FTP
Source CTF and HTB Academy
Usually on port 21
The File Transfer Protocol (FTP) is one of the oldest protocols on the Internet. The FTP runs within the application layer of the TCP/IP protocol stack. Thus, it is on the same layer as HTTP or POP. These protocols also work with the support of browsers or email clients to perform their services. There are also special FTP programs for the File Transfer Protocol.
Footprinting
find / -type f -name ftp* 2>/dev/null | grep scripts
find all the nmap scripts for ftp and choose the ones you wish to usesudo nmap -sV -p21 -sC -A 10.129.14.136
nc -nv 10.129.14.136 21
telnet 10.129.14.136 21
openssl s_client -connect 10.129.14.136:21 -starttls ftp
What to try
Check if anonymous FTP is enabled, if so check if you can downloads files. If so you can RCE. Check out Hackthebox Devel's writeup to have an example of this.
If you do not have write access you could still find interesting and useful files like passwords or else.
vsftpd
One of the most used FTP servers on Linux-based distributions is vsFTPd.
sudo apt install vsftpd
install itcat /etc/vsftpd.conf | grep -v "#"
interesting config to checkcat /etc/ftpusers
file used to deny certain users access to the FTP service
Config for anonymous login
Anonymous login
ftp <TARGET-IP> <port>
you will need to specify the port in case it is not port 21 if it is 21 you do not need to specify
Download ftp files
wget -m --no-passive ftp://username:password@IP:2121 --starttls ftp
wget ftp://username:password@ftp_server_address/path/to/file
lftp
sudo apt install lftp
lftp -p 2121 -u anonymous, 10.10.10.10
Interesting commands
status
will show configurationsdebug
trace
ls -R
list file recursivelyget filename
download a fileput filename
upload a filewget -m --no-passive ftp://anonymous:anonymous@10.129.14.136
Downaload all available filestree .
inspect all files downloaded
Upload a file
touch file
create a fileput file
put it in the ftp server
PASV
enter passive modeDo not forget
ls -al
(to see hidden files)
TFTP
Trivial File Transfer Protocol (TFTP) is simpler than FTP and performs file transfers between client and server processes. However, it does not provide user authentication and other valuable features supported by FTP. In addition, while FTP uses TCP, TFTP uses UDP, making it an unreliable protocol and causing it to use UDP-assisted application layer recovery.
Bruteforcing
FTP Bounce Attack
An FTP bounce attack is a network attack that uses FTP servers to deliver outbound traffic to another device on the network. The attacker uses a PORT command to trick the FTP connection into running commands and getting information from a device other than the intended server.
Consider we are targetting an FTP Server FTP_DMZ exposed to the internet. Another device within the same network, Internal_DMZ, is not exposed to the internet. We can use the connection to the FTP_DMZ server to scan Internal_DMZ using the FTP Bounce attack and obtain information about the server's open ports. Then, we can use that information as part of our attack against the infrastructure.
Source GeeksforGeeks
The Nmap -b flag can be used to perform an FTP bounce attack:
CVEs on FTP
CVE-2022-22836 This vulnerability is for an FTP service that does not correctly process the HTTP PUT request and leads to an authenticated directory/path traversal, and arbitrary file write vulnerability. This vulnerability allows us to write files outside the directory to which the service has access. Exploitation
Resources
Last updated