FTP


Nmap discovered a FTP server on the port 21 of the 192.168.207.124 host. The running service is vsftpd 3.0.2

Null Session


┌──(kali㉿kali)-[~/PEN-200/PG_PLAY/insanityhosting]
└─$ ftp ftp@$IP
Connected to 192.168.207.124.
220 (vsFTPd 3.0.2)
331 Please specify the password.
Password: ftp
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> rstatus
211-FTP server status:
     Connected to ::ffff:192.168.45.158
     Logged in as ftp
     TYPE: ASCII
     No session bandwidth limit
     Session timeout in seconds is 300
     Control connection is plain text
     Data connections will be plain text
     At session startup, client count was 1
     vsFTPd 3.0.2 - secure, fast, stable
211 End of status
ftp>
 
ftp> put test 
local: test remote: test
200 EPRT command successful. Consider using EPSV.
550 Permission denied.

The target FTP server allows null session, but write access is not granted.

ftp> ls -la
200 EPRT command successful. Consider using EPSV.
150 Here comes the directory listing.
drwxr-xr-x    3 0        0              17 Aug 16  2020 .
drwxr-xr-x    3 0        0              17 Aug 16  2020 ..
drwxr-xr-x    2 0        0               6 Apr 01  2020 pub
226 Directory send OK.
 
ftp> ls -la
200 EPRT command successful. Consider using EPSV.
150 Here comes the directory listing.
drwxr-xr-x    2 0        0               6 Apr 01  2020 .
drwxr-xr-x    3 0        0              17 Aug 16  2020 ..
226 Directory send OK.
 
ftp> put test 
local: test remote: test
200 EPRT command successful. Consider using EPSV.
550 Permission denied.

/pub/ directory is empty and no write access.