Tasks

  • What does the 3-letter acronym FTP stand for?
    • Answer: File Transfer Protocol
  • Which port does the FTP service listen on usually?
    • Answer: Port 21
  • FTP sends data in the clear, without any encryption. What acronym is used for a later protocol designed to provide similar functionality to FTP but securely, as an extension of the SSH protocol?
    • Answer: SFTP
  • What is the command we can use to send an ICMP echo request to test our connection to the target?
    • Answer: ping
  • From your scans, what version is FTP running on the target?
    • Answer: vsftpd 3.0.3
  • From your scans, what OS type is running on the target?
    • Answer: Unix
  • What is the command we need to run in order to display the ‘ftp’ client help menu?
    • Answer: ftp -?
  • What is username that is used over FTP when you want to log in without having an account?
    • Answer: anonymous
  • What is the response code we get for the FTP message ‘Login successful’?
    • Answer: 230
  • There are a couple of commands we can use to list the files and directories available on the FTP server. One is dir. What is the other that is a common way to list files on a Linux system.
    • Answer: ls
  • What is the command used to download the file we found on the FTP server?
    • Answer: get
  • Submit root flag
    • 035db21c881520061c53e0536e44f815

Steps

  • We’ll go ahead and do a initial rustscan to see what we are dealing with
rustscan --ulimit 5000 --addresses "10.129.1.14" --top -- -sC -sV
  • Appears to only be FTP again, with the scan actually pointing out the existence of a flag.txt file, so that is cool.
  • However, we are also shown that we do have anonymous login ability on here!
PORT   STATE SERVICE REASON         VERSION  
21/tcp open  ftp     syn-ack ttl 63 vsftpd 3.0.3  
| ftp-anon: Anonymous FTP login allowed (FTP code 230)  
|_-rw-r--r--    1 0        0              32 Jun 04  2021 flag.txt  
| ftp-syst:    
|   STAT:    
| FTP server status:  
|      Connected to ::ffff:10.10.14.71  
|      Logged in as ftp  
|      TYPE: ASCII  
|      No session bandwidth limit  
|      Session timeout in seconds is 300  
|      Control connection is plain text  
|      Data connections will be plain text  
|      At session startup, client count was 3  
|      vsFTPd 3.0.3 - secure, fast, stable  
|_End of status  
Service Info: OS: Unix
  • So, let’s go ahead and do that:
ftp 10.129.1.14
  • Now, after logging in with anonymous, we are able to jump into an FTP session.
Connected to 10.129.1.14.  
220 (vsFTPd 3.0.3)  
Name (10.129.1.14:root): anonymous  
331 Please specify the password.  
Password:    
230 Login successful.  
Remote system type is UNIX.  
Using binary mode to transfer files.  
ftp>
  • We can then find the flag.txt file and download a copy onto our local machine.
ftp> ls  
229 Entering Extended Passive Mode (|||29011|)  
150 Here comes the directory listing.  
-rw-r--r--    1 0        0              32 Jun 04  2021 flag.txt  
226 Directory send OK.  
ftp> get flag.txt  
local: flag.txt remote: flag.txt  
229 Entering Extended Passive Mode (|||41365|)  
150 Opening BINARY mode data connection for flag.txt (32 bytes).  
100% |***********************************************************************************************************************************************************************************************|    32       38.86 KiB/s    00:00 ETA  
226 Transfer complete.  
32 bytes received in 00:00 (0.39 KiB/s)  
ftp>
  • We can then easily read out the file to get the flag!
[Nov 20, 2025 - 12:30:48 (PST)] exegol-htb-starting-point /workspace # ls  
flag.txt  
[Nov 20, 2025 - 12:30:49 (PST)] exegol-htb-starting-point /workspace # cat flag.txt    
035db21c881520061c53e0536e44f815#