alexojocyber/cve-2011-2523-vsftpd-validation-labAuthorized Kali–Metasploitable2 lab using Python and Nmap NSE to validate CVE-2011-2523 in vsFTPd 2.3.4.
⚠️ Authorized Lab Only — conducted in an isolated VirtualBox Host-Only network using Kali Linux and Metasploitable2. No unauthorized systems were scanned or accessed at any point.
CVE-2011-2523 is one of the most well-known supply chain compromises in open source history. In 2011, the official vsFTPd 2.3.4 source code was backdoored on the project's download server — an attacker modified the binary so that entering a username containing :) triggered a backdoor shell on TCP port 6200, granting root access to any remote attacker.
This lab validates CVE-2011-2523 using a structured vulnerability assessment methodology:
ftp-vsftpd-backdoorThis is real vulnerability assessment work — the same methodology used by penetration testers and SOC analysts conducting authorized security assessments.
| Component | Details |
|---|---|
| Attacking Machine | Kali Linux |
| Target Machine | Metasploitable2 (intentionally vulnerable) |
| Hypervisor | Oracle VirtualBox |
| Network | Host-Only Adapter — isolated, no internet access |
| Tools | Python 3, Nmap, NSE, python-nmap library |
| Target IP | 192.168.56.103 |
| Field | Details |
|---|---|
| CVE ID | CVE-2011-2523 |
| Affected Software | vsFTPd 2.3.4 |
| CVSS Score | 10.0 — Critical |
| Vulnerability Type | Backdoor / Supply Chain Compromise |
| Attack Vector | Network — no authentication required |
| Impact | Remote root shell access (uid=0) |
| Discovered | July 2011 |
| MITRE ATT&CK | T1195.002 (Compromise Software Supply Chain) |
How the backdoor works:
When a client connects to vsFTPd 2.3.4 and sends a username containing the characters :) (smiley face), the backdoor code is triggered — opening a listener shell on TCP port 6200. Connecting to port 6200 grants an interactive root shell with no further authentication required.
Step 1: Confirm target IP on Host-Only network
└── ifconfig / ip addr on Metasploitable2
Step 2: Verify connectivity
└── ping 192.168.56.103 from Kali
Step 3: Service & version detection
└── nmap -sV -p 21 192.168.56.103
└── Confirm: vsftpd 2.3.4
Step 4: Python-automated NSE scan
└── python3 pythonnmap.py --host 192.168.56.103 --ports 21
└── NSE scripts executed:
ftp-anon
ftp-bounce
ftp-libopie
ftp-proftpd-backdoor
ftp-vsftpd-backdoor ← CVE-2011-2523 validation
Step 5: Document findings & remediation
sudo nmap -sV -p 21 192.168.56.103
Output:
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 2.3.4
sudo python3 pythonnmap.py --host 192.168.56.103 --ports 21
sudo nmap --script ftp-vsftpd-backdoor -p 21 192.168.56.103
| Service | Port | Finding | Evidence |
|---|---|---|---|
| FTP | TCP 21 | vsFTPd 2.3.4 identified — known backdoored version | Nmap service/version scan |
| FTP | TCP 21 | Anonymous FTP login permitted | ftp-anon NSE output |
| FTP | TCP 21 | Target confirmed vulnerable to CVE-2011-2523 | ftp-vsftpd-backdoor NSE output |
| CVE-2011-2523 | TCP 6200 | Backdoor shell returned uid=0(root) gid=0(root) | NSE validation output |
In a real production environment, remediation would include:
| Action | Priority |
|---|---|
| Immediately remove vsFTPd 2.3.4 and replace with a patched version | 🔴 Critical |
| Verify software integrity using SHA-256 checksums against official vendor hashes before installation | 🔴 Critical |
| Disable anonymous FTP access unless explicitly required | 🟠 High |
| Restrict FTP service exposure using firewall rules and network segmentation | 🟠 High |
Monitor FTP authentication logs for suspicious usernames containing :) | 🟡 Medium |
| Consider replacing FTP entirely with SFTP (SSH File Transfer Protocol) | 🟡 Medium |
| Control | Framework | Relevance |
|---|---|---|
| T1195.002 | MITRE ATT&CK | Compromise Software Supply Chain — backdoor injected into vsFTPd source |
| T1133 | MITRE ATT&CK | External Remote Services — backdoor opens remote root shell |
| T1190 | MITRE ATT&CK | Exploit Public-Facing Application — FTP service exploited remotely |
| SI-2 | NIST SP 800-53 | Flaw Remediation — patch and remove vulnerable software |
| SI-7 | NIST SP 800-53 | Software Integrity — verify software checksums before deployment |
| RA-5 | NIST SP 800-53 | Vulnerability Monitoring and Scanning |
| A.12.6 | ISO 27001 | Management of Technical Vulnerabilities |
The pythonnmap.py script automates the Nmap NSE scan using the python-nmap library:
# Key functionality
import nmap
scanner = nmap.PortScanner()
scanner.scan(
hosts=target_host,
ports=target_ports,
arguments='-sV --script ftp-anon,ftp-bounce,ftp-libopie,ftp-proftpd-backdoor,ftp-vsftpd-backdoor'
)
Benefits of Python automation:
| Skill | Details |
|---|---|
| CVE Research | Understood CVE-2011-2523 technically — attack vector, backdoor mechanism, CVSS score |
| Vulnerability Validation | Used NSE scripting to confirm real CVE in controlled environment |
| Nmap & NSE | Service detection, version scanning, and script-based vulnerability validation |
| Python Security Automation | Automated NSE scan using python-nmap library |
| Findings Documentation | Structured findings table with evidence, severity, and remediation |
| Remediation Planning | Produced prioritised remediation recommendations |
| MITRE ATT&CK Mapping | T1195.002, T1133, T1190 — supply chain and remote access techniques |
| NIST Framework Mapping | SI-2, SI-7, RA-5 — flaw remediation and vulnerability scanning controls |
| Lab Safety | Maintained isolated Host-Only network — zero risk of unauthorized access |
cve-2011-2523-vsftpd-validation-lab/
│
├── README.md # This file
├── pythonnmap.py # Python-automated Nmap NSE scanner
├── requirements.txt # Python dependencies (python-nmap)
├── .gitignore # Excludes sensitive files
│
└── screenshots/
├── metasploitable-ip-address.png # Target IP confirmation
├── ftp-service-version-scan.png # vsFTPd 2.3.4 detected
└── ftp-vsftpd-cve-validation.png # CVE-2011-2523 validated
# Clone the repository
git clone https://github.com/alexojocyber/cve-2011-2523-vsftpd-validation-lab.git
cd cve-2011-2523-vsftpd-validation-lab
# Install Nmap and Python dependency
sudo apt install -y nmap
pip install -r requirements.txt
# Run the scanner against your authorized lab target
sudo python3 pythonnmap.py --host TARGET_IP --ports 21
This lab was conducted exclusively in an isolated, authorized environment using intentionally vulnerable virtual machines. All scanning and validation was performed only against Metasploitable2 on a Host-Only VirtualBox network with no external connectivity. This project is for educational and defensive cybersecurity purposes only. Never scan or test systems without explicit written authorization.