> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/enumeration/ftp.md).

# FTP

FTP (File Transfer Protocol) enumeration involves identifying misconfigurations, services, and credentials that may lead to unauthorized file access or remote code execution. It’s commonly used during internal and external network assessments.

Common Ports: 20, 21, 2121

***

### Attempt Anonymous Login

```bash
ftp <target-ip>
```

* **Username**: `anonymous`, `ftp`, `anon` (Linux-specific)
* **Password**: Any value (e.g., `test@example.com`, blank)

> If anonymous login is allowed, proceed to check file and folder listings.

***

### Check File and Directory Permissions

Use FTP commands such as `ls`, `dir`, and `cd` to navigate.

* **Read permission**: Look for files like:
  * `credentials.txt`
  * `log.txt`
  * `backup.zip`
  * `messages`, `notes`, etc.
* **Write permission**: Attempt to upload files using:

  ```bash
  put <file>
  ```

***

### Download and Analyze Files

If only **read access** is available:

```bash
get <filename>
```

Analyze downloaded files for:

* Usernames and passwords
* Application/database configuration
* Web source code or backup content

***

### Upload Files (If Writable)

If **write permission** is present:

1. Navigate to web-accessible directories (e.g., `/var/www/html`, `/htdocs`).
2. Upload a web shell:

   ```bash
   binary        # Always switch to binary mode before transfer
   put shell.php
   ```
3. Trigger the shell in the browser:

   ```
   http://<target-ip>/shell.php
   ```

{% hint style="success" %}
You can attempt directory traversal with:

`cd ../../`
{% endhint %}

***

### SSH Key Injection via FTP

If **SSH is open** and **you have write access** to a user's home directory:

1. Generate an SSH key pair:

   ```bash
   ssh-keygen -t rsa -f id_rsa
   ```
2. Upload your public key:

   ```bash
   put id_rsa.pub
   ```
3. Rename or move it to the authorized keys path:

   ```
   /home/username/.ssh/authorized_keys
   ```
4. Connect via SSH:

   ```bash
   ssh -i id_rsa username@<target-ip>
   ```

> This allows passwordless login if configured correctly.

***

### Check FTP Service Version

Use `nmap` to identify the running FTP version:

```bash
nmap -p 21 -sV <target>
```

Search for public exploits using:

* [Exploit-DB](https://www.exploit-db.com/)
* [CVE Details](https://www.cvedetails.com/)
* Google search (e.g., `"vsftpd 2.3.4 exploit"`)

> Vulnerable versions like [**vsftpd 2.3.4** (backdoor)](https://www.exploit-db.com/exploits/49757) and ProFTPd 1.3.5 (mod\_copy)

***

### Common FTP Misconfigurations

#### 1. Anonymous Login Allowed

* Should not allow any form of **write access**
* Should be restricted from accessing sensitive paths like:
  * `/var/www/`
  * `/home/`
  * `/etc/`

#### 2. Writable Directories Without Authentication

* Can be used to upload:
  * Reverse shells
  * Defacement payloads
  * SSH keys (privilege escalation vector)

***

### Useful FTP Commands

| Command      | Description                                               |
| ------------ | --------------------------------------------------------- |
| `lcd`        | Change local directory on your machine                    |
| `cd <dir>`   | Change directory on the FTP server                        |
| `ls` / `dir` | List files and folders on the FTP server                  |
| `binary`     | Use binary mode for uploading executable files and shells |
| `put <file>` | Upload file to the server                                 |
| `get <file>` | Download file from the server                             |
| `mget *`     | Download multiple files (wildcard support)                |