metasploit-cursor-harness: Skill for Cursor

FTP Pentest

Prerequisites

• Target is in scope (scope/scope-master.txt, engagement ROE).
• FTP bounce may scan out-of-scope hosts. Verify ROE before bounce attacks.

Ports and detection

Port	Service
21/tcp	FTP control channel
6200/tcp	vsFTPd 2.3.4 backdoor (when triggered)

Service fingerprint

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/ftp/ftp_version",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 21, "THREADS": 5}
)

CLI fallback:

nc -vn <target> 21
nmap -sV -p21 -sC <target>
openssl s_client -connect <target>:21 -starttls ftp

Workflow

Task Progress:
- [ ] Banner and FEAT enumeration
- [ ] Anonymous and default credential testing
- [ ] Writable directory discovery
- [ ] ProFTPD mod_copy / vsFTPd backdoor checks
- [ ] Document findings

Anonymous login test

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/ftp/anonymous",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 21, "FTPUSER": "anonymous", "FTPPASS": "anonymous@"}
)

CLI fallback:

ftp <target>
# USER anonymous / PASS anonymous@
wget -m ftp://anonymous:anonymous@<target>
nmap --script ftp-anon,ftp-syst -p 21 <target>
lftp -e "open <target>; ls" -u anonymous,anonymous

Authentication brute force

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/ftp/ftp_login",
  engagement_id="<id>",
  options={
    "RHOSTS": "<target>",
    "RPORT": 21,
    "USERNAME": "admin",
    "PASSWORD": "password",
    "STOP_ON_SUCCESS": true,
    "THREADS": 5
  }
)

CLI fallback:

hydra -L users.txt -P passwords.txt <target> ftp -t 4
nmap --script ftp-brute -p 21 --script-args userdb=users.txt,passdb=pass.txt <target>

Manual FEAT enumeration

MSF: No direct module; use CLI.

CLI fallback:

ftp <target>
# HELP, FEAT, STAT, SYST
echo -e "FEAT\r\nQUIT\r\n" | nc -vn <target> 21