Which port does the FTP service listen on usually?
Answer: Port 21
FTP sends data in the clear, without any encryption. What acronym is used for a later protocol designed to provide similar functionality to FTP but securely, as an extension of the SSH protocol?
Answer: SFTP
What is the command we can use to send an ICMP echo request to test our connection to the target?
Answer: ping
From your scans, what version is FTP running on the target?
Answer: vsftpd 3.0.3
From your scans, what OS type is running on the target?
Answer: Unix
What is the command we need to run in order to display the ‘ftp’ client help menu?
Answer: ftp -?
What is username that is used over FTP when you want to log in without having an account?
Answer: anonymous
What is the response code we get for the FTP message ‘Login successful’?
Answer: 230
There are a couple of commands we can use to list the files and directories available on the FTP server. One is dir. What is the other that is a common way to list files on a Linux system.
Answer: ls
What is the command used to download the file we found on the FTP server?
Answer: get
Submit root flag
035db21c881520061c53e0536e44f815
Steps
We’ll go ahead and do a initial rustscan to see what we are dealing with
Appears to only be FTP again, with the scan actually pointing out the existence of a flag.txt file, so that is cool.
However, we are also shown that we do have anonymous login ability on here!
PORT STATE SERVICE REASON VERSION
21/tcp open ftp syn-ack ttl 63 vsftpd 3.0.3
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_-rw-r--r-- 1 0 0 32 Jun 04 2021 flag.txt
| ftp-syst:
| STAT:
| FTP server status:
| Connected to ::ffff:10.10.14.71
| Logged in as ftp
| TYPE: ASCII
| No session bandwidth limit
| Session timeout in seconds is 300
| Control connection is plain text
| Data connections will be plain text
| At session startup, client count was 3
| vsFTPd 3.0.3 - secure, fast, stable
|_End of status
Service Info: OS: Unix
So, let’s go ahead and do that:
ftp 10.129.1.14
Now, after logging in with anonymous, we are able to jump into an FTP session.
Connected to 10.129.1.14.
220 (vsFTPd 3.0.3)
Name (10.129.1.14:root): anonymous
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp>
We can then find the flag.txt file and download a copy onto our local machine.
ftp> ls
229 Entering Extended Passive Mode (|||29011|)
150 Here comes the directory listing.
-rw-r--r-- 1 0 0 32 Jun 04 2021 flag.txt
226 Directory send OK.
ftp> get flag.txt
local: flag.txt remote: flag.txt
229 Entering Extended Passive Mode (|||41365|)
150 Opening BINARY mode data connection for flag.txt (32 bytes).
100% |***********************************************************************************************************************************************************************************************| 32 38.86 KiB/s 00:00 ETA
226 Transfer complete.
32 bytes received in 00:00 (0.39 KiB/s)
ftp>
We can then easily read out the file to get the flag!