FTP hacking...

I am learning about network security on my home network and noticed my FTP port was open. When I open up a web browser or ftp client it show that I am connected but no files or directories show up. Why? I also opened up a command prompt (I run win2k) and ftped my pc and once again connection but nothing shows up. Am I voulnerable to attacks? Obviously my directories dont show up but can some one put a backdoor on my system like this? And if someone did upload to this connection where would I find the files?

When you connect via command prompt, you should see the name of the FTP server. Copy the name and paste it into search on your machine and the file's for it should come up.

Just as a precaution, I would recommend you update your Virus and spyware cleaners, and run them in safe mode (F8 at startup). You may have a virus, and if there is an active FTP on your computer, you might turn into a warez server.

Last thing you want is a angry phone call from your ISP.

Also check out TCPview and Fport from foundstone to see what process is holding the FTP server open.

The fact that you do not see any files is not important. If, however, the FTP is the result of something else, you still have to be worried about directory traversal exploits which could give somebody access to any folder on your computer [provided they know the specific weakness].

To me, this simply sounds like IIS is running in its default config. How about really protecting yourself and disable the service. Then you wont have to worry about any of the nastys mentioned above.

--TH13

You can try to use firewall to block incoming packets to the port 21

How would someone be able to gain access to all directories through an ftp port and if someone was to upload to the anonymous ftp I found on my home server where would I find those files?

Quote:

---

How would someone be able to gain access to all directories through an ftp port

---

An FTP exploit.

FTP isn't really my bag, but do a search on your computer for all files created on a specific date, then organize them by time created. you should easily be able to pick the ones that you didn't put there.

I dunno what you mean by "all directories" however they can get to the file/image directories of your website if that's where they are stored (on your server of course). Now how would they gain access? Well, if you have a weak password, then they can login by guessing the password or looking up an ftpd exploit online (which isn't really hard).

if you installed iis then maybe the ftp server is running but i dont remember it running by default but i know telnet server was in the first releases. you say when you ftped into it you saw nothing...didn't it have a banner if it said: 220 ftp Microsoft FTP Service (Version 5.0) then just turn of the services. go to the run box and enter services.msc double click ftp server and stop and disable it. the default dir is ftproot. if it says anything other than ms ftp then you got a problem.

Earlier releases had a telnet server? Wow, what for? LMAO. And tedob, if it say's anything else then he just has a different kind of ftp server running, right? Of course it could be something malicious like one of those trojan ftp program's, but that's thinking the worst right now.

Quote:

---

if someone was to upload to the anonymous ftp I found on my home server where would I find those files?

---

%System Root%\inetpub\ftproot

This, of course, can be changed to anything you like.

systeminternal's TCPview is a good tool for dealing with worm infections since it gives you the possibility of closeing connections on the fly and also get a look into what is acctualy doing what.

Quote:

---

Originally posted here by Spyder32
Earlier releases had a telnet server? Wow, what for?

---

For the same purpose all security flaws are implemented :)

[well I guess for admins but... wow! well said]

And if it's a trojan you can bet it has a modified banner. But if it's a service from IIS then maybe you'll be able to see what's there.

Quote:

---

For the same purpose all security flaws are implemented

---

No, but I'm saying what purpose would a telnet server have on a IIS application? Considering IIS server's are run on M$ system's and telnet server's are generally ran on *nix machine's. And considering there's no point to have a telnet server on a webserver application.

Tedob1, he could be in trouble even if it says ms ftp or whatever the ms ftp server says. There's no reason that someone creating a back door wouldn't try to disguise the backdoor as a ms ftp server. If someone is worried that they might have some "malicious service" running, they cannot ever trust the banner...they really have to use some other tool to figure out what's happening.

ac

I noticed that many of my files have been modified in my c:/ directories. How the hell is this possible. What is a possible attack method? I have now closed port 21. What others should I close? and if there are multiple backdoors what should I be looking for?

another good util for this kind of problem is: Active Ports

Active Ports 1.4 - easy to use tool that enables
you to monitor all open TCP/IP and UDP ports on
the local computer. Active Ports maps ports to
the owning application so you can watch which
process has opened which port. It also displays
a local and remote IP address for each connection
and allows you to terminate the owning process.
Active Ports can help you to detect trojans and
other malicious programs. Freeware

nephewb: If your worried about a trojan or other backdoor application's running on your system then download a trusty trojan scanner and scan your file's. One that I prefer is SwatIt from http://www.swatit.org It work's really well and although it take's some time, it is only because of it's thoroughness and effectiveness.

Quote:

---

Originally posted here by gothic_type
Tedob1, he could be in trouble even if it says ms ftp or whatever the ms ftp server says. There's no reason that someone creating a back door wouldn't try to disguise the backdoor as a ms ftp server. If someone is worried that they might have some "malicious service" running, they cannot ever trust the banner...they really have to use some other tool to figure out what's happening.

ac

---

those that install back doors like to keep them hidden from others not just the owner of the box. too many people scan port 21, not that its impossible imo its just not likely
if he couldn't turn off the service in the usual places that would be a give away. like in the web services mmc. back door ftp servers are small, usually dont have a banner and arn't used for an extented period. the ones you can change the header in like serve-u are usually installed on an off port and the people that use them like to advertise their group and not ms