ftp_bounce: Various improvements

[g0tmi1k]

This PR refreshes this module by:

• Moving the module to be more like other generic FTP service modules
• Able to be more verbose
• Updating metadata
• Use report_note & report_service

Setup

$ docker run --rm -p 2121:21 -p 40000-40100:40000-40100 --name proftpd registry.gitlab.com/g0tmi1k/proftpd-docker:1.3.3c
787c7350dc34 - ProFTPD 1.3.3c (maint) (built Mon Apr 27 2026 16:28:37 UTC) standalone mode STARTUP

Before

$ ./msfconsole -q -x 'db_status; workspace -D;
setg VERBOSE true; setg RHOSTS 10.0.0.10; setg LHOST tap0;'
[*] Connected to msf. Connection type: postgresql.
[*] Deleted workspace: default
[*] Recreated the default workspace
VERBOSE => true
RHOSTS => 10.0.0.10
LHOST => tap0
msf > use ftpbounce

Matching Modules
================

   #  Name                                  Disclosure Date  Rank    Check  Description
   -  ----                                  ---------------  ----    -----  -----------
   0  auxiliary/scanner/portscan/ftpbounce  .                normal  No     FTP Bounce Port Scanner


Interact with a module by name or index. For example info 0, use 0 or use auxiliary/scanner/portscan/ftpbounce

[*] Using auxiliary/scanner/portscan/ftpbounce
msf auxiliary(scanner/portscan/ftpbounce) > options

Module options (auxiliary/scanner/portscan/ftpbounce):

   Name        Current Setting      Required  Description
   ----        ---------------      --------  -----------
   BOUNCEHOST                       yes       FTP relay host
   BOUNCEPORT  21                   yes       FTP relay port
   DELAY       0                    yes       The delay between connections, per thread, in milliseconds
   FTPPASS     mozilla@example.com  no        The password for the specified username
   FTPUSER     anonymous            no        The username to authenticate as
   JITTER      0                    yes       The delay jitter factor (maximum value by which to +/- DELAY) in milliseconds.
   PORTS       1-10000              yes       Ports to scan (e.g. 22-25,80,110-900)
   RHOSTS      10.0.0.10            yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
   THREADS     1                    yes       The number of concurrent threads (max one per host)


View the full module info with the info, or info -d command.

msf auxiliary(scanner/portscan/ftpbounce) > setg BOUNCEHOST 127.0.0.1
BOUNCEHOST => 127.0.0.1
msf auxiliary(scanner/portscan/ftpbounce) > setg BOUNCEPORT 2121
BOUNCEPORT => 2121
msf auxiliary(scanner/portscan/ftpbounce) > setg PORTS 80,6667
PORTS => 80,6667
msf auxiliary(scanner/portscan/ftpbounce) > run
[*] 127.0.0.1:2121 - Connecting to FTP server 127.0.0.1:2121...
[*] 127.0.0.1:2121 - Connected to target FTP server.
[*] 127.0.0.1:2121 - Authenticating as anonymous with password mozilla@example.com...
[*] 127.0.0.1:2121 - Sending password...
[+] 127.0.0.1:2121 -  TCP OPEN 10.0.0.10:6667
[*] 127.0.0.1:2121 - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(scanner/portscan/ftpbounce) > workspace -v

Workspaces
==========

current  name     hosts  services  vulns  creds  loots  notes
-------  ----     -----  --------  -----  -----  -----  -----
*        default  1      1         0      0      0      0

msf auxiliary(scanner/portscan/ftpbounce) > hosts

Hosts
=====

address    mac  name  os_name  os_flavor  os_sp  purpose  info  comments
-------    ---  ----  -------  ---------  -----  -------  ----  --------
10.0.0.10             Unknown                    device

msf auxiliary(scanner/portscan/ftpbounce) > services
Services
========

host       port  proto  name  state  info  resource  parents
----       ----  -----  ----  -----  ----  --------  -------
10.0.0.10  6667  tcp          open         {}

msf auxiliary(scanner/portscan/ftpbounce) >

After

msf auxiliary(scanner/portscan/ftpbounce) > git checkout ftp_bounce
[*] exec: git checkout ftp_bounce

Switched to branch 'ftp_bounce'
Your branch is up to date with 'origin/ftp_bounce'.
msf auxiliary(scanner/portscan/ftpbounce) > workspace -D
[*] Deleted workspace: default
[*] Recreated the default workspace
msf auxiliary(scanner/portscan/ftpbounce) > reload_all
[...]
msf auxiliary(scanner/portscan/ftpbounce) > use ftp_bounce

Matching Modules
================

   #  Name                                   Disclosure Date  Rank    Check  Description
   -  ----                                   ---------------  ----    -----  -----------
   0  auxiliary/scanner/portscan/ftp_bounce  .                normal  No     FTP Bounce Port Scanner


Interact with a module by name or index. For example info 0, use 0 or use auxiliary/scanner/portscan/ftp_bounce

[*] Using auxiliary/scanner/portscan/ftp_bounce
msf auxiliary(scanner/portscan/ftp_bounce) > run
[*] 127.0.0.1:2121 - Connecting to FTP server 127.0.0.1:2121...
[*] 127.0.0.1:2121 - Connected to target FTP server.
[*] 127.0.0.1:2121 - Authenticating as anonymous with password mozilla@example.com...
[*] 127.0.0.1:2121 - Sending password...
[!] 127.0.0.1:2121 - 127.0.0.1:2121 -> 10.0.0.10:80: PORT rejected (expected as DATA < 1024) -- 500 Illegal PORT command
[+] 127.0.0.1:2121 -  TCP OPEN 10.0.0.10:6667
[*] 127.0.0.1:2121 - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(scanner/portscan/ftp_bounce) > workspace -v

Workspaces
==========

current  name     hosts  services  vulns  creds  loots  notes
-------  ----     -----  --------  -----  -----  -----  -----
*        default  2      2         0      0      0      1

msf auxiliary(scanner/portscan/ftp_bounce) > hosts

Hosts
=====

address    mac  name        os_name  os_flavor  os_sp  purpose  info  comments
-------    ---  ----        -------  ---------  -----  -------  ----  --------
10.0.0.10                   Unknown                    device
127.0.0.1       172.17.0.2  Unknown                    device

msf auxiliary(scanner/portscan/ftp_bounce) > services
Services
========

host       port  proto  name  state  info                                                              resource  parents
----       ----  -----  ----  -----  ----                                                              --------  -------
10.0.0.10  6667  tcp          open   Discovered via FTP bounce from 127.0.0.1:2121                     {}
127.0.0.1  2121  tcp    ftp   open   ProFTPD 1.3.3c Server (ProFTPD Docker Installation) [172.17.0.2]  {}

msf auxiliary(scanner/portscan/ftp_bounce) > notes

Notes
=====

 Time                     Host       Service  Port  Protocol  Type        Data
 ----                     ----       -------  ----  --------  ----        ----
 2026-04-28 13:29:48 UTC  127.0.0.1  ftp      2121  tcp       ftp.bounce  {:info=>"Attempted to use machine for FTP bounce attack", :target=>"10.0.0.10"}

msf auxiliary(scanner/portscan/ftp_bounce) >

[github-actions]

Thanks for your pull request! As part of our landing process, we manually verify that all modules work as expected.

We've added the additional-testing-required label to indicate that additional testing is required before this pull request can be merged.
For maintainers, this means visiting here.

[g0tmi1k]

This now needs #21380 to be merged ahead of time.