Lion Cipher Lab

Enumerate and exploit a weak FTP server in your own lab — anonymous access, writable roots, then lock it down

• Penetration Testing / Red Team
• Intermediate
• ~50 min
• Free · no account required

Why it matters

FTP is one of the oldest protocols still running on real networks -- RFC 959 dates to 1985 -- and it refuses to die because it is baked into legacy gear: printers, IP cameras, network-attached storage, backup jobs, industrial controllers, and forgotten Linux boxes. Two things make it a perennial finding on penetration tests. First, FTP is PLAINTEXT: usernames, passwords and file contents cross the wire unencrypted, so anyone who can sniff the network reads the credentials. Second, FTP has an 'anonymous' mode -- log in as the user `anonymous` (or `ftp`) with literally any string as the…

What you'll learn

• explaining what FTP is (RFC 959, a 1985 plaintext file-transfer protocol) and what anonymous FTP means -- logging in as the user `anonymous`/`ftp` with any string as the password, a feature meant for PUBLIC file distribution
• detecting anonymous FTP the way an assessor does: nmap -sV -p21 to confirm the service and version, then the ftp-anon NSE script to actively test whether anonymous login is allowed and print the top-level directory listing
• logging in anonymously with the plain `ftp` client, listing with `ls`, and downloading files with `get` -- reading what an exposed FTP root leaks (configs, backups, credentials left in files)
• understanding the ONE condition that turns a writable anonymous FTP directory into remote code execution: when that same directory is also served by a web server that will EXECUTE what lives there -- upload a script over FTP, request it over HTTP, get code execution
• being honest about that condition: without a writable-dir-maps-to-executable-webroot overlap, anonymous FTP is an information-disclosure and upload-abuse risk, NOT automatic RCE -- and saying which one you actually have in a report
• hardening a real FTP server: anonymous_enable=NO, anon_upload_enable=NO, chroot_local_user=YES, moving to FTPS or SFTP so credentials and data are encrypted, and never sharing an upload directory with an executable webroot
• re-measuring: re-running the nmap ftp-anon script after hardening and confirming anonymous login now FAILS -- the before/after that is the deliverable
• the judgment: why FTP still shows up in real assessments (legacy devices, printers, NAS boxes, backup jobs), why anonymous+writable is the classic finding, and how a pro triages it -- read-only anon = low, writable = check where it lands, plaintext creds = sniff risk
• the honest negatives: modern vsftpd ships with anonymous DISABLED so you had to turn it on, and plaintext FTP leaks credentials on the wire (the reason SFTP/FTPS exist)

Steps in this lab

1. First: this is your lab, and anonymous FTP is a real, common finding
2. The words you need: FTP, anonymous login, plaintext, and why it survives
3. Set up the target: install vsftpd and DELIBERATELY weaken it
4. Discover the service with nmap: version scan, then the ftp-anon script
5. Log in anonymously and read what the FTP root leaks
6. The escalation that matters: writable FTP + an executable webroot = RCE
7. Harden and re-measure: disable anonymous, jail users, move to FTPS/SFTP
8. The judgment: when FTP shows up, how a pro triages it, and the honest negatives

Open the full interactive lab →