Skip to content
HackIndex logo

HackIndex

FTP Version Vulnerability Check

3 min read Jul 10, 2026

The FTP banner identifies the server software and version. Matching that version against known CVEs determines whether public exploits apply. This goes beyond the two commonly known backdoors and covers the broader vulnerability landscape across vsftpd, ProFTPD, FileZilla Server, and IIS FTP.

Pull the Banner and Version

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p $PORT $TARGET_IP 
21/tcp open  ftp  ProFTPD 1.3.5

For more detail from the service itself:

┌──(kali㉿kali)-[~]
└─$ nc -nv $TARGET_IP $PORT 
220 ProFTPD 1.3.5 Server (Debian) [::ffff:10.10.10.5]

The banner typically includes the daemon name and version. Some administrators suppress or modify banners, in which case -sV fingerprinting from nmap is more reliable.

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p $PORT --script banner $TARGET_IP

Match Version Against Known Vulnerabilities

Once you have the version string, check it against the following known vulnerable ranges.

vsftpd

  • 2.3.4 — backdoor allowing command execution via a crafted username. Covered in vsftpd 2.3.4 Backdoor Detection.

  • 2.0.x to 2.3.2 — denial of service via connection saturation in some builds. Not a code execution path.

  • 3.0.0 to 3.0.2 — no critical RCE CVEs, but check for misconfigurations such as writable root and anonymous access.

ProFTPD

  • 1.3.3c — backdoor embedded in a compromised source release. Covered in ProFTPD Backdoor Detection.

  • 1.3.5 — SQL injection in the mod_sql module when SQL authentication is configured (CVE-2015-3306 allows arbitrary file read and write). This is a significant exploitation path covered separately.

  • 1.3.6 and earlier — mod_copy module enabled by default allows unauthenticated file copy between paths on the server using the SITE CPFR and SITE CPTO commands.

Check whether mod_copy is active:

┌──(kali㉿kali)-[~]
└─$ nc -nv $TARGET_IP $PORT
┌──(kali㉿kali)-[~]
└─$ SITE CPFR /etc/passwd

A 350 File or directory exists, ready for destination name response confirms mod_copy is active and the module is exploitable for file read. Exploitation is covered in ProFTPD mod_copy Exploitation.

FileZilla Server (Windows)

  • 0.9.4 and earlier — clear text password storage in XML config file accessible to local users.

  • FileZilla Server 0.9.x — no authentication on the admin interface by default on older installs.

IIS FTP (Windows)

  • IIS 6.0 FTP — buffer overflow in the NLST command (CVE-2009-3555 variant for FTP, MS09-053). Extremely old and unlikely to appear.

  • IIS 7.0 to 7.5 — FTP service crashes on certain AUTH TLS sequences in some patch levels.

Nmap Vulnerability Scripts

Run all FTP-relevant NSE scripts at once:

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p $PORT --script "ftp-*" $TARGET_IP

This runs banner grabbing, anonymous access checking, backdoor detection for vsftpd and ProFTPD, and the brute-force check. Review each script's output independently.

Cross-Reference with searchsploit

Once you have the version string:

┌──(kali㉿kali)-[~]
└─$ searchsploit vsftpd 3.0.3
┌──(kali㉿kali)-[~]
└─$ searchsploit proftpd 1.3.5
┌──(kali㉿kali)-[~]
└─$ searchsploit filezilla server

Filter to remote exploits only:

┌──(kali㉿kali)-[~]
└─$ searchsploit -t ftp --exclude="local|dos|webapps" proftpd

The version string format in searchsploit may differ slightly from banner output. Try partial version numbers if the full string returns no results.

References