Disguise as FTPS traffic to circumvent firewall restrictions on port 443

[R3pl4c3r]

Background

FTPS (also known FTP-SSL, and FTP Secure) is an extension to the commonly used File Transfer Protocol (FTP) that adds support for the Transport Layer Security (TLS) and, formerly, the Secure Sockets Layer (SSL, which is now prohibited by RFC7568) cryptographic protocols.

Details

Negotiation is not supported with implicit FTPS configurations. A client is immediately expected to challenge the FTPS server with a TLS ClientHello message. If such a message is not received by the FTPS server, the server should drop the connection.
In order to maintain compatibility with existing non-FTPS-aware clients, implicit FTPS was expected to listen on the IANA well known port 990/TCP for the FTPS control channel, and port 989/TCP for the FTPS data channel.

ALPN

Protocol	Identification Sequence	Reference
FTP	0x66 0x74 0x70 ("ftp")	[RFC959][RFC4217]

Thinking

If we use port 989 and ALPN "ftp", we can then disguise the internet traffic as FTPS data traffic. Also, the behaviour of an FTPS client seems to be similar as a proxy client.

References:

https://en.wikipedia.org/wiki/FTPS
https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#alpn-protocol-ids