Audit Report and Security Laboratory

Project: Vulnerability Analysis and Secure Network Exploitation
Date: April 2026
Author: Ivo Albacete

1. Executive Summary

This project involved the deployment of a controlled environment for practicing cybersecurity techniques. A virtualized laboratory was configured using a NAT Network to ensure that tests do not affect external networks. The objective was to identify weaknesses in the FTP protocol and validate the exploitation of a known backdoor in the vsftpd service.

2. Work Environment

• Hypervisor: VirtualBox
• Attacker Machine: Kali Linux (IP: 10.0.2.5)
• Victim Machine: Metasploitable 2 (IP: 10.0.2.4)
• Network Configuration: Dedicated NAT Network.

3. Reconnaissance Phase (Nmap)

A full port and service scan was performed with the command: sudo nmap -sV -p- 10.0.2.4

Multiple vulnerable services were identified, notably port 21/tcp running vsftpd 2.3.4. This version is known for CVE-2011-2523.

4. Traffic and Protocol Analysis (Wireshark)

Using Wireshark, traffic between the attacker and victim machines was analyzed. It was confirmed that the FTP protocol transmits information in plain text, allowing credential interception.

Interception evidence: By following the TCP Stream, the sending of the malicious user intended to trigger the backdoor is clearly visible.

5. Exploitation and Control (Backdoor)

The attack vector consists of sending a username that ends with the sequence :).

Step 1: Backdoor Activation An FTP connection was attempted with the user ivo:). Although the client reports a login error, this action triggers the opening of the hidden port 6200 on the server.

Step 2: Root Access Subsequently, netcat was used to connect to port 6200, obtaining a shell with maximum privileges (root).

6. Defensive Analysis (Blue Team)

On the victim machine, the traces left by the connection were audited. Analysis of the system logs allowed identifying the multiple connections originating from the attacker IP (10.0.2.5), validating the importance of log management in active defense.

7. Conclusions and Mitigation

The exploited vulnerability is of critical severity (CVSS 10.0). To secure the system, the following measures are recommended:

1. Update: Migrate to a version of vsftpd greater than 2.3.4 where this flaw was fixed.
2. Encryption: Replace FTP usage with secure protocols such as SFTP or SSH.
3. Monitoring: Implement alerts for login patterns that include unusual special characters.