Note that FTP does­n’t show hid­den files! Try in Win­dows e.g “cd ProgramData”.

Enumeration

With nmap. Scans a net­work for ftp servers which allow anony­mous access.

nmap -v -p21 --script=ftp-anon.nse 10.11.1.1-254

FTP relays

The FTP spec­i­fi­ca­tion defines FTP relays. One FTP serv­er can say to anoth­er FTP serv­er to send files to anoth­er third-par­ty serv­er. See the nmap man­page for more details. Today it is most­ly not pos­si­ble to use, but some old sys­tems still have this feature.

See also FTP bounce attack to scan anoth­er sys­tem via a FTP serv­er as proxy. (Source)

Mirror FTP system

With wget

wget -m --no-passive ftp://anonymous:anonymous@$target

With lftp

lftp -u anonymous,dfsdf -e "mirror --parallel=2 --verbose / ." $target

FileZilla

If port 14147 is exposed, tun­nel it to local­host, then exe­cute FileZill Serv­er Interface.exe from the cor­rect ver­sion and con­nect to localhost.

Binary and ascii mode

• Bina­ry mode does­n’t change the file
• ASCII mode:
  • Removes ^M when a file is trans­ferred from a Win­dows host to a *nix host.
  • Adds ^M when a file is trans­ferred from a *nix host to a Win­dows host.