Fawn

One port, vsftpd 3.0.3, anonymous login allowed, flag in the FTP root. The box is a reminder that the version banner is the distraction - the finding is that an unauthenticated principal was given read access at all.

OS
Linux
Difficulty
Very Easy
Retired
30 Sept 2021
Skills
ftp, anonymous-access, vsftpd

Fawn is the FTP box in the HackTheBox Starting Point: port 21, vsftpd 3.0.3, anonymous login, and a flag sitting in the root. It is trivial to clear, but the useful habit it teaches is to not get distracted by the version number. vsftpd 3.0.3 is a current, non-backdoored build - there is no memorable CVE to reach for here. The weakness is entirely a configuration choice: anonymous_enable was left on, and the thing it exposes is world-readable.

Path to root, at a glance:
  1. nmap -> port 21, vsftpd 3.0.3, ftp-anon says anonymous is allowed.
  2. ftp in as anonymous, any password.
  3. Read flag.txt without ever downloading it.

Recon - nmap

┌──(r3vpwnx㉿r3vpwnx)-[~/CTF/HTB/Fawn]
└─$ sudo nmap -Pn -A 10.129.1.14
Starting Nmap 7.99 ( https://nmap.org ) at 2021-09-30 15:59 -0400
Nmap scan report for 10.129.1.14
Host is up (0.39s latency).
PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.3
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_-rw-r--r--    1 0        0              32 Jun 04  2021 flag.txt
Service Info: OS: Unix

The scan did the enumeration for me. nmap’s ftp-anon script actually logs in as anonymous, and the FTP code 230 it reports is the protocol’s “User logged in, proceed” response - so the finding is confirmed before I have typed a single FTP command. It even lists the directory: a 32-byte flag.txt, owner uid 0, world-readable (-rw-r--r--).

Worth internalising: vsftpd 3.0.3 is not the 2.3.4 build with the smiley-face backdoor that everyone remembers. Reaching for an exploit here is the wrong reflex. The version is clean; the configuration is the problem.

Foothold - anonymous FTP

“Anonymous FTP” is a specific mechanism, not just “no login.” The server maps the special usernames anonymous and ftp onto a real low-privilege local account (also ftp), chroots that account into its home directory, and accepts any string as the password (by convention an email address). Everything that account can read is now readable by the entire internet.

┌──(r3vpwnx㉿r3vpwnx)-[~/CTF/HTB/Fawn]
└─$ ftp 10.129.1.14
Connected to 10.129.1.14.
220 (vsFTPd 3.0.3)
Name (10.129.1.14:r3vpwnx): anonymous
331 Please specify the password.
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.

331 asks for a password, 230 accepts the empty/any one - the same success code nmap already saw. List the chroot:

ftp> ls -al
229 Entering Extended Passive Mode (|||18570|)
150 Here comes the directory listing.
drwxr-xr-x    2 0        121          4096 Jun 04  2021 .
drwxr-xr-x    2 0        121          4096 Jun 04  2021 ..
-rw-r--r--    1 0        0              32 Jun 04  2021 flag.txt
226 Directory send OK.

Loot - reading the flag

No need to pull the file to disk - the FTP client can page a remote file straight to the terminal:

ftp> page flag.txt
[flag redacted]
ftp>

page/less/get flag.txt /dev/stdout all read without leaving an artifact in the working directory. Small thing, but keeping the engagement filesystem clean is a good habit even on a lab.

Detection and hardening

  • Turn anonymous off unless the service genuinely needs a public drop point: anonymous_enable=NO in vsftpd.conf. If a public directory is required, isolate it and make it the only readable path.
  • Never let anonymous write. anon_upload_enable / anon_mkdir_write_enable turn a read exposure into an upload-and-execute path if the directory is ever served or processed elsewhere.
  • Encrypt it. Plain FTP sends control and data (credentials included) in cleartext. Use FTPS or, better, SFTP over SSH.
  • Blue team: an anonymous 230 from an external source address is a clean single-line alert in the FTP log - alert on 230 where the user is anonymous/ftp.

Lessons

  • The banner is a distraction; the config is the bug. A clean, current vsftpd still leaks everything if anonymous access is enabled over a reachable interface.
  • nmap scripts often finish the job. ftp-anon logged in and listed the flag before I touched the service - read the scripted output before reaching for a client.
  • An unauthenticated read is already a breach. It did not need to be a shell. Anything an anonymous principal can reach is, by definition, public.