pentesting-ftp

https://book.hacktricks.xyz/network-services-pentesting/pentesting-ftp

21 - Pentesting FTP - HackTricks

 

21 - Pentesting FTP

 

 

​☁️ HackTricks Cloud ☁️​🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥​

 

 

Basic Information

The File Transfer Protocol (FTP) is a standard network protocol used for the transfer of computer files between a client and server on a computer network. It is a plain-text protocol that uses as new line character 0x0d 0x0a so sometimes you need to connect using telnet or nc -C.

Default Port: 21

 

PORT STATE SERVICE

 

21/tcp open ftp

Connections Active & Passive

In Active FTP the FTP client first initiates the control connection from its port N to FTP Servers command port – port 21. The client then listens to port N+1 and sends the port N+1 to FTP Server. FTP Server then initiates the data connection, from its port M to the port N+1 of the FTP Client.

But, if the FTP Client has a firewall setup that controls the incoming data connections from outside, then active FTP may be a problem. And, a feasible solution for that is Passive FTP.

In Passive FTP, the client initiates the control connection from its port N to the port 21 of FTP Server. After this, the client issues a passv comand. The server then sends the client one of its port number M. And the client initiates the data connection from its port P to port M of the FTP Server.

Source: https://www.thesecuritybuddy.com/vulnerabilities/what-is-ftp-bounce-attack/​

Connection debugging

The FTP commands debug and trace can be used to see how is the communication occurring.

Enumeration

Banner Grabbing

 

nc -vn <IP> 21

 

openssl s_client -connect crossfit.htb:21 -starttls ftp #Get certificate if any

Connect to FTP using starttls

 

lftp

 

lftp :~> set ftp:ssl-force true

 

lftp :~> set ssl:verify-certificate no

 

lftp :~> connect 10.10.10.208

 

lftp 10.10.10.208:~> login

 

Usage: login <user|URL> [<pass>]

 

lftp 10.10.10.208:~> login username Password

Unauth enum

With nmap

 

sudo nmap -sV -p21 -sC -A 10.10.10.10

You can us the commands HELP and FEAT to obtain some information of the FTP server:

 

HELP

 

214-The following commands are recognized (* =>'s unimplemented):

 

214-CWD XCWD CDUP XCUP SMNT* QUIT PORT PASV

 

214-EPRT EPSV ALLO* RNFR RNTO DELE MDTM RMD

 

214-XRMD MKD XMKD PWD XPWD SIZE SYST HELP

 

214-NOOP FEAT OPTS AUTH CCC* CONF* ENC* MIC*

 

214-PBSZ PROT TYPE STRU MODE RETR STOR STOU

 

214-APPE REST ABOR USER PASS ACCT* REIN* LIST

 

214-NLST STAT SITE MLSD MLST

 

214 Direct comments to root@drei.work

 

​

 

FEAT

 

211-Features:

 

PROT

 

CCC

 

PBSZ

 

AUTH TLS

 

MFF modify;UNIX.group;UNIX.mode;

 

REST STREAM

 

MLST modify*;perm*;size*;type*;unique*;UNIX.group*;UNIX.mode*;UNIX.owner*;

 

UTF8

 

EPRT

 

EPSV

 

LANG en-US

 

MDTM

 

SSCN

 

TVFS

 

MFMT

 

SIZE

 

211 End

 

​

 

STAT

 

#Info about the FTP server (version, configs, status...)

Anonymous login

anonymous : anonymous anonymous : ftp : ftp

 

ftp <IP>

 

>anonymous

 

>anonymous

 

>ls -a # List all files (even hidden) (yes, they could be hidden)

 

>binary #Set transmission to binary instead of ascii

 

>ascii #Set transmission to ascii instead of binary

 

>bye #exit

​Brute force​

Here you can find a nice list with default ftp credentials: https://github.com/danielmiessler/SecLists/blob/master/Passwords/Default-Credentials/ftp-betterdefaultpasslist.txt​

Automated

Anon login and bounce FTP checks are perform by default by nmap with -sC option or:

 

nmap --script ftp-* -p 21 <ip>

Browser connection

You can connect to a FTP server using a browser (like Firefox) using a URL like:

 

ftp://anonymous:anonymous@10.10.10.98

Note that if a web application is sending data controlled by a user directly to a FTP server you can send double URL encode %0d%0a (in double URL encode this is %250d%250a) bytes and make the FTP server perform arbitrary actions. One of this possible arbitrary actions is to download content from a users controlled server, perform port scanning or try to talk to other plain-text based services (like http).

Download all files from FTP

 

wget -m ftp://anonymous:anonymous@10.10.10.98 #Donwload all

 

wget -m --no-passive ftp://anonymous:anonymous@10.10.10.98 #Download all

Some FTP commands

 

FTPBounce attack

Some FTP servers allow the command PORT. This command can be used to indicate to the server that you wants to connect to other FTP server at some port. Then, you can use this to scan which ports of a host are open through a FTP server.

​Learn here how to abuse a FTP server to scan ports.​

You could also abuse this behaviour to make a FTP server interact with other protocols. You could upload a file containing an HTTP request and make the vulnerable FTP server send it to an arbitrary HTTP server (maybe to add a new admin user?) or even upload a FTP request and make the vulnerable FTP server download a file for a different FTP server. The theory is easy:

 

Its highly probably that this will throw an error like Socket not writable because the connection doesn't last enough to send the data with RETR. Suggestions to try to avoid that are:

 

 

posts.txt

495KB

Text

posts.txt

 

Anyway, here you have an old example about how to abuse this to make a FTP server download a file from a different FTP server.​

Filezilla Server Vulnerability

FileZilla usually binds to local an Administrative service for the FileZilla-Server (port 14147). If you can create a tunnel from your machine to access this port, you can connect to it using a blank password and create a new user for the FTP service.

Config files

 

ftpusers

 

ftp.conf

 

proftpd.conf

 

vsftpd.conf

Post-Exploitation

The default configuration of vsFTPd can be found in /etc/vsftpd.conf. In here, you could find some dangerous settings:

 

Shodan