# FTP Version Vulnerability Check

> Identifies FTP server versions with known CVEs by banner grabbing and cross-referencing against vulnerability databases to detect unpatched or outdated daemons.

- **URL:** https://hackindex.io/services/ftp/vulnerability-discovery/ftp-version-vulnerability-check
- **Path:** FTP > Vulnerability Discovery
- **Up:** [Vulnerability Discovery](https://hackindex.io/services/ftp/vulnerability-discovery.md)
- **Published:** 2026-03-16
- **Updated:** 2026-07-10

The FTP banner identifies the server software and version. Matching that version against known CVEs determines whether public exploits apply. This goes beyond the two commonly known backdoors and covers the broader vulnerability landscape across vsftpd, ProFTPD, FileZilla Server, and IIS FTP.

## Pull the Banner and Version

```bash
nmap -sV -p $PORT $TARGET_IP
# 21/tcp open  ftp  ProFTPD 1.3.5
#
```

For more detail from the service itself:

```bash
nc -nv $TARGET_IP $PORT
# 220 ProFTPD 1.3.5 Server (Debian) [::ffff:10.10.10.5]
```

The banner typically includes the daemon name and version. Some administrators suppress or modify banners, in which case `-sV` fingerprinting from nmap is more reliable.

```bash
nmap -sV -p $PORT --script banner $TARGET_IP
```

## Match Version Against Known Vulnerabilities

Once you have the version string, check it against the following known vulnerable ranges.

### vsftpd

- **2.3.4**: backdoor allowing command execution via a crafted username. Covered in [vsftpd 2.3.4 Backdoor Detection](https://hackindex.io/services/ftp/vulnerability-discovery/vsftpd-backdoor-detection).
- **2.0.x to 2.3.2**: denial of service via connection saturation in some builds. Not a code execution path.
- **3.0.0 to 3.0.2**: no critical RCE CVEs, but check for misconfigurations such as writable root and anonymous access.

### ProFTPD

- **1.3.3c**: backdoor embedded in a compromised source release. Covered in [ProFTPD Backdoor Detection](https://hackindex.io/services/ftp/vulnerability-discovery/proftpd-backdoor-detection).
- **1.3.5 (CVE-2015-3306)**: `mod_copy` module allows unauthenticated arbitrary file read and write via the `SITE CPFR` and `SITE CPTO` commands.
- **1.3.6 and earlier**: same `mod_copy` SITE CPFR/CPTO exposure when the module is enabled.

Check whether `mod_copy` is active:

```bash
nc -nv $TARGET_IP $PORT
SITE CPFR /etc/passwd
```

A `350 File or directory exists, ready for destination name` response confirms `mod_copy` is active and the module is exploitable for file read. Exploitation is covered in [ProFTPD 1.3.3c Exploitation](https://hackindex.io/services/ftp/exploitation/proftpd-133c).

### FileZilla Server (Windows)

- **0.9.4 and earlier**: clear text password storage in XML config file accessible to local users.
- **FileZilla Server 0.9.x**: no authentication on the admin interface by default on older installs.

### IIS FTP (Windows)

- **IIS 6.0 FTP**: buffer overflow in the NLST command (CVE-2009-3023, MS09-053). Extremely old and unlikely to appear.
- **IIS 7.0 to 7.5**: FTP service crashes on certain AUTH TLS sequences in some patch levels.

## Nmap Vulnerability Scripts

Run all FTP-relevant NSE scripts at once:

```bash
nmap -sV -p $PORT --script "ftp-*" $TARGET_IP
```

This runs banner grabbing, anonymous access checking, backdoor detection for vsftpd and ProFTPD, and the brute-force check. Review each script's output independently.

## Cross-Reference with searchsploit

Once you have the version string:

```bash
searchsploit vsftpd 3.0.3
searchsploit proftpd 1.3.5
searchsploit filezilla server
```

Filter to remote exploits only:

```bash
searchsploit -t ftp --exclude="local|dos|webapps" proftpd
```

The version string format in searchsploit may differ slightly from banner output. Try partial version numbers if the full string returns no results.

## References

- [banner NSE Script](https://nmap.org/nsedoc/scripts/banner.html) - Grabs the service banner from any TCP service including FTP
- [Exploit Database](https://exploit-db.com) - Searchable database of public exploits indexed by software and version
- [CVE Details: vsftpd](https://www.cvedetails.com/product/368/Vsftpd-Vsftpd.html) - Full CVE history for vsftpd across all versions
- [CVE Details: ProFTPD](https://www.cvedetails.com/product/762/Proftpd-Proftpd.html) - Full CVE history for ProFTPD across all versions