FTP (File Transfer Protocol)#

Purpose:

FTP is used to upload and download files between a client and server over a network.

Layer:

• Application Layer (same as HTTP, POP3)

Ports:

• Control Channel: TCP port 21 – used for commands/status codes
• Data Channel: TCP port 20 – used for transferring files

Active vs Passive Mode

FTP Commands Overview#

• ls — list directory contents
• get <file> — download file
• put <file> — upload file
• status — show connection status
• debug — enable detailed output
• trace — trace packets

Authentication & Security#

• Default: Requires username and password
• Anonymous Access: No credentials required (limited access)
• Warning: FTP transmits data in clear text, vulnerable to sniffing
• Log Files & Configuration:
  • /etc/vsftpd.conf – main config file
  • /etc/ftpusers – users denied access

Common vsftpd Configuration#

# Show only active settings
cat /etc/vsftpd.conf | grep -v "#"

Blocked Users via /etc/ftpusers#

cat /etc/ftpusers

Example output:#

guest
john
kevin

These users are blocked from using FTP.

Dangerous (but sometimes used) Anonymous Settings#

anonymous_enable=YES
anon_upload_enable=YES
anon_mkdir_write_enable=YES
no_anon_password=YES
anon_root=/home/username/ftp
write_enable=YES

These can expose your system if enabled without care. Use only in trusted internal networks.

Anonymous Login Example#

ftp 10.129.14.136
Name: anonymous

ftp> ls
ftp> get <filename>
ftp> status
ftp> debug
ftp> trace

TFTP (Trivial File Transfer Protocol)#

Purpose:

Used for simple file transfers, often in embedded or network boot environments.

Comparison with FTP:

TFTP Commands

Useful Tips#

• vsftpd is commonly used on Linux systems and can be installed via:

sudo apt install vsftpd

• For more configuration options, refer to the man page:

man vsftpd.conf

Footprinting the Service with Nmap#

Nmap and NSE (Nmap Scripting Engine)#

• Nmap is a powerful scanner for discovering hosts, services, and vulnerabilities.

• It includes NSE scripts for specific services like FTP, HTTP, SMB, etc.

• To keep the script database up to date:

  sudo nmap --script-updatedb

• Location of scripts (example):

  find / -type f -name ftp* 2>/dev/null | grep scripts

FTP Enumeration#

Scanning Target#

Basic Nmap command for FTP service on port 21:

sudo nmap -sV -p21 -sC -A 10.129.14.136

Breakdown:#

• sV: Version detection.
• p21: Scan port 21.
• sC: Run default NSE scripts.
• A: Aggressive scan (includes OS detection, version detection, script scanning, and traceroute).

Output Highlights:#

• FTP service detected: vsftpd 2.0.8 or later
• Anonymous login allowed
• Directories and files listed, many are writeable – potential for file upload!
• ftp-anon script detected anonymous login and dumped directory contents.
• ftp-syst script showed FTP status and server banner: vsFTPd 3.0.3

Script Tracing#

Use --script-trace to see low-level interaction between Nmap and the server:

sudo nmap -sV -p21 -sC -A 10.129.14.136 --script-trace

This helps understand what NSE scripts are doing (like sending STAT, USER, PASS commands).

Manual FTP Interaction#

If you want to interact manually:

nc -nv 10.129.14.136 21

or

telnet 10.129.14.136 21

TLS/SSL Support (Encrypted FTP)#

If the FTP server uses TLS:

openssl s_client -connect 10.129.14.136:21 -starttls ftp

This can show:

• Certificate details (e.g., CN = master.inlanefreight.htb)
• Organization, location, sometimes email address
• Useful for OSINT and identifying targets