipakue faili kutoka seva nyingine ya FTP.\ Nadharia ni rahisi: 1. **Pakia ombi (ndani ya faili ya maandiko) kwenye seva iliyo hatarini.** Kumbuka kwamba ikiwa unataka kuzungumza na seva nyingine ya HTTP au FTP unahitaji kubadilisha mistari kwa `0x0d 0x0a` 2. **Tumia `REST X` ili kuepuka kutuma herufi ambazo hutaki kutuma** (labda ili kupakia ombi ndani ya faili unahitaji kuweka kichwa cha picha mwanzoni) 3. **Tumia `PORT` kuungana na seva na huduma isiyo na mpangilio** 4. **Tumia `RETR` kutuma ombi lililohifadhiwa kwa seva.** Ni uwezekano mkubwa kwamba hii **itaonyesha kosa kama** _**Socket si writable**_ **kwa sababu muunganisho haukudumu vya kutosha kutuma data kwa `RETR`**. Mapendekezo ya kujaribu kuepuka hilo ni: * Ikiwa unatumia ombi la HTTP, **weka ombi sawa moja baada ya nyingine** hadi **\~0.5MB** angalau. Kama hii: {% file src="../../.gitbook/assets/posts.txt" %} posts.txt {% endfile %} * Jaribu **kujaza ombi na data "junk" inayohusiana na protokali** (ukizungumza na FTP labda amri za junk tu au kurudia maagizo ya `RETR` ili kupata faili) * Tu **jaza ombi na wahusika wengi wa null au wengine** (iliyogawanywa kwenye mistari au la) Hata hivyo, hapa una [mfano wa zamani kuhusu jinsi ya kutumia hii kufanya seva ya FTP ipakue faili kutoka seva nyingine ya FTP.](ftp-bounce-download-2oftp-file.md) ## Filezilla Server Vulnerability **FileZilla** kawaida **huunganisha** na **local** huduma ya **Administrative** kwa **FileZilla-Server** (bandari 14147). Ikiwa unaweza kuunda **tunnel** kutoka **kifaa chako** ili kufikia bandari hii, unaweza **kuungana** nayo kwa kutumia **nenosiri tupu** na **kuunda** mtumiaji **mpya** kwa huduma ya FTP. ## Config files ``` ftpusers ftp.conf proftpd.conf vsftpd.conf ``` ### Post-Exploitation Mipangilio ya kawaida ya vsFTPd inaweza kupatikana katika `/etc/vsftpd.conf`. Hapa, unaweza kupata mipangilio hatari: * `anonymous_enable=YES` * `anon_upload_enable=YES` * `anon_mkdir_write_enable=YES` * `anon_root=/home/username/ftp` - Katalogi ya watu wasiojulikana. * `chown_uploads=YES` - Badilisha umiliki wa faili zilizopakiwa kwa siri * `chown_username=username` - Mtumiaji ambaye anapewa umiliki wa faili zilizopakiwa kwa siri * `local_enable=YES` - Ruhusu watumiaji wa ndani kuingia * `no_anon_password=YES` - Usimuulize mtu asiyejulikana kuhusu nenosiri * `write_enable=YES` - Ruhusu amri: STOR, DELE, RNFR, RNTO, MKD, RMD, APPE, na SITE ### Shodan * `ftp` * `port:21` ## HackTricks Automatic Commands ``` Protocol_Name: FTP #Protocol Abbreviation if there is one. Port_Number: 21 #Comma separated if there is more than one. Protocol_Description: File Transfer Protocol #Protocol Abbreviation Spelled out Entry_1: Name: Notes Description: Notes for FTP Note: | Anonymous Login -bi <<< so that your put is done via binary wget --mirror 'ftp://ftp_user:UTDRSCH53c"$6hys@10.10.10.59' ^^to download all dirs and files wget --no-passive-ftp --mirror 'ftp://anonymous:anonymous@10.10.10.98' if PASV transfer is disabled https://book.hacktricks.xyz/pentesting/pentesting-ftp Entry_2: Name: Banner Grab Description: Grab FTP Banner via telnet Command: telnet -n {IP} 21 Entry_3: Name: Cert Grab Description: Grab FTP Certificate if existing Command: openssl s_client -connect {IP}:21 -starttls ftp Entry_4: Name: nmap ftp Description: Anon login and bounce FTP checks are performed Command: nmap --script ftp-* -p 21 {IP} Entry_5: Name: Browser Connection Description: Connect with Browser Note: ftp://anonymous:anonymous@{IP} Entry_6: Name: Hydra Brute Force Description: Need Username Command: hydra -t 1 -l {Username} -P {Big_Passwordlist} -vV {IP} ftp Entry_7: Name: consolesless mfs enumeration ftp Description: FTP enumeration without the need to run msfconsole Note: sourced from https://github.com/carlospolop/legion Command: msfconsole -q -x 'use auxiliary/scanner/ftp/anonymous; set RHOSTS {IP}; set RPORT 21; run; exit' && msfconsole -q -x 'use auxiliary/scanner/ftp/ftp_version; set RHOSTS {IP}; set RPORT 21; run; exit' && msfconsole -q -x 'use auxiliary/scanner/ftp/bison_ftp_traversal; set RHOSTS {IP}; set RPORT 21; run; exit' && msfconsole -q -x 'use auxiliary/scanner/ftp/colorado_ftp_traversal; set RHOSTS {IP}; set RPORT 21; run; exit' && msfconsole -q -x 'use auxiliary/scanner/ftp/titanftp_xcrc_traversal; set RHOSTS {IP}; set RPORT 21; run; exit' ``` {% hint style="success" %} Jifunze & fanya mazoezi ya AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ Jifunze & fanya mazoezi ya GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte)
Support HackTricks * Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)! * **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.** * **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
{% endhint %}