FTP Is Not Dead: Bounce Attacks, Path Traversal, and Anonymous Write

#nmap -sC -sV -p 21 192.168.2.142#link

That is where every FTP engagement starts. One nmap command. The -sC runs default scripts including ftp-anon which checks for anonymous login. The -sV grabs the banner and version. In the output above, you see vsFTPd 2.3.4 with anonymous access enabled and a writeable incoming directory. Three pieces of information that determine your entire attack path.

You are in. No password required. The ftp client gives you ls, cd, get, mget, put, mput. Download everything interesting. Upload if the directory is writeable. The help command shows all available operations. Do not overthink this phase. Enumerate, download, move on.

The FTP Bounce Attack: Scanning Through the Server

Here is where it gets interesting. FTP has a PORT command that tells the server to connect back to a client-specified address and port. If the server does not validate that address, you can make it connect to internal hosts. You are scanning the internal network through the FTP server. The target never sees your IP.

Port 80 is open on the internal host 172.17.0.2. You discovered this without ever touching that host directly. The FTP server made the connection for you. Modern FTP servers disable this by default, but misconfigured ones still exist. Especially in DMZ segments where the FTP server bridges external and internal networks.

CVE-2022-22836: CoreFTP Path Traversal

One curl command. The --path-as-is flag prevents curl from normalizing the path traversal sequences. The server processes the PUT request, follows the ../../../../../../ traversal out of the restricted directory, and writes "PoC." to C:\whoops. Arbitrary file write outside the FTP root. From there, it is a short hop to writing a web shell or replacing a service binary.

FTP is old. People assume it is secure because it is behind a firewall. That assumption is your advantage. Check anonymous access. Check write permissions. Check if the server allows PORT commands to arbitrary addresses. Check the version against known CVEs. Five minutes of enumeration can hand you the entire internal network.