FTP mixin: Report if host is up but service doesn't match by g0tmi1k · Pull Request #21575 · rapid7/metasploit-framework

g0tmi1k · 2026-06-16T14:45:52Z

This has come from: #21416

When ftp_version (or any module using the FTP mixin) connects to an open port that responds with a non-FTP banner, the greeting fails to match /^(120|220)[\s-]/.
Currently, the connection simply closes with nothing added to the workspace.

This uses report_service() to update the workspace with the unknown service (and also host).

Demo

Before

Nothing recorded when a non-FTP service responds

$ git status
On branch master
Your branch is up to date with 'origin/master'.

nothing to commit, working tree clean
$
$ ./msfconsole -q -x 'workspace -D;
use auxiliary/scanner/ftp/ftp_version;
set RHOSTS 10.0.0.10;
set RPORT 22;
run'
[*] Deleted workspace: default
[*] Recreated the default workspace
RHOSTS => 10.0.0.10
RPORT => 22
[*] 10.0.0.10:22          - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(scanner/ftp/ftp_version) > workspace -v

Workspaces
==========

current  name     hosts  services  vulns  creds  loots  notes
-------  ----     -----  --------  -----  -----  -----  -----
*        default  0      0         0      0      0      0

msf auxiliary(scanner/ftp/ftp_version) >

After

Host and service recorded with banner info

$ git status
On branch ftp_mixin3
Your branch is up to date with 'origin/ftp_mixin3'.

nothing to commit, working tree clean
$
$ ./msfconsole -q -x 'workspace -D;
use auxiliary/scanner/ftp/ftp_version;
set RHOSTS 10.0.0.10;
set RPORT 22;
run;'
[*] Deleted workspace: default
[*] Recreated the default workspace
RHOSTS => 10.0.0.10
RPORT => 22
[*] 10.0.0.10:22          - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(scanner/ftp/ftp_version) > workspace -v

Workspaces
==========

current  name     hosts  services  vulns  creds  loots  notes
-------  ----     -----  --------  -----  -----  -----  -----
*        default  1      2         0      0      0      0

msf auxiliary(scanner/ftp/ftp_version) > hosts

Hosts
=====

address    mac  name  os_name  os_flavor  os_sp  purpose  info  comments
-------    ---  ----  -------  ---------  -----  -------  ----  --------
10.0.0.10             Unknown                    device

msf auxiliary(scanner/ftp/ftp_version) > services
Services
========

host       port  proto  name     state  info             resource  parents
----       ----  -----  ----     -----  ----             --------  -------
10.0.0.10  22    tcp    unknown  open   Non-FTP service  {}        tcp (22/tcp)
10.0.0.10  22    tcp    tcp      open                    {}

msf auxiliary(scanner/ftp/ftp_version) >

Copilot

Pull request overview

This PR updates the shared FTP remote mixin so that when an FTP module connects to an open TCP port but the initial greeting does not look like an FTP banner, Metasploit still reports the host/service to the workspace (instead of silently closing without recording anything).

Changes:

Add a fallback report_service() path in Ftp#connect when the greeting does not match an FTP RFC-959 style banner.
Record the service as unknown with a TCP parent, and store a short info string intended to capture the banner (or a fallback message).

Impact Analysis:

Blast radius: medium/high (all modules/mixins calling Msf::Exploit::Remote::Ftp#connect, including scanners like auxiliary/scanner/ftp/ftp_version; downstream effect is limited to DB/workspace reporting).
Data and contract effects: introduces additional service rows for (host, port) when the port is open but not FTP (or when no FTP banner is received), potentially increasing “services” counts and persisting “unknown” service entries.
Rollback and test focus: easy rollback (single mixin change); validate against (1) real FTP services (still reports ftp and note), (2) non-FTP banner services (records banner/info as intended), and (3) no-banner/timeouts (does not mislead or spam).

cgranleese-r7 · 2026-07-10T11:32:04Z

Tested and seems to work as expected:

msf auxiliary(scanner/ftp/ftp_version) > services
Services
========

host            port  proto  name     state  info             resource  parents
----            ----  -----  ----     -----  ----             --------  -------
10.140.106.183  22    tcp    unknown  open   Non-FTP service  {}        tcp (22/tcp)
10.140.106.183  22    tcp    tcp      open                    {}

msf auxiliary(scanner/ftp/ftp_version) >

We have some merged conflicts and I believe that copilot comment may be worth looking into. Once those are resolved I can get this merged for you 👍

g0tmi1k · 2026-07-16T15:28:15Z

FTP

$ git status
On branch ftp_mixin3
Your branch is up to date with 'origin/ftp_mixin3'.

nothing to commit, working tree clean
$
$ ./msfconsole -q -x 'db_status; workspace -D;
setg VERBOSE true;
use auxiliary/scanner/ftp/ftp_version;
set RHOSTS 10.0.0.10;'
[*] Connected to msf. Connection type: postgresql.
[*] Deleted workspace: default
[*] Recreated the default workspace
VERBOSE => true
RHOSTS => 10.0.0.10
msf auxiliary(scanner/ftp/ftp_version) > run
[+] 10.0.0.10:21          - FTP Banner: '220 (vsFTPd 2.3.4)\x0d\x0a'
[*] 10.0.0.10:21          - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(scanner/ftp/ftp_version) > workspace -v

Workspaces
==========

current  name     hosts  services  vulns  creds  loots  notes
-------  ----     -----  --------  -----  -----  -----  -----
*        default  1      2         0      0      0      2

msf auxiliary(scanner/ftp/ftp_version) > services
Services
========

host       port  proto  name  state  info                        resource  parents
----       ----  -----  ----  -----  ----                        --------  -------
10.0.0.10  21    tcp    tcp   open                               {}
10.0.0.10  21    tcp    ftp   open   220 (vsFTPd 2.3.4)\x0d\x0a  {}        tcp (21/tcp)

msf auxiliary(scanner/ftp/ftp_version) > notes

Notes
=====

 Time                     Host       Service  Port  Protocol  Type        Data
 ----                     ----       -------  ----  --------  ----        ----
 2026-07-16 15:24:09 UTC  10.0.0.10  ftp      21    tcp       ftp.banner  {:banner=>"220 (vsFTPd 2.3.4)"}
 2026-07-16 15:24:09 UTC  10.0.0.10  ftp      21    tcp       ftp.cpe     {:cpe=>"cpe:/a:vsftpd_project:vsftpd:2.3.4"}

msf auxiliary(scanner/ftp/ftp_version) >

Non-FTP, but banner (SSH)

msf auxiliary(scanner/ftp/ftp_version) > workspace -D
[*] Deleted workspace: default
[*] Recreated the default workspace
msf auxiliary(scanner/ftp/ftp_version) > run RPORT=22
[*] 10.0.0.10:22          - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(scanner/ftp/ftp_version) > workspace -v

Workspaces
==========

current  name     hosts  services  vulns  creds  loots  notes
-------  ----     -----  --------  -----  -----  -----  -----
*        default  1      2         0      0      0      0

msf auxiliary(scanner/ftp/ftp_version) > services
Services
========

host       port  proto  name     state  info                                   resource  parents
----       ----  -----  ----     -----  ----                                   --------  -------
10.0.0.10  22    tcp    unknown  open   SSH-2.0-OpenSSH_4.7p1 Debian-8ubuntu1  {}        tcp (22/tcp)
10.0.0.10  22    tcp    tcp      open                                          {}

msf auxiliary(scanner/ftp/ftp_version) >

Non-FTP, no banner (X11)

msf auxiliary(scanner/ftp/ftp_version) > workspace -D
[*] Deleted workspace: default
[*] Recreated the default workspace
msf auxiliary(scanner/ftp/ftp_version) > run RPORT=6000
[*] 10.0.0.10:6000        - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(scanner/ftp/ftp_version) > workspace -v

Workspaces
==========

current  name     hosts  services  vulns  creds  loots  notes
-------  ----     -----  --------  -----  -----  -----  -----
*        default  1      2         0      0      0      0

msf auxiliary(scanner/ftp/ftp_version) > services
Services
========

host       port  proto  name     state  info             resource  parents
----       ----  -----  ----     -----  ----             --------  -------
10.0.0.10  6000  tcp    unknown  open   Non-FTP service  {}        tcp (6000/tcp)
10.0.0.10  6000  tcp    tcp      open                    {}

msf auxiliary(scanner/ftp/ftp_version) >

Host, but no service

msf auxiliary(scanner/ftp/ftp_version) > workspace -D
[*] Deleted workspace: default
[*] Recreated the default workspace
msf auxiliary(scanner/ftp/ftp_version) > run RPORT=9999
[*] 10.0.0.10:9999        - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(scanner/ftp/ftp_version) > workspace -v

Workspaces
==========

current  name     hosts  services  vulns  creds  loots  notes
-------  ----     -----  --------  -----  -----  -----  -----
*        default  1      0         0      0      0      0

msf auxiliary(scanner/ftp/ftp_version) >

g0tmi1k · 2026-07-16T15:29:35Z

Thats great to hear @cgranleese-r7, thanks!

Fixed up and forced push'd

cgranleese-r7 · 2026-07-17T14:39:19Z

Release Notes

Improves scanner/ftp/ftp_version to now report the service if host is up but we don't get an appropriate FTP banner.

g0tmi1k · 2026-07-17T16:35:14Z

Thanks @cgranleese-r7 !

smcintyre-r7 added this to Metasploit Kanban Jun 16, 2026

github-project-automation Bot moved this to Todo in Metasploit Kanban Jun 16, 2026

g0tmi1k mentioned this pull request Jun 16, 2026

FTP mixin: Fixes & improvements #21416

Merged

g0tmi1k force-pushed the ftp_mixin3 branch from 0cad10c to 885bf29 Compare July 9, 2026 06:24

cgranleese-r7 self-assigned this Jul 10, 2026

cgranleese-r7 requested a review from Copilot July 10, 2026 10:42

Copilot started reviewing on behalf of cgranleese-r7 July 10, 2026 10:42 View session

Copilot AI reviewed Jul 10, 2026

View reviewed changes

Comment thread lib/msf/core/exploit/remote/ftp.rb

cgranleese-r7 added the rn-enhancement release notes enhancement label Jul 10, 2026

ftp: Report if host is up but service doesn't match

a59e4b4

g0tmi1k force-pushed the ftp_mixin3 branch from 885bf29 to a59e4b4 Compare July 16, 2026 14:57

cgranleese-r7 approved these changes Jul 17, 2026

View reviewed changes

github-project-automation Bot moved this from Todo to In Progress in Metasploit Kanban Jul 17, 2026

cgranleese-r7 merged commit 4dca1c1 into rapid7:master Jul 17, 2026
44 checks passed

github-project-automation Bot moved this from In Progress to Done in Metasploit Kanban Jul 17, 2026

g0tmi1k deleted the ftp_mixin3 branch July 17, 2026 16:35

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

FTP mixin: Report if host is up but service doesn't match#21575

FTP mixin: Report if host is up but service doesn't match#21575
cgranleese-r7 merged 1 commit into
rapid7:masterfrom
g0tmi1k:ftp_mixin3

g0tmi1k commented Jun 16, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

cgranleese-r7 commented Jul 10, 2026

Uh oh!

g0tmi1k commented Jul 16, 2026 •

edited

Loading

Uh oh!

g0tmi1k commented Jul 16, 2026

Uh oh!

Uh oh!

cgranleese-r7 commented Jul 17, 2026

Uh oh!

g0tmi1k commented Jul 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Conversation

g0tmi1k commented Jun 16, 2026

Demo

Before

After

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

cgranleese-r7 commented Jul 10, 2026

Uh oh!

g0tmi1k commented Jul 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

FTP

Non-FTP, but banner (SSH)

Non-FTP, no banner (X11)

Host, but no service

Uh oh!

g0tmi1k commented Jul 16, 2026

Uh oh!

Uh oh!

cgranleese-r7 commented Jul 17, 2026

Release Notes

Uh oh!

g0tmi1k commented Jul 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

g0tmi1k commented Jul 16, 2026 •

edited

Loading