FTP

Nmap discovered a FTP server on the target port 21 The running service is vsftpd 3.0.3

Null Session

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/reconstruction/ftp]
└─$ ftp $IP             
Connected to 192.168.209.103.
220 (vsFTPd 3.0.3)
Name (192.168.209.103:kali): ftp
331 Please specify the password.
Password: ftp
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp>

Null session established

ftp> put test 
local: test remote: test
229 Entering Extended Passive Mode (|||8866|)
550 Permission denied.

No write access

ftp> ls
229 Entering Extended Passive Mode (|||35995|)
150 Here comes the directory listing.
drwxr-xr-x    2 0        0            4096 Apr 29  2020 WebSOC
-rw-r--r--    1 0        0             137 Apr 29  2020 note.txt
226 Directory send OK.

note.txt

ftp> get note.txt
local: note.txt remote: note.txt
229 Entering Extended Passive Mode (|||30354|)
150 Opening BINARY mode data connection for note.txt (137 bytes).
100% |*******************************************************************************************|   137        2.77 MiB/s    00:00 ETA
226 Transfer complete.
137 bytes received in 00:00 (5.59 KiB/s)
 
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/reconstruction/ftp]
└─$ cat note.txt        
I've just setup the new WebSOC! This should hopefully help us catch these filthy hackers!
 
 
TODO: remove leftover passwords from testing

Mention of the WebSOC directory leftover passwords from testing

WebSOC

ftp> cd WebSOC
250 Directory successfully changed.
ftp> ls
229 Entering Extended Passive Mode (|||20560|)
150 Here comes the directory listing.
-rw-r--r--    1 0        0         3086771 Apr 29  2020 1.05.2020.pcap
-rw-r--r--    1 0        0          869677 Apr 29  2020 29.04.2020.pcap
-rw-r--r--    1 0        0        14579662 Apr 29  2020 30.04.2020.pcap
226 Directory send OK.
 
ftp> get 1.05.2020.pcap
local: 1.05.2020.pcap remote: 1.05.2020.pcap
229 Entering Extended Passive Mode (|||28906|)
150 Opening BINARY mode data connection for 1.05.2020.pcap (3086771 bytes).
  0% |                                                                                           |     0        0.00 KiB/s    --:-- ETAg100% |*******************************************************************************************|  3014 KiB    3.96 MiB/s    00:00 ETA
226 Transfer complete.
3086771 bytes received in 00:00 (3.86 MiB/s)
 
ftp> get 29.04.2020.pcap
local: 29.04.2020.pcap remote: 29.04.2020.pcap
229 Entering Extended Passive Mode (|||10216|)
150 Opening BINARY mode data connection for 29.04.2020.pcap (869677 bytes).
100% |*******************************************************************************************|   849 KiB    2.91 MiB/s    00:00 ETA
226 Transfer complete.
869677 bytes received in 00:00 (2.72 MiB/s)
ftp> get 30.04.2020.pcap
local: 30.04.2020.pcap remote: 30.04.2020.pcap
229 Entering Extended Passive Mode (|||26782|)
150 Opening BINARY mode data connection for 30.04.2020.pcap (14579662 bytes).
100% |*******************************************************************************************| 14237 KiB    4.65 MiB/s    00:00 ETA
226 Transfer complete.
14579662 bytes received in 00:03 (4.62 MiB/s)