HackTricks
Search…
Pentesting
Powered By GitBook
21 - Pentesting FTP

Basic Information

The File Transfer Protocol (FTP) is a standard network protocol used for the transfer of computer files between a client and server on a computer network. It is a plain-text protocol that uses as new line character 0x0d 0x0a so sometimes you need to connect using telnet or nc -C.
Default Port: 21
1
PORT STATE SERVICE
2
21/tcp open ftp
Copied!

Enumeration

1
nc -vn <IP> 21
2
openssl s_client -connect crossfit.htb:21 -starttls ftp #Get certificate if any
Copied!

Connect to FTP using starttls

1
lftp
2
lftp :~> set ftp:ssl-force true
3
lftp :~> set ssl:verify-certificate no
4
lftp :~> connect 10.10.10.208
5
lftp 10.10.10.208:~> login
6
Usage: login <user|URL> [<pass>]
7
lftp 10.10.10.208:~> login username Password
Copied!

Unauth enum

You can us the commands HELP and FEAT to obtain some information of the FTP server:
1
HELP
2
214-The following commands are recognized (* =>'s unimplemented):
3
214-CWD XCWD CDUP XCUP SMNT* QUIT PORT PASV
4
214-EPRT EPSV ALLO* RNFR RNTO DELE MDTM RMD
5
214-XRMD MKD XMKD PWD XPWD SIZE SYST HELP
6
214-NOOP FEAT OPTS AUTH CCC* CONF* ENC* MIC*
7
214-PBSZ PROT TYPE STRU MODE RETR STOR STOU
8
214-APPE REST ABOR USER PASS ACCT* REIN* LIST
9
214-NLST STAT SITE MLSD MLST
10
214 Direct comments to [email protected]
11
FEAT
12
211-Features:
13
PROT
14
CCC
15
PBSZ
16
AUTH TLS
17
MFF modify;UNIX.group;UNIX.mode;
18
REST STREAM
19
MLST modify*;perm*;size*;type*;unique*;UNIX.group*;UNIX.mode*;UNIX.owner*;
20
UTF8
21
EPRT
22
EPSV
23
LANG en-US
24
MDTM
25
SSCN
26
TVFS
27
MFMT
28
SIZE
29
211 End
Copied!

Connections

In Active FTP the FTP client first initiates the control connection from its port N to FTP Servers command port – port 21. The client then listens to port N+1 and sends the port N+1 to FTP Server. FTP Server then initiates the data connection, from its port M to the port N+1 of the FTP Client.
But, if the FTP Client has a firewall setup that controls the incoming data connections from outside, then active FTP may be a problem. And, a feasible solution for that is Passive FTP.
In Passive FTP, the client initiates the control connection from its port N to the port 21 of FTP Server. After this, the client issues a passv comand. The server then sends the client one of its port number M. And the client initiates the data connection from its port P to port M of the FTP Server.

Anonymous login

anonymous : anonymous anonymous : ftp : ftp
1
ftp <IP>
2
>anonymous
3
>anonymous
4
>ls -a # List all files (even hidden) (yes, they could be hidden)
5
>binary #Set transmission to binary instead of ascii
6
>ascii #Set transmission to ascii instead of binary
7
>bye #exit
Copied!

Automated

Anon login and bounce FTP checks are perform by default by nmap with -sC option or:
1
nmap --script ftp-* -p 21 <ip>
Copied!

Shodan

    ftp
    port:21

Browser connection

You can connect to a FTP server using a browser (like Firefox) using a URL like:
1
ftp://anonymous:[email protected]
Copied!
Note that if a web application is sending data controlled by a user directly to a FTP server you can send double URL encode %0d%0a (in double URL encode this is %250d%250a) bytes and make the FTP server perform arbitrary actions. One of this possible arbitrary actions is to download content from a users controlled server, perform port scanning or try to talk to other plain-text based services (like http).

Download all files from FTP

1
wget -m ftp://anonymous:[email protected] #Donwload all
2
wget -m --no-passive ftp://anonymous:[email protected] #Download all
Copied!

Some FTP commands

    USER username
    PASS password
    HELP The server indicates which commands are supported
    PORT 127,0,0,1,0,80This will indicate the FTP server to establish a connection with the IP 127.0.0.1 in port 80 (you need to put the 5th char as "0" and the 6th as the port in decimal or use the 5th and 6th to express the port in hex).
    EPRT |2|127.0.0.1|80|This will indicate the FTP server to establish a TCP connection (indicated by "2") with the IP 127.0.0.1 in port 80. This command supports IPv6.
    LIST This will send the list of files in current folder
    APPE /path/something.txt This will indicate the FTP to store the data received from a passive connection or from a PORT/EPRT connection to a file. If the filename exists, it will append the data.
    STOR /path/something.txt Like APPE but it will overwrite the files
    STOU /path/something.txt Like APPE, but if exists it won't do anything.
    RETR /path/to/file A passive or a port connection must be establish. Then, the FTP server will send the indicated file through that connection
    REST 6 This will indicate the server that next time it send something using RETR it should start in the 6th byte.
    TYPE i Set transfer to binary
    PASV This will open a passive connection and will indicate the user were he can connects

FTPBounce attack

Some FTP servers allow the command PORT. This command can be used to indicate to the server that you wants to connect to other FTP server at some port. Then, you can use this to scan which ports of a host are open through a FTP server.
You could also abuse this behaviour to make a FTP server interact with other protocols. You could upload a file containing an HTTP request and make the vulnerable FTP server send it to an arbitrary HTTP server (maybe to add a new admin user?) or even upload a FTP request and make the vulnerable FTP server download a file for a different FTP server. The theory is easy:
    1.
    Upload the request (inside a text file) to the vulnerable server. Remember that if you want to talk with another HTTP or FTP server you need to change lines with 0x0d 0x0a
    2.
    Use REST X to avoid sending the characters you don't want to send (maybe to upload the request inside the file you needed to put some image header at the begging)
    3.
    Use PORTto connect to the arbitrary server and service
    4.
    Use RETRto send the saved request to the server.
Its highly probably that this will throw an error like Socket not writable because the connection doesn't last enough to send the data with RETR. Suggestions to try to avoid that are:
    If you are sending an HTTP request, put the same request one after another until ~0.5MB at least. Like this:
posts.txt
495KB
Text
posts.txt
    Try to fill the request with "junk" data relative to the protocol (talking to FTP maybe just junk commands or repeating the RETRinstruction to get the file)
    Just fill the request with a lot of null characters or others (divided on lines or not)

Filezilla Server Vulnerability

FileZilla usually binds to local an Administrative service for the FileZilla-Server (port 14147). If you can create a tunnel from your machine to access this port, you can connect to it using a blank password and create a new user for the FTP service.

Config files

1
ftpusers
2
ftp.conf
3
proftpd.conf
Copied!

HackTricks Automatic Commands

1
Protocol_Name: FTP #Protocol Abbreviation if there is one.
2
Port_Number: 21 #Comma separated if there is more than one.
3
Protocol_Description: File Transfer Protocol #Protocol Abbreviation Spelled out
4
5
Entry_1:
6
Name: Notes
7
Description: Notes for FTP
8
Note: |
9
Anonymous Login
10
-bi <<< so that your put is done via binary
11
12
wget --mirror 'ftp://ftp_user:UTDRSCH53c"[email protected]'
13
^^to download all dirs and files
14
15
wget --no-passive-ftp --mirror 'ftp://anonymous:[email protected]'
16
if PASV transfer is disabled
17
18
https://book.hacktricks.xyz/pentesting/pentesting-ftp
19
20
Entry_2:
21
Name: Banner Grab
22
Description: Grab FTP Banner via telnet
23
Command: telnet -n {IP} 21
24
25
Entry_3:
26
Name: Cert Grab
27
Description: Grab FTP Certificate if existing
28
Command: openssl s_client -connect {IP}:21 -starttls ftp
29
30
Entry_4:
31
Name: nmap ftp
32
Description: Anon login and bounce FTP checks are performed
33
Command: nmap --script ftp-* -p 21 {IP}
34
35
Entry_5:
36
Name: Browser Connection
37
Description: Connect with Browser
38
Note: ftp://anonymous:[email protected]{IP}
39
40
Entry_6:
41
Name: Hydra Brute Force
42
Description: Need Username
43
Command: hydra -t 1 -l {Username} -P {Big_Passwordlist} -vV {IP} ftp
Copied!
Last modified 28d ago