Matteo Cantoni <goony@nothink.org>
Source-scoped identity with 16 associated PoCs and 25 linked vulnerabilities.
Exploit catalog results
Showing 16 PoCs on this page
MetasploitAnonymous FTP Access Detection
Metasploit auxiliary PoCby g0tmi1kAdded to Metasploit 2026-05-06ScannerCVE-1999-04971 file
Analysis
Technical assessment
This Metasploit auxiliary module detects whether an FTP server allows anonymous login and determines if the access is read-only or read/write. It does not exploit a vulnerability; it only checks for and reports the presence of anonymous FTP access.
Backdoor review
No backdoor observed in reviewed code
The module is a straightforward Metasploit auxiliary scanner that checks for anonymous FTP access. It performs only the documented actions: attempting an anonymous login, optionally testing write access by creating and removing a directory, optionally listing directory contents and storing them as loot, and reporting the result. No concealed executable behavior, unrelated payloads, credential exfiltration, persistence mechanisms, or deceptive instructions were observed.
Classification basis and observed behavior
Classification basis
The module's description states it 'Detect[s] anonymous (read/write) FTP service access.' Its code performs login checks, write-access tests, and reports findings without delivering a payload or gaining unauthorized access beyond the anonymous login itself. This is consistent with a scanner, not an exploit.
modules/auxiliary/scanner/ftp/ftp_anonymous.rb:16-17modules/auxiliary/scanner/ftp/ftp_anonymous.rb:42-97Requirements
- Network connectivity to an FTP server on the configured port (default 21).
modules/auxiliary/scanner/ftp/ftp_anonymous.rb:36
Observed behavior
- Attempts to connect and login to the target FTP server with anonymous credentials.
modules/auxiliary/scanner/ftp/ftp_anonymous.rb:43 - Tests write access by creating and then removing a randomly named directory.
modules/auxiliary/scanner/ftp/ftp_anonymous.rb:46-54 - Optionally retrieves and stores a directory listing as loot.
modules/auxiliary/scanner/ftp/ftp_anonymous.rb:61-72 - Reports the vulnerability 'Anonymous FTP Access' and registers the anonymous credentials.
modules/auxiliary/scanner/ftp/ftp_anonymous.rb:75-84
Behaviors behind the backdoor verdict
Observables
- Module Behavior
- Payload withheldThis is the documented purpose of the module and is consistent with normal auxiliary scanner functionality.
modules/auxiliary/scanner/ftp/ftp_anonymous.rb:42-57 - Module Behavior
- Payload withheldStoring loot is a standard Metasploit feature for evidence collection, not a backdoor.
modules/auxiliary/scanner/ftp/ftp_anonymous.rb:61-72 - Module Behavior
- Payload withheldStandard Metasploit reporting functions; no external exfiltration.
modules/auxiliary/scanner/ftp/ftp_anonymous.rb:75-84modules/auxiliary/scanner/ftp/ftp_anonymous.rb:99-133
What the analysis did not establish
- Analysis is based solely on the module source code and metadata; framework mixins and libraries (e.g., Msf::Exploit::Remote::Ftp) are not expanded, so the exact implementation of connect_login and send_cmd is not inspected.
- Review is limited to the module source code; Metasploit framework mixins (e.g., Msf::Exploit::Remote::Ftp, Msf::Auxiliary::Scanner) are not expanded, so their internal behavior is not inspected.
- Binary files were not present in the evidence.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.