3

I want to write a python script that is able to fingerprint ports on a server to identify the FTP client running on the port.

While there is often a Banner message upon connection, this message is not reliable or can be removed easily.

Is there any tool / database etc available which can help to identify the different clients by behavior? e.g. by digging through source code i noticed that the PyFTPd Server uses the message "I'm going to ignore this command..." which can be used to identify that service.

I am happy for any help, as many FTP commands are supported and included in all daemons so it is difficult to find all the differences... I am trying to distinguish between

vsftpd
pureftpd
proftpd
pyftpd
1
  • I would suggest to use nmap or zmap
    – Cyberduck
    Commented Nov 19, 2019 at 22:51

2 Answers 2

2

Update: ftpmap does what you are looking for. It can differentiate between a various versions per server, but the last update seems to have been around 2010, based on the latest pureftpd version it knows being from 2010.

It works by sending various commands to the target server, the text it responds with is crudely "checksummed", and this results in a set of numbers that it tries to look up in a list to find the software and, if possible, also which exploit applies to the version. This mechanism isn't very versatile and small differences will cause random changes. More stable and versatile (but also more work) would have been to look for keywords, or key omissions, in response strings.


FileZilla versions until 1.4.0-rc1 (2022-04-20) returned 220 instead of 221 on QUIT, ref. https://filezilla-project.org/versions.php?type=server
When you QUIT, it just says "Goodbye" with nothing else, ref. https://github.com/zedfoxus/filezilla-server/blob/856ec4678c53132788da9d2802f37d1c6a0d2691/source/ControlSocket.cpp#L564

Pure-FTPD shows data volume statistics on QUIT, ref. https://github.com/jedisct1/pure-ftpd/blob/adb5f40a2b74496c63fd3495a1c0379981404cec/src/messages_en.h#L16 and the "Please tell me who you are" response to a bare PASS command might also be quite unique (same file, line 47).

There are probably more such telltales. If you want to build a scanner for this, you will need to look at different FTP servers (you already named a few) and just try out various commands, particularly ones that work without login such as HELP, AUTH, STARTTLS, USER, PASS, and QUIT. This command may be helpful to see the raw responses:

$ nc -vC <ip> 21
220-Hello, I am a custom banner
220 The dash after 220 means there will be another response line
PASS
530 Please tell me who you are
QUIT
221-Goodbye. You uploaded 0 and downloaded 0 kbytes.
221 Logout.

The -C flag turns newlines into \r\n (aka CRLF) which is the required line ending.

The Nmap suggestion from Cyberduck and DoubleD is not bad either, though Nmap usually does more basic matching even with service probes. Maybe you can contribute more probes for Nmap to try, since a lot of people will run that tool and, thus, be able to make use of your contribution without having to search for and download your custom software.

Trying the current version of Nmap on a server that responds as above, it will take its sweet time trying out various probes (it ignores --max-rtt-timeout and casually wait 10 seconds between every probe), then tells nothing more than the banner basically.

1

The standard tool on Kali is nmap, specifically with the -sV or -A option.

If that doesn't detect your application or version properly, you can contact the developers.

You may be able to dig through the nmap source code to figure out how their detection works, but consider yourself warned: detection routines almost always includes a massive pile of regular expressions to puzzle through.

I've found nmap to be fairly reliable, but we don't run any of the daemons you've listed so I don't know if it can detect those.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .