VAPT report for vsFTPd 2.3.4 backdoor CVE-2011-2523, covering Nmap vulnerability scanning, Metasploit exploitation, post-exploitation root access, and remediation.
Target: Metasploitable 2
Tester: Security Analyst
Date: 24th June 2026
Scope: Internal Lab Testing (Kali Linux → Metasploitable 2)
A vulnerability scanning was performed using Nmap vulnerability scanning script against the Metasploitable 2 machine. The scan identified a critical vulnerability in the FTP service (vsFTPd 2.3.4 backdoor) as vulnerable to CVE-2011-2523.
The vulnerability was then successfully exploited using the Metasploit Framework, resulting in a Meterpreter session with root privileges.
Overall Risk Level: 🔴 Critical
• Identify open ports, services and versions.
• Detect vulnerabilities.
• Perform exploitation
• Assess impact
• Recommend remediation
| Phase | Description |
|---|
| Reconnaissance | Identified target system |
| Scanning | Performed vulnerability scanning |
| Enumeration | Detected services and versions |
| Exploitation | Exploited by accessing Meterpreter session |
| Post-Exploitation | Confirmed root access |
| Machine | IP Address | Role |
|---|---|---|
| Kali Attacker | 192.168.56.101 | Attacker |
| Metasploitable 2 | 192.168.56.103 | Target |
~ CVE ID: CVE-2011-2523
~ Affected Service: vsFTPd 2.3.4
~ Type: Backdoor Command Execution
~ Description: A malicious backdoor was introduced into the vsFTPd 2.3.4 source code. When a username ending with :) is used during login, the service opens a shell on port 6200, granting root access to the attacker.
Exploitability: High
Impact: Remote root shell access
Severity: Critical (CVSS 10.0)
Vulnerability scanning:
Exploitation using msfconsole:
Setting Target and Local Host:
Root access Gained:
• Executed Nmap vulnerability scanning script in Kali attacker using command:
nmap -–script vuln 192.168.56.103
• Detected vsFTPd 2.3.4 backdoor vulnerability (CVE 2011 2523) on port 21/tcp.
• Opened Metasploitable Framework using msfconsole
• Searched for the exploit module using search vsftp.
• Selected the exploit with backdoor vulnerability.
• Set the Target and Local host
RHOST= 192.168.56.103
LHOST= 192.168.56.101
• Run the exploit and a meterpreter session is opened with Root access on target system.
• Complete system compromise with root privileges.
• Ability to manipulate files, directories, and processes.
• Potential for lateral movement across the network.
• Remove vsFTPd 2.3.4 and replace with a secure version (e.g., vsFTPd 3.x)
• Ensure all services are updated to the latest versions.
• If not required, disable FTP entirely and use secure alternatives like SFTP/SSH.
The vulnerability CVE-2011-2523 allows attackers to gain unauthorized root access, making it a critical security risk. Proper patching and service hardening are essential to mitigate such threats.
