21 - FTP

Telnet

telnet 10.0.0.3 21

Netcat

nc -n 10.0.0.3 21

NSE Script

nmap -sV -script banner -p21 -Pn 10.0.0.3

FTP

ftp 10.0.0.3

FTP Exploitation

Note: During the port scanning phase Nmap’s script scan (-sC), can be enabled to check for FTP Bounce and Anonymous Login.

Try anonymous login using anonymous:anonymous credentials.

ftp 10.0.0.3
…
Name (10.0.0.3:kali): anonymous
331 Please specify the password.
Password: [anonymous]
230 Login successful.

List all files in order.

ftp> ls -lat
200 PORT command successful. Consider using PASV.
150 Here comes the directory listing.
…
226 Directory send OK.

FTP Browser Client

Note: Due to its insecure nature, FTP support is being dropped by Firefox and Google Chrome.

Use a dedicated FTP client for browsing and file access; the browser URL example is not a reliable method in current mainstream browsers. Supply the intended identity explicitly rather than assuming anonymous access, and keep passwords out of browser URLs/history.

Brute Forcing

Use the FTP login-guessing procedure for a known username, password list or nonstandard port. Check the account policy and scope first; anonymous access and successful authentication are separate checks. Re-test an accepted pair with the FTP client and inspect its actual directory/file access.

Note: SecLists includes a handy list of FTP default credentials.

Configuration files

It is important to examine these config files:

ftpusers
ftp.conf
proftpd.conf

Other

Binary and ASCII

Binary and ASCII files have to be uploading using the binary or ascii mode respectively, otherwise, the file will become corrupted. Use the corresponding command to switch between modes.

Download all files from FTP

wget -m ftp://anonymous:anonymous@10.10.10.98 #Donwload all
wget -m --no-passive ftp://anonymous:anonymous@10.10.10.98 #Download all