Hepet_FTP_20001

FTP

---

Nmap discovered a FTP server on the target port 20001 The running service is FileZilla ftpd 0.9.41 beta

Null Session

---

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/hepet]
└─$ ftp $IP -P 20001
Connected to 192.168.159.140.
220-FileZilla Server version 0.9.41 beta
220-written by Tim Kosse (Tim.Kosse@gmx.de)
220 Please visit http://sourceforge.net/projects/filezilla/
Name (192.168.159.140:kali): anonymous
331 Password required for anonymous
Password: anonymous
230 Logged on
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> 
ftp> put test
local: test remote: test
229 Entering Extended Passive Mode (|||50637|)
550 Permission denied

Authenticated as the anonymous account No write access

ftp> pwd
Remote directory: /
ftp> ls
229 Entering Extended Passive Mode (|||50607|)
150 Connection accepted
-r--r--r-- 1 ftp ftp            312 Oct 20  2020 .babelrc
-r--r--r-- 1 ftp ftp            147 Oct 20  2020 .editorconfig
-r--r--r-- 1 ftp ftp             23 Oct 20  2020 .eslintignore
-r--r--r-- 1 ftp ftp            779 Oct 20  2020 .eslintrc.js
-r--r--r-- 1 ftp ftp            167 Oct 20  2020 .gitignore
-r--r--r-- 1 ftp ftp            228 Oct 20  2020 .postcssrc.js
-r--r--r-- 1 ftp ftp            346 Oct 20  2020 .tern-project
drwxr-xr-x 1 ftp ftp              0 Oct 20  2020 build
drwxr-xr-x 1 ftp ftp              0 Oct 20  2020 config
-r--r--r-- 1 ftp ftp           1376 Oct 20  2020 index.html
-r--r--r-- 1 ftp ftp         425010 Oct 20  2020 package-lock.json
-r--r--r-- 1 ftp ftp           2454 Oct 20  2020 package.json
-r--r--r-- 1 ftp ftp           1100 Oct 20  2020 README.md
drwxr-xr-x 1 ftp ftp              0 Oct 20  2020 src
drwxr-xr-x 1 ftp ftp              0 Oct 20  2020 static
-r--r--r-- 1 ftp ftp            127 Oct 20  2020 _redirects
226 Transfer OK

The root directory contains what appears to be a web application root directory

ftp> more package.json
{
  "name": "vue-blog-demo",
  "version": "1.0.0",
  "description": "A Vue.js blog demo to demonstrate proper decoupling of api data and swapping of resources/providers",
  "author": "Nicolas Udy <dev@udy.io>",
  "private": true,
  "scripts": {
    "dev": "node build/dev-server.js",
    "start": "npm run dev",
    "build": "node build/build.js",
    "lint": "eslint --ext .js,.vue src"
  },
  "dependencies": {
    "lodash.merge": "^4.6.2",
    "scrollto-with-animation": "^4.5.2",
    "vue": "^2.5.2",
    "vue-disqus": "^2.0.3",
    "vue-router": "^3.0.1"
  },
  "devDependencies": {
    "autoprefixer": "^7.2.6",
    "babel-core": "^6.26.3",
    "babel-eslint": "^7.1.1",
    "babel-loader": "^7.1.5",
    "babel-plugin-transform-runtime": "^6.22.0",
    "babel-polyfill": "^6.23.0",
    "babel-preset-env": "^1.7.0",
    "babel-preset-stage-2": "^6.22.0",
    "babel-register": "^6.22.0",
    "chalk": "^2.4.1",
    "connect-history-api-fallback": "^1.5.0",
    "copy-webpack-plugin": "^4.5.2",
    "css-loader": "^0.28.11",
    "eslint": "^4.18.2",
    "eslint-config-standard": "^10.2.1",
    "eslint-friendly-formatter": "^3.0.0",

It’s a Vue.js blog demo Overall, it appears irrelevant