Re: Listing hide files via ftp


On 15-Mar-07, at 1:35 AM, carlopmart wrote:
carlopmart {at} gmail {d0t} com
Are you doing this from the server administration side, or logged into an ftp server?
I am doing this logged into a ftp server


Ah, you are looking to see a listing of hidden files or regular files that your user isn't permitted to see? In that case you are actually looking for an exploit for the ftp server, the server itself, or to exploit a user account that has elevated permissions.




Details:



[carlos@nazgul iso-images]$ ftp ftp.server.com
Connected to ftp.server.com (1.1.1.1).
220 ACME Technologies Inc.
Name (ftp.server.com:carlos): anonymous
331 Anonymous login ok, send your complete email address as your password.
Password:
230 Anonymous access granted, restrictions apply.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls -la
227 Entering Passive Mode (1,1,1,1,209,98)
150 Opening ASCII mode data connection for file list
drwxr-xr-x 5 root root 4096 Dec 28 19:38 .
drwxr-xr-x 5 root root 4096 Dec 28 19:38 ..
-rw-r--r-- 1 sgreen sgreen 304 Feb 15 22:13 .bash_logout
-rw-r--r-- 1 sgreen sgreen 191 Feb 15 22:13 .bash_profile
-rw-r--r-- 1 sgreen sgreen 124 Feb 15 22:13 .bashrc
-rw-r--r-- 1 sgreen sgreen 383 Feb 15 22:13 .emacs
-rw-r--r-- 1 sgreen sgreen 120 Feb 15 22:13 .gtkrc
drwxr-xr-x 3 sgreen sgreen 4096 Jun 20 2006 .kde
-rw-r--r-- 1 sgreen sgreen 658 Feb 15 22:13 .zshrc
drwxrwx-wt 267 ftp ftp 12288 Mar 14 21:15 download
lrwxrwxrwx 1 ftp ftp 8 Jun 14 2006 pub -> download
drwxrwx-wx 205 support support 77824 Mar 15 06:30 upload
226 Transfer complete.
ftp> cd download
250 CWD command successful
ftp> ls -la
227 Entering Passive Mode (216,228,148,15,223,76)
150 Opening ASCII mode data connection for file list
226 Transfer complete.
ftp> ls -Al
227 Entering Passive Mode (216,228,148,15,224,175)
150 Opening ASCII mode data connection for file list
226 Transfer complete.
ftp>

As you can see on this screen, I can list root directories but not contents on subdirectories, but on this subdirectories exists files ...


Cheers,
Tremaine Lea
Network Security Consultant



Actually what I see is that you can see both directories and hidden files. The files that begin with a dot are normally hidden from view when doing a directory listing. What this means in this particular case is that either you don't have permission to see files/ directories of that type in the download directory, or that no such files exist there for you to see.

Tremaine

------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.

http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------

Relevant Pages

  • Re: Listing hide files via ftp
    ... On Mar 11, 2007, at 6:01 AM, carlopmart wrote: ... Are you doing this from the server administration side, or logged into an ftp server? ... 150 Opening ASCII mode data connection for file list ... 227 Entering Passive Mode ...
    (Pen-Test)
  • Re: Microsoft FTP Server problem on W2K?
    ... It is a UNISYS ClearPath mainframe system that is trying to FTP using ... passive mode to a MS FTP server. ... Currently the mainframe FTPs in ACTIVE mode. ... Since the mainframe pushes files to our customers over a WAN connection, ...
    (microsoft.public.inetserver.iis.security)
  • RE: FTP Upload
    ... FTP server to the following specified size. ... //set or get the remote path of the FTP server that you want to connect. ... //set the class MessageString. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: FTP Upload
    ... FTP server to the following specified size. ... //set or get the remote path of the FTP server that you want to connect. ... //set the class MessageString. ...
    (microsoft.public.dotnet.framework.aspnet)
  • RE: vsftpd beginners tutorial?
    ... # This file was created to illustrate the steps needed to create a new FTP ... Why vsftpd as this FTP Server? ... System software customization considerations. ... User and Group Configuration ...
    (RedHat)