FTP - 21,20
First we try to understand the technology, and then we dive into footprinting FTP.
The File Transfer Protocol is one of the oldest protocols on the internet. It is an application layer protocol so same layer as HTTP or POP.
Lets say we want to upload a file to the server. In an FTP connection, two channels are opened. First the client and the server establish a control channel on port 21. Here the client sends commands and the server returns status codes. Then a data channel is established via port 20. The protocol watches for errors during this process.
There is a distinction between active and passive FTP. In the active variant, communications happen as normal and the client communicates its port to the server but when the server replies back from the new data port (which the client hasn't seen yet) and the client has a firewall protection that blocks such a reply, for such situations passive variant was developed. Here, the server announces a port through which the client can establish the data channel. Since the client initiates the connection in this method, the firewall does not block the transfer.
The FTP knows different commands and status codes, even though not all commands are configured on the server. Usually FTP requires credentials to use the server but FTP anonymous is sometimes enabled to let a client use FTP without using any passwords which is a big security risk.
TFTP
TFTP is much simpler than FTP. It doesnt provide authentication and many other features provided by FTP. Instead of TCP it uses UDP which makes it very unreliable. Because of the lack of security, TFTP, unlike FTP, may only be used in local and protected networks. Here are some of the commands accepted by TFTP:
connect
Sets the remote host, and optionally the port, for file transfers.
get
Transfers a file or set of files from the remote host to the local host.
put
Transfers a file or set of files from the local host onto the remote host.
quit
Exits tftp.
status
Shows the current status of tftp, including the current transfer mode (ascii or binary), connection status, time-out value, and so on.
verbose
Turns verbose mode, which displays additional information during file transfer, on or off.
Unlike the FTP client, TFTP does not have directory listing functionality.
Default Configuration
One of the most used FTP servers on Linux-based distributions is vsFTPd. The default configuration of vsFTPd can be found in /etc/vsftpd.conf, and some settings are already predefined by default. It is highly recommended to install the vsFTPd server on a VM and have a closer look at this configuration.
The vsFTPd server is only one of a few FTP servers available to us. There are many different alternatives to it, which also bring, among other things, many more functions and configuration options with them. We will use the vsFTPd server because it is an excellent way to show the configuration possibilities of an FTP server in a simple and easy-to-understand way without going into the details of the man pages. If we look at the configuration file of vsFTPd, we will see many options and settings that are either commented or commented out. However, the configuration file does not contain all possible settings that can be made. The existing and missing ones can be found on the man page.
listen=NO
Run from inetd or as a standalone daemon?
listen_ipv6=YES
Listen on IPv6 ?
anonymous_enable=NO
Enable Anonymous access?
local_enable=YES
Allow local users to login?
dirmessage_enable=YES
Display active directory messages when users go into certain directories?
use_localtime=YES
Use local time?
xferlog_enable=YES
Activate logging of uploads/downloads?
connect_from_port_20=YES
Connect from port 20?
secure_chroot_dir=/var/run/vsftpd/empty
Name of an empty directory
pam_service_name=vsftpd
This string is the name of the PAM service vsftpd will use.
rsa_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
The last three options specify the location of the RSA certificate to use for SSL encrypted connections.
rsa_private_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
ssl_enable=NO
In addition, there is a file called /etc/ftpusers that we also need to pay attention to, as this file is used to deny certain users access to the FTP service.
Dangerous Settings
One of the authentication setting is the anonymous login.This is often used to allow everyone on the internal network to share files and data without accessing each other's computers. With vsFTPd, the optional settings that can be added to the configuration file for the anonymous login look like this:
anonymous_enable=YES
Allowing anonymous login?
anon_upload_enable=YES
Allowing anonymous to upload files?
anon_mkdir_write_enable=YES
Allowing anonymous to create new directories?
no_anon_password=YES
Do not ask anonymous for password?
anon_root=/home/username/ftp
Directory for anonymous.
write_enable=YES
Allow the usage of FTP commands: STOR, DELE, RNFR, RNTO, MKD, RMD, APPE, and SITE?
As soon as we connect to the vsFTPd server, the response code 220 is displayed with the banner of the FTP server. Often this banner contains the description of the service and even the version of it. After logging in we can first use the status command:
Some commands should be used occasionally, as these will make the server show us more information that we can use for our purposes. These commands include debug and trace.
Here are some more configuration descriptions for anonymouse ftp:
dirmessage_enable=YES
Show a message when they first enter a new directory?
chown_uploads=YES
Change ownership of anonymously uploaded files?
chown_username=username
User who is given ownership of anonymously uploaded files.
local_enable=YES
Enable local users to login?
chroot_local_user=YES
Place local users into their home directory?
chroot_list_enable=YES
Use a list of local users that will be placed in their home directory?
hide_ids=YES
All user and group information in directory listings will be displayed as "ftp".
ls_recurse_enable=YES
Allows the use of recurse listings.
If hide_ids=YES setting is present, the UID and GUID representation of the service will be overwritten, making it more difficult for us to identify with which rights these files are written and uploaded.
Another helpful setting we can use for our purposes is the ls_recurse_enable=YES. This is often set on the vsFTPd server to have a better overview of the FTP directory structure, as it allows us to see all the visible content at once.
Downloading files from such an FTP server is one of the main features, as well as uploading files created by us. This allows us, for example, to use LFI vulnerabilities to make the host execute system commands. Apart from the files, we can view, download and inspect. Attacks are also possible with the FTP logs, leading to Remote Command Execution (RCE). This applies to the FTP services and all those we can detect during our enumeration phase.
We can download individual files with get <file_name> or we can download all the files (which can cause alarms):
Next, we can check if we have the permissions to upload files to the FTP server. Especially with web servers, it is common that files are synchronized, and the developers have quick access to the files. FTP is often used for this purpose, and most of the time, configuration errors are found on servers that the administrators think are not discoverable. The attitude that internal network components cannot be accessed from the outside means that the hardening of internal systems is often neglected and leads to misconfigurations.
The ability to upload files to the FTP server connected to a web server increases the likelihood of gaining direct access to the webserver and even a reverse shell that allows us to execute internal system commands and perhaps even escalate our privileges.
To upload a file use the command put <file_name>.
Footprinting FTP
One of the most popular and widely used tool for footprinting FTP is Nmap. Nmap also brings the Nmap Scripting Engine (NSE), a set of many different scripts written for specific services. We can update the database with:
We can find scripts related to FTP:
This is what an Nmap scan looks like on port 21:
The default script scan is based on the services' fingerprints, responses, and standard ports. Once Nmap has detected the service, it executes the marked scripts one after the other, providing different information. For example, the ftp-anon NSE script checks whether the FTP server allows anonymous access. If so, the contents of the FTP root directory are rendered for the anonymous user.
The ftp-syst, for example, executes the STAT command, which displays information about the FTP server status. This includes configurations as well as the version of the FTP server. Nmap also provides the ability to trace the progress of NSE scripts at the network level if we use the --script-trace option in our scans. This lets us see what commands Nmap sends, what ports are used, and what responses we receive from the scanned server.
With SSL/TLS Encryption
It looks slightly different if the FTP server runs with TLS/SSL encryption. Because then we need a client that can handle TLS/SSL. For this, we can use the client openssl and communicate with the FTP server. The good thing about using openssl is that we can see the SSL certificate, which can also be helpful.
Last updated