Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-11-29 16:10:54 +00:00
Code Issues Projects Releases Packages Wiki Activity
hacktricks/network-services-pentesting/pentesting-ftp/ftp-bounce-download-2oftp-file.md
Carlos Polop e65a322118 a
2024-02-09 08:15:24 +01:00

3.5 KiB
Raw Blame History

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks:

Resume

If you have access to a bounce FTP server, you can make it request files of other FTP server where you know some credentials and download that file to your own server.

Requirements

  • FTP valid credentials in the FTP Middle server
  • FTP valid credentials in Victim FTP server
  • Both server accepts the PORT command bounce FTP attack
  • You can write inside some directory of the FRP Middle server
  • The middle server will have more access inside the Victim FTP Server than you for some reason this is what you are going to exploit

Steps

  1. Connect to your own FTP server and make the connection passive pasv command to make it listen in a directory where the victim service will send the file
  2. Make the file that is going to send the FTP Middle server t the Victim server the exploit. This file will be a plaint text of the needed commands to authenticate against the Victim server, change the directory and download a file to your own server.
  3. Connect to the FTP Middle Server and upload de previous file
  4. Make the FTP Middle server establish a connection with the victim server and send the exploit file
  5. Capture the file in your own FTP server
  6. Delete the exploit file from the FTP Middle server

For a more detailed information check the post: http://www.ouah.org/ftpbounce.html

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks: