Fawn is a Very Easy Linux machine that demonstrates the security risks of FTP services with anonymous access enabled. The machine has only one open port (21/TCP - FTP) running vsftpd 3.0.3, which allows anonymous login and contains a flag file accessible without authentication.

Path to root, at a glance:

  • Scan the target → discover port 21 (FTP) running vsftpd 3.0.3
  • Connect via FTP with anonymous credentials
  • List directory contents and find flag.txt
  • View the flag directly using the page command or download it

Nmap

┌──(r3vpwnx㉿r3vpwnx)-[~/CTF/HTB/Fawn]
└─$ sudo nmap -Pn -A 10.129.1.14
Starting Nmap 7.99 ( https://nmap.org ) at 2021-09-30 15:59 -0400
Nmap scan report for 10.129.1.14
Host is up (0.39s latency).
Not shown: 999 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.3
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to ::ffff:10.10.14.105
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count was 3
|      vsFTPd 3.0.3 - secure, fast, stable
|_End of status
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_-rw-r--r--    1 0        0              32 Jun 04  2021 flag.txt
Device type: general purpose|router
Running: Linux 4.X|5.X, MikroTik RouterOS 7.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3
OS details: Linux 4.15 - 5.19, MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3)
Network Distance: 2 hops
Service Info: OS: Unix

TRACEROUTE (using port 199/tcp)
HOP RTT       ADDRESS
1   373.20 ms 10.10.14.1
2   372.60 ms 10.129.1.14

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 18.96 seconds

The scan reveals:

  • Port 21/tcp: FTP service running vsftpd 3.0.3
  • Anonymous login: Allowed (FTP code 230)
  • OS: Unix
  • File: flag.txt is present in the FTP root directory

The Service: FTP (File Transfer Protocol)

FTP (File Transfer Protocol) is a standard network protocol used to transfer files between a client and server. Key characteristics:

  • Port: 21 (control), 20 (data)
  • Authentication: Username/password or anonymous
  • Security: Transmits data in cleartext (no encryption)
  • Common vulnerabilities: Anonymous access, default credentials, directory traversal

Exploitation: Anonymous FTP Access

Connection Attempt

Since nmap indicated anonymous login is allowed, I connect using the ftp client with username anonymous:

┌──(r3vpwnx㉿r3vpwnx)-[~/CTF/HTB/Fawn]
└─$ ftp 10.129.1.14
Connected to 10.129.1.14.
220 (vsFTPd 3.0.3)
Name (10.129.1.14:r3vpwnx): anonymous
331 Please specify the password.
Password: 
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.

Note: The password can be anything (or left blank). Common practice is to use anonymous@example.com or just press Enter.

Enumeration

List the directory contents to find interesting files:

ftp> ls -al
229 Entering Extended Passive Mode (|||18570|)
150 Here comes the directory listing.
drwxr-xr-x    2 0        121          4096 Jun 04  2021 .
drwxr-xr-x    2 0        121          4096 Jun 04  2021 ..
-rw-r--r--    1 0        0              32 Jun 04  2021 flag.txt
226 Directory send OK.

We find flag.txt in the root FTP directory.
Reading the Flag

Instead of downloading, we can read the flag directly using the page command:

ftp> page flag.txt
035d**********************15
ftp>

The flag is displayed immediately in the terminal.

Alternative methods (without get):

  • less flag.txt
  • page flag.txt
  • get flag.txt /dev/stdout
image

Task Answers

1 What does the 3-letter acronym FTP stand for? File Transfer Protocol
2 Which port does the FTP service listen on usually? 21
3 What acronym is used for a later protocol designed to provide similar functionality to FTP but securely, as an extension of the SSH protocol? SFTP (Secure File Transfer Protocol)
4 What is the command we can use to send an ICMP echo request to test our connection to the target? ping
5 From your scans, what version is FTP running on the target? vsftpd 3.0.3
6 From your scans, what OS type is running on the target? Unix
7 What is the command we need to run in order to display the ‘ftp’ client help menu? ftp -?
8 What is username that is used over FTP when you want to log in without having an account? anonymous
9 What is the response code we get for the FTP message ‘Login successful’? 230
10 What is the other command (besides dir) to list files on a Linux system? ls
11 What is the command used to download the file we found on the FTP server? get
12 Submit the flag: 035d**********************15

Key Vulnerabilities

  1. Anonymous FTP Access
    The most critical vulnerability is allowing anonymous login with read access to files. This exposes sensitive data to anyone who can reach the FTP server.

  2. Unencrypted Protocol
    FTP transmits all data (including credentials) in plaintext. If the server had required authentication, credentials could be intercepted through network sniffing.

  3. Sensitive Data Exposure
    The flag file was placed in the root FTP directory, making it accessible to any anonymous user.

Security Recommendations

  • Disable anonymous FTP - Require authentication for all access
  • Use SFTP/FTPS - Replace FTP with encrypted alternatives
  • Restrict file permissions - Ensure sensitive files aren’t placed in public directories
  • Network segmentation - Limit FTP access to trusted networks only
  • Regular audits - Check for misconfigured services and exposed data
  • Implement access controls - Use principle of least privilege

Why It Worked

This machine demonstrates that even a single misconfiguration—allowing anonymous FTP access with readable files—can lead to data exposure. The simplicity of the exploitation highlights how important proper security configurations are, even for services that seem harmless.