Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-11-21 20:23:18 +00:00
Code Issues Projects Releases Packages Wiki Activity
hacktricks/network-services-pentesting/pentesting-ftp
History
Translator workflow b442ae90c4 Translated to Klingon
2024-02-10 17:52:19 +00:00
..
ftp-bounce-attack.md Translated to Klingon 2024-02-10 17:52:19 +00:00
ftp-bounce-download-2oftp-file.md Translated to Klingon 2024-02-10 17:52:19 +00:00
README.md Translated to Klingon 2024-02-10 17:52:19 +00:00

README.md

21 - Pentesting FTP

htARTE (HackTricks AWS Red Team Expert) DaH jImej (HackTricks AWS Red Team Expert)!
  • Do you work in a cybersecurity company? Do you want to see your company advertised in HackTricks? or do you want to have access to the latest version of the PEASS or download HackTricks in PDF? Check the SUBSCRIPTION PLANS!
  • Discover The PEASS Family, our collection of exclusive NFTs
  • Get the official PEASS & HackTricks swag
  • Join the 💬 Discord group or the telegram group or follow me on Twitter
  • Share your hacking tricks by submitting PRs to the hacktricks repo and hacktricks-cloud repo.

Find vulnerabilities that matter most so you can fix them faster. Intruder tracks your attack surface, runs proactive threat scans, finds issues across your whole tech stack, from APIs to web apps and cloud systems. Try it for free today.

{% embed url="https://www.intruder.io/?utm_campaign=hacktricks&utm_source=referral" %}

Basic Information

The File Transfer Protocol (FTP) serves as a standard protocol for file transfer across a computer network between a server and a client.
It is a plain-text protocol that uses as new line character 0x0d 0x0a so sometimes you need to connect using telnet or nc -C.

Default Port: 21

PORT   STATE SERVICE
21/tcp open  ftp

Qapla' & Qa'vIn

In Qapla' FTP, the FTP client first initiates the control connection from its port N to FTP Servers command port – port 21. The client then listens to port N+1 and sends the port N+1 to FTP Server. FTP Server then initiates the data connection, from its port M to the port N+1 of the FTP Client.

But, if the FTP Client has a firewall setup that controls the incoming data connections from outside, then Qapla' FTP may be a problem. And, a feasible solution for that is Qa'vIn FTP.

In Qa'vIn FTP, the client initiates the control connection from its port N to the port 21 of FTP Server. After this, the client issues a passv comand. The server then sends the client one of its port number M. And the client initiates the data connection from its port P to port M of the FTP Server.

Source: https://www.thesecuritybuddy.com/vulnerabilities/what-is-ftp-bounce-attack/

Connection debugging

The FTP commands debug and trace can be used to see how is the communication occurring.

Enumeration

Banner Grabbing

nc -vn <IP> 21
openssl s_client -connect crossfit.htb:21 -starttls ftp #Get certificate if any

Connect to FTP using starttls

English Translation:

FTP jatlh starttls lo'laH

Markdown + HTML Translation:

FTP jatlh starttls lo'laH

English to Klingon Translation:

FTP jatlh starttls lo'laH

Markdown + HTML Translation:

FTP jatlh starttls lo'laH

lftp
lftp :~> set ftp:ssl-force true
lftp :~> set ssl:verify-certificate no
lftp :~> connect 10.10.10.208
lftp 10.10.10.208:~> login
Usage: login <user|URL> [<pass>]
lftp 10.10.10.208:~> login username Password

Unauth enum

nmap-laH.

sudo nmap -sV -p21 -sC -A 10.10.10.10

Dujmey HELP je FEAT lo'laHbe'chugh FTP server vItlhutlh.

You can use the commands `HELP` and `FEAT` to obtain some information of the FTP server:

HELP
214-The following commands are recognized (* =>'s unimplemented):
214-CWD     XCWD    CDUP    XCUP    SMNT*   QUIT    PORT    PASV
214-EPRT    EPSV    ALLO*   RNFR    RNTO    DELE    MDTM    RMD
214-XRMD    MKD     XMKD    PWD     XPWD    SIZE    SYST    HELP
214-NOOP    FEAT    OPTS    AUTH    CCC*    CONF*   ENC*    MIC*
214-PBSZ    PROT    TYPE    STRU    MODE    RETR    STOR    STOU
214-APPE    REST    ABOR    USER    PASS    ACCT*   REIN*   LIST
214-NLST    STAT    SITE    MLSD    MLST
214 Direct comments to root@drei.work

FEAT
211-Features:
PROT
CCC
PBSZ
AUTH TLS
MFF modify;UNIX.group;UNIX.mode;
REST STREAM
MLST modify*;perm*;size*;type*;unique*;UNIX.group*;UNIX.mode*;UNIX.owner*;
UTF8
EPRT
EPSV
LANG en-US
MDTM
SSCN
TVFS
MFMT
SIZE
211 End

STAT
#Info about the FTP server (version, configs, status...)

qoH login

anonymous : anonymous
anonymous :
ftp : ftp

ftp <IP>
>anonymous
>anonymous
>ls -a # List all files (even hidden) (yes, they could be hidden)
>binary #Set transmission to binary instead of ascii
>ascii #Set transmission to ascii instead of binary
>bye #exit

Brute force

Qa'Hom: vaj ftp-betterdefaultpasslist.txt https://github.com/danielmiessler/SecLists/blob/master/Passwords/Default-Credentials/ftp-betterdefaultpasslist.txt ghItlh.

Automated

Anon login and bounce FTP checks are perform by default by nmap with -sC option or:

nmap --script ftp-* -p 21 <ip>

Browser connection

You can connect to a FTP server using a browser (like Firefox) using a URL like:

Browser connection

You can connect to a FTP server using a browser (like Firefox) using a URL like:

ftp://anonymous:anonymous@10.10.10.98

ghItlh 'ej web application user FTP server data DIvI' web application user data FTP server DIvI' double URL encode %0d%0a bytes FTP server arbitrary actions perform legh. arbitrary actions possible legh download content user controlled server, port scanning perform plain-text based services (like http).

FTP files Download all

wget -m ftp://anonymous:anonymous@10.10.10.98 #Donwload all
wget -m --no-passive ftp://anonymous:anonymous@10.10.10.98 #Download all

ghItlhvam 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /or/ 'ej /

wget -r --user="USERNAME" --password="PASSWORD" ftp://server.com/

Some FTP commands

  • USER username
  • PASS password
  • HELP The server indicates which commands are supported
  • **PORT 127,0,0,1,0,80**This will indicate the FTP server to establish a connection with the IP 127.0.0.1 in port 80 (you need to put the 5th char as "0" and the 6th as the port in decimal or use the 5th and 6th to express the port in hex).
  • **EPRT |2|127.0.0.1|80|**This will indicate the FTP server to establish a TCP connection (indicated by "2") with the IP 127.0.0.1 in port 80. This command supports IPv6.
  • LIST This will send the list of files in current folder
  • LIST -R List recursively (if allowed by the server)
  • APPE /path/something.txt This will indicate the FTP to store the data received from a passive connection or from a PORT/EPRT connection to a file. If the filename exists, it will append the data.
  • STOR /path/something.txt Like APPE but it will overwrite the files
  • STOU /path/something.txt Like APPE, but if exists it won't do anything.
  • RETR /path/to/file A passive or a port connection must be establish. Then, the FTP server will send the indicated file through that connection
  • REST 6 This will indicate the server that next time it send something using RETR it should start in the 6th byte.
  • TYPE i Set transfer to binary
  • PASV This will open a passive connection and will indicate the user were he can connects
  • PUT /tmp/file.txt Upload indicated file to the FTP

FTPBounce attack

Some FTP servers allow the command PORT. This command can be used to indicate to the server that you wants to connect to other FTP server at some port. Then, you can use this to scan which ports of a host are open through a FTP server.

Learn here how to abuse a FTP server to scan ports.

You could also abuse this behaviour to make a FTP server interact with other protocols. You could upload a file containing an HTTP request and make the vulnerable FTP server send it to an arbitrary HTTP server (maybe to add a new admin user?) or even upload a FTP request and make the vulnerable FTP server download a file for a different FTP server.
The theory is easy:

  1. Upload the request (inside a text file) to the vulnerable server. Remember that if you want to talk with another HTTP or FTP server you need to change lines with 0x0d 0x0a
  2. Use REST X to avoid sending the characters you don't want to send (maybe to upload the request inside the file you needed to put some image header at the beginning)
  3. Use PORTto connect to the arbitrary server and service
  4. Use RETRto send the saved request to the server.

Its highly probably that this will throw an error like Socket not writable because the connection doesn't last enough to send the data with RETR. Suggestions to try to avoid that are:

  • If you are sending an HTTP request, put the same request one after another until ~0.5MB at least. Like this:

{% file src="../../.gitbook/assets/posts (1).txt" %} posts.txt {% endfile %}

  • Try to fill the request with "junk" data relative to the protocol (talking to FTP maybe just junk commands or repeating the RETRinstruction to get the file)
  • Just fill the request with a lot of null characters or others (divided on lines or not)

Anyway, here you have an old example about how to abuse this to make a FTP server download a file from a different FTP server.

Filezilla Server Vulnerability

FileZilla usually binds to local an Administrative service for the FileZilla-Server (port 14147). If you can create a tunnel from your machine to access this port, you can connect to it using a blank password and create a new user for the FTP service.

Config files

ftpusers
ftp.conf
proftpd.conf
vsftpd.conf

Post-Exploitation

The default configuration of vsFTPd can be found in /etc/vsftpd.conf. In here, you could find some dangerous settings:

  • anonymous_enable=YES
  • anon_upload_enable=YES
  • anon_mkdir_write_enable=YES
  • anon_root=/home/username/ftp - Directory for anonymous.
  • chown_uploads=YES - Change ownership of anonymously uploaded files
  • chown_username=username - User who is given ownership of anonymously uploaded files
  • local_enable=YES - Enable local users to login
  • no_anon_password=YES - Do not ask anonymous for password
  • write_enable=YES - Allow commands: STOR, DELE, RNFR, RNTO, MKD, RMD, APPE, and SITE

Shodan

  • ftp
  • port:21

Find vulnerabilities that matter most so you can fix them faster. Intruder tracks your attack surface, runs proactive threat scans, finds issues across your whole tech stack, from APIs to web apps and cloud systems. Try it for free today.

{% embed url="https://www.intruder.io/?utm_campaign=hacktricks&utm_source=referral" %}

HackTricks Automatic Commands

Protocol_Name: FTP    #Protocol Abbreviation if there is one.
Port_Number:  21     #Comma separated if there is more than one.
Protocol_Description: File Transfer Protocol          #Protocol Abbreviation Spelled out

Entry_1:
Name: Notes
Description: Notes for FTP
Note: |
Anonymous Login
-bi     <<< so that your put is done via binary

wget --mirror 'ftp://ftp_user:UTDRSCH53c"$6hys@10.10.10.59'
^^to download all dirs and files

wget --no-passive-ftp --mirror 'ftp://anonymous:anonymous@10.10.10.98'
if PASV transfer is disabled

https://book.hacktricks.xyz/pentesting/pentesting-ftp

Entry_2:
Name: Banner Grab
Description: Grab FTP Banner via telnet
Command: telnet -n {IP} 21

Entry_3:
Name: Cert Grab
Description: Grab FTP Certificate if existing
Command: openssl s_client -connect {IP}:21 -starttls ftp

Entry_4:
Name: nmap ftp
Description: Anon login and bounce FTP checks are performed
Command: nmap --script ftp-* -p 21 {IP}

Entry_5:
Name: Browser Connection
Description: Connect with Browser
Note: ftp://anonymous:anonymous@{IP}

Entry_6:
Name: Hydra Brute Force
Description: Need Username
Command: hydra -t 1 -l {Username} -P {Big_Passwordlist} -vV {IP} ftp

Entry_7:
Name: consolesless mfs enumeration ftp
Description: FTP enumeration without the need to run msfconsole
Note: sourced from https://github.com/carlospolop/legion
Command: msfconsole -q -x 'use auxiliary/scanner/ftp/anonymous; set RHOSTS {IP}; set RPORT 21; run; exit' && msfconsole -q -x 'use auxiliary/scanner/ftp/ftp_version; set RHOSTS {IP}; set RPORT 21; run; exit' && msfconsole -q -x 'use auxiliary/scanner/ftp/bison_ftp_traversal; set RHOSTS {IP}; set RPORT 21; run; exit' && msfconsole -q -x 'use auxiliary/scanner/ftp/colorado_ftp_traversal; set RHOSTS {IP}; set RPORT 21; run; exit' &&  msfconsole -q -x 'use auxiliary/scanner/ftp/titanftp_xcrc_traversal; set RHOSTS {IP}; set RPORT 21; run; exit'
Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!