> For the complete documentation index, see [llms.txt](https://yongjun04.gitbook.io/oscp-cheatsheet/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://yongjun04.gitbook.io/oscp-cheatsheet/methodology/service-enumeration/tcp-ftp-21.md).

# TCP: FTP - 21

> **NOTE: Enter the following for file transfer mode in FTP console**
>
> * passive
> * binary

## Connection

### Anonymous Login

| Username  | Password  |
| --------- | --------- |
| ftp       | ftp       |
| anonymous | anonymous |

```bash
ftp <Username>@<Target IP Address> [Port]
```

### Bruteforce Login

Using Username List and Password List

```bash
hydra -L <Username Lists> -P <Password Lists> -f ftp://<Target IP Address> [-p <Port>]
```

Using Username and Password

```bash
hydra -l <Username> -p <Password> -f ftp://<Target IP Address> [-p <Port>]
```

Using Username:Password list

```bash
hydra -C <Username:Password List> -f ftp://<Target IP Address> [-p <Port>]
```

## Enumeration

### Nmap

```bash
nmap --script "ftp-anon" -p <Port> <Target IP Address>
```

### Banner Grabbing

```bash
nc -nv <Target IP Address> <Port>
```

```bash
nc -sV <Target IP Address> <Port>
```

## File Maneuver

### Downloading Shares

```bash
wget -m ftp://<Username>:<Password>@<Target IP Address>
```

```bash
wget -m --no-passive ftp://:@<Target IP Address>
```

> **NOTE: The above command is to download shares if there is no firewall between you and FTP server**

## Grab Cert

```bash
openssl s_client -starttls ftp -connect <Target IP Address>:<Port>
```

## Exploit

> **NOTE:**
>
> * Accessing the payload via HTTP would trigger the payload
> * Recommend .asp or .aspx for Mircosoft servers

```bash
put <Payload File>
```