How to use the command 'nxc ftp' (with examples)

The nxc ftp command is a powerful tool designed for penetration testing and exploiting FTP (File Transfer Protocol) servers. It provides security professionals and curious users the ability to evaluate the security of FTP servers by testing various credentials, accessing directories, downloading, and uploading files. This makes it an indispensable resource when conducting security assessments, attaching to remote servers, and verifying the integrity of systems that use the FTP protocol.

Use case 1: Search for valid credentials by trying out every combination in the specified lists of usernames and passwords

Code:

nxc ftp 192.168.178.2 -u path/to/usernames.txt -p path/to/passwords.txt

Motivation:

In penetration testing, finding valid login credentials is often the first step in assessing a system’s security. This command helps by systematically trying every combination of usernames and passwords provided in the specified text files. This brute-force method, while time-consuming, can reveal weak credentials that could allow unauthorized access.

Explanation:

• nxc ftp 192.168.178.2: Specifies the command and the target FTP server’s IP address.
• -u path/to/usernames.txt: Specifies the path to the text file containing possible usernames.
• -p path/to/passwords.txt: Specifies the path to the text file containing possible passwords.

Example Output:

Trying combination: user1/password1
Invalid credentials
Trying combination: user2/password2
Valid credentials found - Username: 'user2' Password: 'password2'

Use case 2: Continue searching for valid credentials even after valid credentials have been found

Code:

nxc ftp 192.168.178.2 -u path/to/usernames.txt -p path/to/passwords.txt --continue-on-success

Motivation:

Sometimes it is important to uncover all valid credentials, not just the first successful one. This could reveal shared accounts, multiple vulnerabilities, or provide a fuller picture of the system’s access points. By continuing to search after a successful combination is found, more comprehensive information is obtained, facilitating a deeper security insight.

Explanation:

• nxc ftp 192.168.178.2: The target FTP server’s IP address.
• -u path/to/usernames.txt: Specifies the usernames file.
• -p path/to/passwords.txt: Specifies the passwords file.
• --continue-on-success: Directs the command to keep trying combinations even after finding a valid one.

Example Output:

Trying combination: admin/admin123
Valid credentials found - Username: 'admin' Password: 'admin123'
Continuing search...
Trying combination: user2/user2pass
Valid credentials found - Username: 'user2' Password: 'user2pass'

Use case 3: Perform directory listings on each FTP server the supplied credentials are valid on

Code:

nxc ftp 192.168.178.0/24 -u username -p password --ls

Motivation:

Generating a directory listing can reveal what files and directories are present, and their permissions, sizes, and modification dates. This is useful for auditing purposes and to assess what sensitive data might be exposed on the server.

Explanation:

• nxc ftp 192.168.178.0/24: Targets all FTP servers in the specified subnet range.
• -u username: Uses the supplied username for login.
• -p password: Uses the supplied password.
• --ls: Instructs the command to perform a directory listing on the servers.

Example Output:

192.168.178.1:
drwxr-xr-x  2 root root 4096 Sep 12 10:00 public_html
-rw-r--r--  1 root root 1234 Sep 12 10:00 index.html

192.168.178.2:
drwxr-xr-x  2 user user 4096 Sep 13 09:15 documents
-rw-r--r--  1 user user 4321 Sep 13 09:15 notes.txt

Use case 4: Download the specified file from the target server

Code:

nxc ftp 192.168.178.2 -u username -p password --get path/to/file

Motivation:

Downloading files from a server is an essential part of managing data, facilitating analysis, or verifying its contents. This ability is critical for verifying file integrity, obtaining necessary data for further investigations, and for backup purposes.

Explanation:

• nxc ftp 192.168.178.2: The IP address of the target server.
• -u username: Authenticates with the specified username.
• -p password: Uses the specified password for authentication.
• --get path/to/file: Indicates the file path to download from the server.

Example Output:

Connecting to 192.168.178.2
Successfully logged in
Downloading file: path/to/file
Download complete: /local/path/to/file

Use case 5: Upload the specified file to the target server at the specified location

Code:

nxc ftp 192.168.178.2 -u username -p password --put path/to/local_file path/to/remote_location

Motivation:

Uploading files to an FTP server is crucial for deploying updates, sharing data, or managing remote content. This command enables the transfer of files from a local machine to a remote server, ensuring that files are accessible and up-to-date.

Explanation:

• nxc ftp 192.168.178.2: Identifies the target FTP server’s IP.
• -u username: The username for logging into the server.
• -p password: Corresponding password for login.
• --put path/to/local_file path/to/remote_location: Specifies the local file to upload and its target destination on the server.

Example Output:

Connecting to 192.168.178.2
Successfully logged in
Uploading file: path/to/local_file to path/to/remote_location
Upload complete

Conclusion:

The nxc ftp command is versatile, offering a suite of tools for auditing and managing FTP servers. Whether performing security assessments, managing files, or investigating system vulnerabilities, its array of options provide the flexibility and functionality required for a variety of tasks. Be it identifying weak credentials, accessing files, or managing data, nxc ftp delivers a robust set of features to enhance FTP interactions effectively.