Module 23 (ftp and wireshark) Ate the end of this module, you should know most everything about ftp one might need to know. In addition, you should know how to use wireshark to sniff on ftp sessions, extract passwords, and identify files that have been transferred. Module 23

First the Dull ftp RFC Part Protocol supports copying a file from one internet host to another. Defined by several related IETF RFCs: RFC 114, RFC 133, RFC 141, RFC 171, RFC 172 Traditionally, ftp uses two TCP ports: 21 for control commands 20 for data transfer Hosts may choose to perform data transfer to a dynamically assigned port. Operates in either active or passive mode Module 23

Active vs. Passive Mode In active mode, by default, the client initiates the control session on port 21 and leaves port 20 open for the server to send data. The server initiates the connection for port 20. If the client is behind a firewall, or NAT, then the server may be unable to connect back to the client to send data. If passive mode is selected, then the server gives the client a port to initiate a connection to for data transfer. Browsers typically use passive mode for ftp protocol connections (so they'll work when the client is behind a firewall). Module 23

Initiating an ftp connection Initiating an ftp connection $ ftp ftp.cise.ufl.edu Connected to ftp.cise.ufl.edu. 220 UF CISE Anonymous Server (ftp0) Name (ftp.cise.ufl.edu:jnw): ftp 331 Anonymous login ok, send your complete email address as your password Password: 230 Anonymous access granted, restrictions apply Remote system type is UNIX. Using binary mode to transfer files. If anonymous login is chosen username is ftp or anonymous By convention, on anonymous login, you specify your email address. If you are connecting from a machine where you receive email you can type username@ leaving off the domain name. Module 23

Important ftp client commands ftp> help binary binary set binary transfer type ftp> help cd cd change remote working directory ftp> help lcd lcd change local working directory ftp> help get get receive file ftp> help mget mget get multiple files ftp> help passive passive enter passive transfer mode ftp> help ls ls list contents of remote directory Module 23

ftp API Commands The subcommands are those discussed in the RFC. They can be issued by an ftp client by prefixing the RFC API command with the client command quote. ftp> quote help 214-The following commands are recognized (* =>'s unimplemented): CWD XCWD CDUP XCUP SMNT* QUIT PORT PASV EPRT EPSV ALLO* RNFR RNTO DELE MDTM RMD XRMD MKD XMKD PWD XPWD SIZE SYST HELP NOOP FEAT OPTS AUTH* CCC* CONF* ENC* MIC* PBSZ* PROT* TYPE STRU MODE RETR STOR STOU APPE REST ABOR USER PASS ACCT* REIN* LIST NLST STAT SITE MLSD MLST ftp> quote help port 214 Syntax: PORT <sp> h1,h2,h3,h4,p1,p2 Module 23

Let's Look at an ftp Session Get your kali VM running in NAT mode. Execute wireshark at a terminal command prompt Select menu entry Capture->Interfaces Select eth0 in the Capture Interfaces popup. Then press the Start button in the Capture Interfaces popup. Wireshark is now capturing packets Module 23

Wireshark: Capture->Interfaces Module 23

Wireshark: Set interface to sniff Module 23

Back to your ftp session In a terminal on kali, execute an ftp session ftp to cise.ufl.edu Log in as ftp Give your email_address@ as the password Set passive mode (because you are NATted) Execute an ls command to list the directory contents Do a get on the file welcome.msg Quit ftp Go back to your Wireshark Window and Stop the capture Module 23

Wireshark: Stop the Transfer (Red X) Module 23

Inspecting the Packets in Wireshark To filter (downselect) the packets to just those going to the ftp port, type ftp in the Filter: window (it will turn green) Things to notice: The user (ftp) and password (jnw@) were passed in plain text. The commands that travelled across the network were API commands (USER, PASS) Module 23

Wireshark: ftp packets Module 23

ftp Passive Mode When the passive command is issued, passive mode is entered in the client. No packets are transferred. When we then issue and ls command, a passive transfer ensues as follows: Client issues PASV command Server responds with a port number (130,230) = 130*256+230 = 33510 Client issues LIST command Client connects to specified port to get transferred data We can filter for ftp-data to see these packets Module 23

Wireshark: Passive Mode Module 23

Wireshark: ftp-data (Transfer on port 33510) Module 23