Skip to content
HackIndex logo

HackIndex

FTP Configuration File Loot

3 min read Mar 16, 2026

After gaining shell access to a host running an FTP service, the daemon configuration files reveal user credentials, virtual account databases, chroot paths, and service settings. These often contain plaintext or recoverable passwords and expose the structure of the FTP environment for further exploitation.

vsftpd Configuration

The main vsftpd config is at /etc/vsftpd.conf:

┌──(kali㉿kali)-[~]
└─$ cat /etc/vsftpd.conf

Key values to note:

  • anonymous_enable=YES confirms anonymous access is permitted

  • local_enable=YES means system accounts can authenticate

  • write_enable=YES confirms write access is globally allowed

  • chroot_local_user=YES means users are jailed to their home directories

  • pasv_min_port and pasv_max_port reveal the passive port range

  • ftpd_banner shows the configured banner string

Virtual user databases are defined separately. Check for PAM configuration:

┌──(kali㉿kali)-[~]
└─$ cat /etc/pam.d/vsftpd
┌──(kali㉿kali)-[~]
└─$ cat /etc/vsftpd/vsftpd.conf
┌──(kali㉿kali)-[~]
└─$ ls /etc/vsftpd/

Virtual user password files referenced in the config:

┌──(kali㉿kali)-[~]
└─$ cat /etc/vsftpd/virtual_users.txt

This file sometimes stores virtual FTP usernames and plaintext passwords in alternating lines.

ProFTPD Configuration

ProFTPD config is typically at /etc/proftpd/proftpd.conf or /etc/proftpd.conf:

┌──(kali㉿kali)-[~]
└─$ cat /etc/proftpd/proftpd.conf
┌──(kali㉿kali)-[~]
└─$ cat /etc/proftpd.conf

ProFTPD supports SQL authentication via mod_sql. The config will contain database credentials if SQL auth is configured:

<Module mod_sql.c>
  SQLBackend          mysql
  SQLConnectInfo      proftpd@@localhost root dbpassword
  SQLUserInfo         users username password uid gid homedir shell
</Module>

The database password and user are in plaintext. Connect directly to the database with these credentials.

Include files may split configuration across multiple files:

┌──(kali㉿kali)-[~]
└─$ grep -r "Include" /etc/proftpd/ 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ cat /etc/proftpd/conf.d/*.conf 2>/dev/null

FileZilla Server Configuration (Windows)

FileZilla Server stores its configuration in XML:

C:\Program Files\FileZilla Server\FileZilla Server.xml
C:\Program Files (x86)\FileZilla Server\FileZilla Server.xml
┌──(kali㉿kali)-[~]
└─$ cat "C:\Program Files\FileZilla Server\FileZilla Server.xml"

User accounts and their hashed or plaintext passwords are stored in this file. Older versions of FileZilla Server store passwords in MD5 or even plaintext depending on the version and configuration.

IIS FTP Configuration (Windows)

IIS FTP is configured through applicationHost.config:

C:\Windows\System32\inetsrv\config\applicationHost.config
C:\Users\Guest\Desktop> type C:\Windows\System32\inetsrv\config\applicationHost.config | findstr -i ftp

Virtual directory mappings and authentication settings are in this file.

FTP User Account Files

On Linux, FTP users may be system accounts listed in /etc/passwd:

┌──(kali㉿kali)-[~]
└─$ grep -v '/nologin\|/false' /etc/passwd | grep -v '^#'

Accounts with a valid login shell that also have FTP access are candidates for SSH login with the same credentials.

If the FTP daemon uses a separate user database:

┌──(kali㉿kali)-[~]
└─$ find /etc /var /opt -name "*ftpusers*" -o -name "*userlist*" -o -name "*virtual*users*" 2>/dev/null | xargs cat 2>/dev/null

FTP Root Path Discovery

Knowing the FTP root path confirms whether writable directories overlap with the web root:

┌──(kali㉿kali)-[~]
└─$ grep -i "DocumentRoot\|root\|home\|chroot" /etc/vsftpd.conf 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ grep -i "ServerRoot\|DefaultRoot\|DocumentRoot" /etc/proftpd.conf /etc/proftpd/proftpd.conf 2>/dev/null

Cross-reference the FTP root with web server configuration:

┌──(kali㉿kali)-[~]
└─$ grep -i "DocumentRoot" /etc/apache2/sites-enabled/*.conf 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ grep -i "root" /etc/nginx/sites-enabled/*.conf 2>/dev/null

A matching or overlapping path confirms the web shell upload path if write access existed.

References