1. Module 23 (ftp and wireshark)
Ate the end of this module, you should know most everything about ftp one might need to know. In addition, you should know how to use wireshark to sniff on ftp sessions, extract passwords, and identify files that have been transferred.
Module 23

2. First the Dull ftp RFC Part
Protocol supports copying a file from one internet host to another.
Defined by several related IETF RFCs: RFC 114, RFC 133, RFC 141, RFC 171, RFC 172
Traditionally, ftp uses two TCP ports:
21 for control commands
20 for data transfer
Hosts may choose to perform data transfer to a dynamically assigned port.
Operates in either active or passive mode
Module 23

3. Active vs. Passive Mode
In active mode, by default, the client initiates the control session on port 21 and leaves port 20 open for the server to send data. The server initiates the connection for port 20.
If the client is behind a firewall, or NAT, then the server may be unable to connect back to the client to send data.
If passive mode is selected, then the server gives the client a port to initiate a connection to for data transfer.
Browsers typically use passive mode for ftp protocol connections (so they'll work when the client is behind a firewall).
Module 23

4. Initiating an ftp connection
Initiating an ftp connection $ ftp ftp.cise.ufl.edu Connected to ftp.cise.ufl.edu UF CISE Anonymous Server (ftp0) Name (ftp.cise.ufl.edu:jnw): ftp 331 Anonymous login ok, send your complete address as your password Password: 230 Anonymous access granted, restrictions apply Remote system type is UNIX. Using binary mode to transfer files.
If anonymous login is chosen username is ftp or anonymous
By convention, on anonymous login, you specify your address. If you are connecting from a machine where you receive you can type leaving off the domain name.
Module 23

5. Important ftp client commands
ftp> help binary binary set binary transfer type
ftp> help cd cd change remote working directory
ftp> help lcd lcd change local working directory
ftp> help get get receive file
ftp> help mget mget get multiple files
ftp> help passive passive enter passive transfer mode
ftp> help ls ls list contents of remote directory
Module 23

6. ftp API Commands
The subcommands are those discussed in the RFC. They can be issued by an ftp client by prefixing the RFC API command with the client command quote.
ftp> quote help 214-The following commands are recognized (* =>'s unimplemented): CWD XCWD CDUP XCUP SMNT* QUIT PORT PASV EPRT EPSV ALLO* RNFR RNTO DELE MDTM RMD XRMD MKD XMKD PWD XPWD SIZE SYST HELP NOOP FEAT OPTS AUTH* CCC* CONF* ENC* MIC* PBSZ* PROT* TYPE STRU MODE RETR STOR STOU APPE REST ABOR USER PASS ACCT* REIN* LIST NLST STAT SITE MLSD MLST
ftp> quote help port
214 Syntax: PORT <sp> h1,h2,h3,h4,p1,p2
Module 23

7. Let's Look at an ftp Session
Get your kali VM running in NAT mode.
Execute wireshark at a terminal command prompt
Select menu entry Capture->Interfaces
Select eth0 in the Capture Interfaces popup.
Then press the Start button in the Capture Interfaces popup.
Wireshark is now capturing packets
Module 23

8. Wireshark: Capture->Interfaces
Module 23

9. Wireshark: Set interface to sniff
Module 23

10. Back to your ftp session
In a terminal on kali, execute an ftp session
ftp to cise.ufl.edu
Log in as ftp
Give your as the password
Set passive mode (because you are NATted)
Execute an ls command to list the directory contents
Do a get on the file welcome.msg
Quit ftp
Go back to your Wireshark Window and Stop the capture
Module 23

11. Wireshark: Stop the Transfer (Red X)
Module 23

12. Inspecting the Packets in Wireshark
To filter (downselect) the packets to just those going to the ftp port, type ftp in the Filter: window (it will turn green)
Things to notice:
The user (ftp) and password were passed in plain text.
The commands that travelled across the network were API commands (USER, PASS)
Module 23

13. Wireshark: ftp packets
Module 23

14. ftp Passive Mode
When the passive command is issued, passive mode is entered in the client. No packets are transferred.
When we then issue and ls command, a passive transfer ensues as follows:
Client issues PASV command
Server responds with a port number (130,230) = 130* = 33510
Client issues LIST command
Client connects to specified port to get transferred data
We can filter for ftp-data to see these packets
Module 23

15. Wireshark: Passive Mode
Module 23

16. Wireshark: ftp-data (Transfer on port 33510)
Module 23