CVE-2011-2523 Exploit (vsFTPd 2.3.4 Backdoor)

This project demonstrates exploitation of the vsFTPd 2.3.4 backdoor vulnerability (CVE-2011-2523) using Python and pwntools.

Disclaimer: This project is for educational and authorized penetration testing purposes only. Do NOT use against systems without permission.

Vulnerability Overview

• CVE ID: CVE-2011-2523
• Affected Software: vsFTPd 2.3.4
• Type: Backdoor / Remote Command Execution
• Port: 21 (FTP), 6200 (Backdoor shell)

👉 The vulnerable version of vsFTPd contains a malicious backdoor that is triggered when a username containing :) is used during login.

How the Exploit Works

1. Connects to the target FTP server
2. Checks if the version is vsFTPd 2.3.4
3. Sends a specially crafted username (USER hello:))
4. Triggers the hidden backdoor
5. Connects to port 6200
6. Opens an interactive shell

🛠️ Requirements

• Python 3
• pwntools library

Install dependencies:

pip install pwntools

Usage

🔹 Run the exploit

python3 exploit.py <TARGET_IP>

🔹 Optional: Specify port

python3 exploit.py <TARGET_IP> <PORT>

Example

python3 exploit.py 192.168.190.140

Expected Output

[+] Checking FTP Version...
[+] Triggering backdoor...
[+] Connecting to backdoor....
[+] Got Shell
$

Important Notes

• Target must be running vsFTPd 2.3.4 (vulnerable version)

• Port 6200 must be reachable

• Works best in lab environments like:

  • Metasploitable
  • Vulnerable VMs

Improvements (Future Work)

• Auto-detection of multiple FTP versions
• Add reverse shell payload
• Multi-target scanning support
• Integration with automation tools