# (21)FTP

## About

<img src="https://2471562516-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2x96g0dngcMbgd6cnWUj%2Fuploads%2FsHzuZRBUJva0Rt4LksA9%2Ffile.excalidraw.svg?alt=media&#x26;token=fa30fd5f-ff1a-4a69-9256-20a35f41f8b6" alt="Basic FTP connection graph." class="gitbook-drawing">

### Active VS Passive FTP

<img src="https://2471562516-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2x96g0dngcMbgd6cnWUj%2Fuploads%2FkfJHwD5f0nyWdNBGh958%2Ffile.excalidraw.svg?alt=media&#x26;token=99f8d664-f8c1-4d9b-b089-164582d13672" alt="Active vs Passive FTP" class="gitbook-drawing">

{% hint style="info" %}
TFTP on the other hand, is a more basic implementation of FTP:

* It uses UDP.
* <mark style="color:red;">Needs no user authentication.</mark>
* No directory listing functionality

<mark style="color:red;">These characteristics are enough to assume that this protocol should be used only on strongly secured networks.</mark>
{% endhint %}

## Config:

For Linux, it is common to use the vsFTPd server to implement the FTP protocol.

```bash
$sudo apt install vsftpd
```

* ***/etc/vstpd.conf***
* ***/etc/ftpusers : Blocked users***

### Useful commands:

* ls
* debug/trace
* get/put (if it's enabled)
* ls -R (if it's enabled)&#x20;

```bash
# Outputs a directory with the target IP name containing the downloaded content.
$wget -m --no-passive ftp://username:password@targetIP
```

## Enumeration

### Nmap

```bash
$sudo nmap  -p21 -sC --script=ftp* 10.10.10.10
```

### Interaction and banner grabbing:

<img src="https://2471562516-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2x96g0dngcMbgd6cnWUj%2Fuploads%2FssGYUoJ87OOun8BKDFcQ%2Ffile.excalidraw.svg?alt=media&#x26;token=1bf0433a-6cd4-4651-b45b-d9655ca32859" alt="" class="gitbook-drawing">

Upon connecting to the server, we'll get a response depending on how it was configured, we'll try to grab and check that banner to get more information about the server.

```bash
$nc <target-ip> 21
$telnet <target-ip> 21
```

#### Download all the available content:

```bash
$wget -m --no-passive ftp://username:password@targetIP
```

If the server runs with TLS/SSL encryption:

```bash
$openssl s_client -connect <target-ip>:21 -starttls ftp
```
