In this video, we are going to learn how we can exploit FTP protocol.
FTP, as the name suggests, is a protocol that is used to allow the remote transfer of files over a
network.
FTP operates using a client server protocol.
The client initiates a connection with the server.
The server validates whatever login credentials are provided and then opens the session.
When the session is open, the client may execute commands on the server.
FTP protocol normally runs on port 21.
For enumeration, we can use Nmap to scan for port 21 and get information about it.
In some cases FTP may allow anonymous login which does not need any username and password.
If FTP requires username and password, we can use hydra to brute force the password.
Just use the command as shown on the screen and mention FTP protocol.
Now let's see the demonstration.
For the demonstration purposes I'm using.
Network services roam on Tryhackme, which is a very good roam to learn network exploitation.
And the first question is what communication model does FTP use which we have already discussed?
That is client server model.
The second question is what's the standard FTP protocol, which is Port 21?
The third question is how many modes of FTP connections are there?
Which are two?
So after solving the basic questions, you start your machine.
And our task is to enumerate FTP.
Once the machine is started, copy the IP address of the machine.
Move over to your Kali machine.
And try to bring it.
So our machine is live.
Now start Nmap scan.
SSH is for stealth scan.
Dash A is to enumerate all possible services and ports.
Dash t4 is to speed up the scan.
And we do have FTP running on port 21.
Which also allows anonymous login.
Before we move on to the next step, let's just run the scan for all posts to see if any other port
is open.
To repeat the scan with dash P dash flag.
Foreskin is back.
When only Port 21 is open on which FTP service is running.
So the next question is what variant of FTP is running on it?
It is vsftpd, which we have seen.
No, we need to anonymous login into the file system.
Open a new terminal.
And use the command FTP and the IP address.
And once it asks for the name was anonymous and give it a blank password and you are logged into the
machine.
You can check the files in the current directory by command.
There's one file public underscore notice dot text.
To download the file, use the get command and the file is downloaded.
Now you can check the contents of the file with Cat Command.
Now, let's just answer the question on Tryhackme.
So the question is what is the file name which you have seen public notice dot txt.
And the next question is what do we think?
A possible username.
Which is like.
Just complete this section.
Now, in the next task we will be brute forcing FTP credentials.
First of all, locate your rock dictionary file.
Locate command.
It's located in usr share wordlist directory.
They use the command draw dash l specify the user name, which is Mike.
Specify the dictionary of passwords with dash flag.
IP address.
I specify FTP in the end.
You can use dash v flag for verbose output.
You can see that it has successfully bruteforced our password, which is actually password.
To the password of user mic is password.
Lead the next task as well.
And let's just log in.
Use the command FTP, the IP address of the machine.
Now use the username Mike.
And the password.
Password.
And we are logged in.
Let's check the contents of the current file with FTP and get the ftp dot txt file.
Knocked out its content.
And we have our flag.
Just copy the flag and paste it on.
Try hack me.
So we have completed FTP exploitation task on tryhackme.
So in this video we learned how we can enumerate FTP and how we can exploit and brute force FTP passwords.