Hello everyone,
I’m trying to complete an old room on THM - cat pictures - but I’m stuck.
I even looked at different write-ups and yet…
Shortly: I have this IP, I do my nmap and find http and ssh ports open, while ftp port is filtered; I connect to the http port via browser and there’s an hint on the website (a forum about cat pictures): a post with written
“knock knock 1111 2222 3333 4444”
so I look on google and discover the existence of port knocking…and try my things:
- I install knockd and try
If you haven’t gotten it yet I’m a very beginner, so I looked to different write-ups and I haven’t found out why this isn’t working - fyi every single walkthrough says that knocking is the way (and it’s only the beginning)…
I even asked AI which suggested me to write a Bash script, a loop with 1 second delay that uses
nmap -Pn where -p is the variable $port (1111 … 4444) with no retries for nmap, i.e --max-retries 0 …and nothing! I really don’t know…
Anyone would be so kind to help me?
*** SOLUTION ***
Ok, it seems to be a known bug (June 2026).
For the people who are having the same issue here’s the official “what to do” I’ve found:
**Issue:**
The port knocking step does not open FTP on the current deployment.
**How to test:**
Install knock on the AttackBox if needed.
apt install knockd -y
Run the expected sequence.
knock -v TARGET_IP 1111 2222 3333 4444
Then test FTP.
nc -nv TARGET_IP 21
Expected result:
FTP should open and return:
220 vsFTPd 3.0.5
**Actual result:**
FTP does not open, even though the knock sequence is correct.
How to confirm the cause:
On the target as root, check the knock logs.
grep -i knock /var/log/syslog
The logs show knockd detects the sequence and reaches OPEN SESAME, but then the command fails.
**Example error:**
openFTP: OPEN SESAME
running command: /sbin/iptables ...
sh: 1: /sbin/iptables: not found
command returned non-zero status code 127
The real iptables path on the target is:
/usr/sbin/iptables
**not:**
/sbin/iptables
There is also a rule order problem. The original command appends the allow rule, but the firewall already has reject rules for port 21. This means the allow rule can be added below a reject rule and never gets reached.
Broken command:
command = /sbin/iptables -A INPUT -s %IP% -p tcp --dport 21 -j ACCEPT && iptables -D INPUT -p tcp --dport 21 -j REJECT
Working command tested:
command = /usr/sbin/iptables -I INPUT 3 -s %IP% -p tcp --dport 21 -j ACCEPT
After updating the command and restarting knockd, the same knock sequence successfully opened FTP.
** Suggested fix: **
Update /etc/knockd.conf so openFTP uses /usr/sbin/iptables and inserts the ACCEPT rule above the FTP reject rules.
for example,
```
cp /etc/knockd.conf /etc/knockd.conf.bak && sed -i 's|/sbin/iptables|/usr/sbin/iptables|g; s|-A INPUT -s %IP% -p tcp --dport 21 -j ACCEPT && iptables -D INPUT -p tcp --dport 21 -j REJECT|-I INPUT 3 -s %IP% -p tcp --dport 21 -j ACCEPT|g' /etc/knockd.conf && pkill knockd; /usr/sbin/knockd -i eth0 -d
```
