Anonymous FTP Access Detection

MetasploitMetasploit auxiliary PoCScannerRubyauxiliary_scanner/ftp/ftp_anonymous

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Metasploit
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

This Metasploit auxiliary module detects whether an FTP server allows anonymous login and determines if the access is read-only or read/write. It does not exploit a vulnerability; it only checks for and reports the presence of anonymous FTP access.

Backdoor review

No backdoor observed in reviewed code

The module is a straightforward Metasploit auxiliary scanner that checks for anonymous FTP access. It performs only the documented actions: attempting an anonymous login, optionally testing write access by creating and removing a directory, optionally listing directory contents and storing them as loot, and reporting the result. No concealed executable behavior, unrelated payloads, credential exfiltration, persistence mechanisms, or deceptive instructions were observed.

ClassificationScanner
Model confidence95%
AuthenticationNot required
Languagesruby
Target softwareftp_server
Attack typescredential_access
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The module's description states it 'Detect[s] anonymous (read/write) FTP service access.' Its code performs login checks, write-access tests, and reports findings without delivering a payload or gaining unauthorized access beyond the anonymous login itself. This is consistent with a scanner, not an exploit.

modules/auxiliary/scanner/ftp/ftp_anonymous.rb:16-17modules/auxiliary/scanner/ftp/ftp_anonymous.rb:42-97

Requirements

  • Network connectivity to an FTP server on the configured port (default 21).modules/auxiliary/scanner/ftp/ftp_anonymous.rb:36

Observed behavior

  • Attempts to connect and login to the target FTP server with anonymous credentials.modules/auxiliary/scanner/ftp/ftp_anonymous.rb:43
  • Tests write access by creating and then removing a randomly named directory.modules/auxiliary/scanner/ftp/ftp_anonymous.rb:46-54
  • Optionally retrieves and stores a directory listing as loot.modules/auxiliary/scanner/ftp/ftp_anonymous.rb:61-72
  • Reports the vulnerability 'Anonymous FTP Access' and registers the anonymous credentials.modules/auxiliary/scanner/ftp/ftp_anonymous.rb:75-84
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Module Behavior
Attempts anonymous FTP login and optionally tests write access via MKD/RMD commandsThis is the documented purpose of the module and is consistent with normal auxiliary scanner functionality.modules/auxiliary/scanner/ftp/ftp_anonymous.rb:42-57
Module Behavior
Optionally stores directory listing as loot using store_lootStoring loot is a standard Metasploit feature for evidence collection, not a backdoor.modules/auxiliary/scanner/ftp/ftp_anonymous.rb:61-72
Module Behavior
Reports vulnerability and registers credentials in the databaseStandard Metasploit reporting functions; no external exfiltration.modules/auxiliary/scanner/ftp/ftp_anonymous.rb:75-84modules/auxiliary/scanner/ftp/ftp_anonymous.rb:99-133
Review boundaries

What the analysis did not establish

  • Analysis is based solely on the module source code and metadata; framework mixins and libraries (e.g., Msf::Exploit::Remote::Ftp) are not expanded, so the exact implementation of connect_login and send_cmd is not inspected.
  • Review is limited to the module source code; Metasploit framework mixins (e.g., Msf::Exploit::Remote::Ftp, Msf::Auxiliary::Scanner) are not expanded, so their internal behavior is not inspected.
  • Binary files were not present in the evidence.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1