# FTP

## <mark style="color:yellow;">ABOUT</mark>

<mark style="color:red;">**File Transfer Protocol**</mark> is a standard communication <mark style="color:purple;">**protocol**</mark> used for the transfer of computer files from a server to a client on a computer network. **FTP** is built on a **client–server** model, and by default is using <mark style="color:yellow;">**port 21.**</mark>

In <mark style="color:red;">**active FTP**</mark>, the client connects to the server’s command port (usually port 21) and tells the server which port it opened for data. The server then initiates the data connection back to the client’s specified port. This can cause issues if the client is behind a firewall or NAT that blocks incoming connections.

In <mark style="color:red;">**passive FTP**</mark>, the client connects to the server’s command port and requests passive mode. The server then opens a random port and tells the client to connect to it for data transfer. This allows the client to initiate both connections, making it more firewall-friendly.

## <mark style="color:yellow;">COMMANDS</mark>

| Command                                  | Description                                                        |
| ---------------------------------------- | ------------------------------------------------------------------ |
| <mark style="color:green;">`USER`</mark> | specifies the user to log in as.                                   |
| <mark style="color:green;">`PASS`</mark> | sends the password for the user attempting to log in.              |
| <mark style="color:green;">`PORT`</mark> | when in active mode, this will change the data port used.          |
| <mark style="color:green;">`PASV`</mark> | switches the connection to the server from active mode to passive. |
| <mark style="color:green;">`LIST`</mark> | displays a list of the files in the current directory.             |
| <mark style="color:green;">`CWD`</mark>  | will change the current working directory to one specified.        |
| <mark style="color:green;">`PWD`</mark>  | prints out the directory you are currently working in.             |
| <mark style="color:green;">`SIZE`</mark> | will return the size of a file specified.                          |
| <mark style="color:green;">`RETR`</mark> | retrieves the file from the FTP server.                            |
| <mark style="color:green;">`QUIT`</mark> | ends the session.                                                  |

## <mark style="color:yellow;">USAGE</mark>

#### Connect

```bash
ftp 13.13.13.13
```

#### Commands

```bash
get or mput - download a file or files
put or mput - upload a file or files
status - more info about server
ls cd - moving in directories
```

## <mark style="color:yellow;">TFTP</mark>

<mark style="color:red;">**vsFTPd**</mark> is one of the most used FTP servers on Linux-based distributions. The default configuration of vsFTPd can be found in <mark style="color:yellow;">**/etc/vsftpd.conf**</mark>. Users, for which access to FTP server is forbidden could be found at <mark style="color:green;">**`/etc/ftpusers`**</mark> file

## <mark style="color:yellow;">Dangerous Config Settings</mark>

* <mark style="color:green;">**`anonymous_enable=YES`**</mark> - Allowing anonymous login?
* <mark style="color:green;">**`anon_upload_enable=YES`**</mark> - Allowing anonymous to upload files?
* <mark style="color:green;">**`anon_mkdir_write_enable=YES`**</mark> - Allowing anonymous to create new directories?
* <mark style="color:green;">**`no_anon_password=YES`**</mark> - Do not ask anonymous for password?
* <mark style="color:green;">**`anon_root=/home/username/ftp`**</mark> - Directory for anonymous.
* <mark style="color:green;">**`write_enable=YES`**</mark> - Allow the usage of FTP commands

## <mark style="color:yellow;">Bruteforcing</mark>

We could do a FTP server **bruteforcing** or **password** spraying with <mark style="color:green;">**Medusa**</mark>

```bash
medusa -u v17 -P /usr/share/wordlists/rockyou.txt -h 13.13.13.13 -M ftp 
```

**Options:**&#x20;

* <mark style="color:green;">**`-u`**</mark> for username and <mark style="color:green;">**`-U`**</mark> for list&#x20;
* <mark style="color:green;">**`-p`**</mark> for password and <mark style="color:green;">**`-P`**</mark> for list
* <mark style="color:green;">**`-h`**</mark> for host
* <mark style="color:green;">**`-M`**</mark> for protocol

## <mark style="color:yellow;">FTP Bounce Attack</mark>

We are using a **ftp** <mark style="color:green;">**`PORT`**</mark> command to trick **ftp server** into running command and getting information from device other than **ftp server**. As example we could use this to **scan the network** through **ftp**. You could look here for more explanation[ **\[LINK\]**](https://www.geeksforgeeks.org/what-is-ftp-bounce-attack/)**.** For making ftp bounce attack nmap scan we could use <mark style="color:green;">**`-b`**</mark> option:

```bash
nmap -Pn -v -n -p80 -b v17:amogus@13.13.13.13 69.69.69.69
Where 13.13.13.13 is ftp server
```

## <mark style="color:yellow;">Tips2Hack</mark>

1. Try to use anonymous login, config allows that, you could lurk for some juicy info. For this just use <mark style="color:yellow;">**anonymous**</mark> as login name, and left password empty.
2. If config allows, you could lurk even faster through directories with recursive listing <mark style="color:green;">**`ls -R`**</mark>
3. To download a file you need to use <mark style="color:green;">**`get`**</mark> command and to upload you need <mark style="color:green;">**`put`**</mark> and also you could use <mark style="color:green;">**`status`**</mark> to get more info about server and FTP state
4. To <mark style="color:yellow;">**download**</mark> <mark style="color:yellow;">**all**</mark> <mark style="color:yellow;">**files**</mark> you need to use

```bash
wget -m --no-passive ftp://anonymous:anonymous@13.13.13.13
```

5. Check all available nmap ftp scripts:

```bash
find / -type f -name ftp* 2>/dev/null | grep scripts
```