Anonymous FTP

Anonymous FTP is an FTP service configuration that lets you log in with the user anonymous (or ftp) and any password (traditionally an email address). It dates from an era when it was used to distribute public files; today, on a target, it's a first-order enumeration point.

How to confirm it (attacker). nmap with its default scripts shouts it:

21/tcp open  ftp     Microsoft ftpd
| ftp-anon: Anonymous FTP login allowed (FTP code 230)

Code 230 is FTP's "User logged in": it confirms anonymous login works. From there, ftp <ip> with user anonymous and an empty password grants access.

What to look for. List the contents (dir/ls) and download whatever's there. Remember the binary command before pulling non-text files (images, executables): in ASCII mode they get corrupted.

ftp <ip>                                       # user: anonymous, empty pass; then ls / get / put / binary
netexec ftp <ip> -u anonymous -p ''            # confirm anonymous access
curl -s -u 'anonymous:' ftp://<ip>/ --list-only
wget -r --no-passive ftp://anonymous:x@<ip>/   # recursive download of everything
curl -T shell.aspx -u 'anonymous:' ftp://<ip>/ # upload a webshell if writable

The real risk is in write access and context. A read-only anonymous FTP with innocuous files is little more than noise. The danger appears when:

• It allows uploading files (put): an attacker drops content on the server.
• Its directory coincides with another service's root. That's Devel's case: the anonymous FTP wrote to the same directory IIS served. Uploading an .aspx webshell over FTP and requesting it over HTTP gave command execution. The trick was validating the hypothesis with an innocuous test.txt before uploading anything dangerous.

How to detect it. In the FTP server log, the signature is an anonymous/ftp login (code 230) from an external IP, and above all a STOR/PUT by an anonymous user uploading an executable (.aspx, .php, .jsp) to a directory that also serves another service. Confirmation is the creation of that file in the web root (FIM) followed by an HTTP request that runs it and the web process spawning a shell. An anonymous upload to a directory shared with the webroot is the critical pattern.

Defence. Disable anonymous access unless expressly needed; if kept, leave it read-only, with an isolated directory (never shared with the web root or executable paths) and no sensitive information. Encrypt the channel (FTPS/SFTP) and log accesses.