Skip to content
HackIndex logo

HackIndex

FTP Writable Directory Check

3 min read Mar 29, 2026

A writable FTP directory becomes a critical finding when it overlaps with a path served by a web server. Uploading a file to /var/www/html/uploads over FTP and then requesting it over HTTP gives remote code execution without any vulnerability in the web application itself. This page confirms whether write access exists and identifies whether the writable path is web-accessible.

Check Write Permissions in the Listing

When connected to FTP, the directory listing shows permissions in Unix format:

┌──(kali㉿kali)-[~]
└─$ curl -s --user $USER:$PASSWORD ftp://$TARGET_IP:$PORT/ -l

Connect interactively and check permissions:

┌──(kali㉿kali)-[~]
└─$ ftp $TARGET_IP $PORT

Inside the session:

ftp > ls -la 
drwxrwxrwx    2 1000  1000  4096 Mar 10 09:00 uploads
drwxr-xr-x    3 0     0     4096 Mar 10 09:00 pub
-rw-r--r--    1 0     0      512 Mar 10 09:00 readme.txt

drwxrwxrwx means world-writable. drwxrwxr-x means group-writable. Both may permit upload depending on the FTP daemon configuration and which user it runs as.

Test Upload Directly

Create a test file and attempt to upload it to each directory:

┌──(kali㉿kali)-[~]
└─$ echo "writetest" > /tmp/writetest.txt
┌──(kali㉿kali)-[~]
└─$ curl -s --user $USER:$PASSWORD -T /tmp/writetest.txt ftp://$TARGET_IP:$PORT/uploads/writetest.txt

Confirm it landed:

┌──(kali㉿kali)-[~]
└─$ curl -s --user $USER:$PASSWORD ftp://$TARGET_IP:$PORT/uploads/

If writetest.txt appears in the listing, write access is confirmed. Clean it up after confirming:

┌──(kali㉿kali)-[~]
└─$ curl -s --user $USER:$PASSWORD -Q "DELE /uploads/writetest.txt" ftp://$TARGET_IP:$PORT/

Check for Web Root Overlap

The critical question after confirming write access is whether the writable path is also accessible over HTTP. Common paths to check:

┌──(kali㉿kali)-[~]
└─$ curl -s -o /dev/null -w "%{http_code}" http://$TARGET_IP/uploads/writetest.txt
┌──(kali㉿kali)-[~]
└─$ curl -s -o /dev/null -w "%{http_code}" http://$TARGET_IP/writetest.txt
┌──(kali㉿kali)-[~]
└─$ curl -s -o /dev/null -w "%{http_code}" http://$TARGET_IP/ftp/writetest.txt

A 200 response confirms the file is served by the web server. If you know the FTP root path from the banner or configuration disclosure, map it against likely web roots:

Common FTP roots that overlap with web directories:

  • /var/www/html/

  • /var/www/html/uploads/

  • /srv/ftp/

  • /home/USERNAME/public_html/

  • C:\inetpub\wwwroot\

  • C:\xampp\htdocs\

What Writable FTP Access Enables

A writable directory not served by a web server still enables staging files for later retrieval, uploading tools during post-exploitation, or overwriting configuration files if the path is sensitive.

A writable directory served by a web server enables web shell upload and direct remote code execution. The full exploitation workflow is in FTP Web Shell Upload.

References