Added Extended passive mode to the core ftp module.

[bigendiansmalls]

Extended passive mode (EPSV), as documented in RFC2428 is similar to the PASSive mode in that it requests that the server open a port and wait for a data connection. However, in unlike PASSive mode, Extended Passive mode returns only the port on which the server listens for the data connection, not the IP + Port. The client is expected to use the existing IP (e.g. the one it used to create the initial control channel connection) to connect to the new data port.

Where this becomes important is if the server is behind some type of natting device, EPSV will work in this case, PASS may not.

Existing example using PASSive mode (how MSF currently works)

User 192.168.1.1
Server public ip: 100.25.25.25
Server private ip: 170.20.20.1

• User -> AWS server via public IP via FTP
• Connection 192.168.1.1 - EST - 100.25.25.25 (nat'd 170.20.20.1)
• User switches to standard passive move (PASV)
• Server replies with IP & Port to connect to (e.g. 170.20.20.1 port: 1367)
• User issues any data command (ls, put, get, etc.)
• User ftp client tries to connect to 170.20.20.1:1367 and fails.

Screenshot of the above

Using EPSV

Same setup as above

• User -> AWS server via public IP via FTP
• Connection 192.168.1.1 - EST - 100.25.25.25 (nat'd 170.20.20.1)
• User switches to extended passive move (EPSV) via Advanced Option (set PassiveMode true)
• Server replies with Port only (no IP) to connect to (e.g. port: 1367)
• User issues any data command (ls, put, get, etc.)
• User ftp client tries to connect to original IP + data port 100.25.25.25:1367 and succeeds.

Screenshot of the above

Verification (using any Ftp-based exploit)

• Start msfconsole
• use exploit/mainframe/ftp/ftp_jcl_creds
• set payload cmd/mainframe/apf_privesc_jcl
• set ftpuser user
• set ftppass password
• set apflib HLQ.LINKLIB
• set rhosts 127.0.0.1

Other Screenshots

[bigendiansmalls]

Hey @busterb any questions on this one?

[busterb]

I didn't have the exact target, but this works fine for me. Thanks @bigendiansmalls

[busterb]

Release Notes

The Metasploit FTP client (EPSV) now includes Extended Passive Mode support which enables it to more easily traverse a NAT than with regular passive mode.

[bigendiansmalls]

Cheers.