# Vulnerability Discovery

> FTP vulns: anonymous access, cleartext creds, writable dirs, CVEs, backdoor

- **URL:** https://hackindex.io/services/ftp/vulnerability-discovery
- **Service:** [FTP](https://hackindex.io/services/ftp.md)
- **Tags:** vulns, misconfig, risk
- **Published:** 2025-12-29
- **Updated:** 2026-03-29

## ProFTPD ,  backdoor detection (1.3.3c)

**What this does:**  
Tests for the presence of the **ProFTPD 1.3.3c backdoor** (BID 45150).  
The NSE script checks whether the service responds in a way consistent with the known backdoored version. By default, it uses a **non-destructive **`id`** command** purely to confirm the backdoor’s presence.

```bash
nmap -sV -p "$TARGET_PORT" --script ftp-proftpd-backdoor "$TARGET_IP"
```

**Record:**

- Detected ProFTPD version/banner
- Whether the backdoor check returned a positive result
- Script output (confirmed vs not detected)

In order to exploit this backdoor you can follow this page: [**ProFTPD 1.3.3c Backdoor**](https://hackindex.io/services/ftp/exploitation/proftpd-133c)

## vsftpd ,  backdoor detection (2.3.4)

**What this does:**  
Tests for the **vsftpd 2.3.4 backdoor** disclosed in July 2011 (**CVE-2011-2523**).  
The script verifies whether the FTP service behaves like the backdoored version, again using a **harmless **`id`** command** by default to validate exposure.

```bash
nmap -sV -p "$TARGET_PORT" --script ftp-vsftpd-backdoor "$TARGET_IP"
```

**Record:**

- Detected vsftpd version/banner
- Whether the backdoor was identified
- Any anomalous responses indicating compromise

In order to exploit this backdoor you can follow this page: [**vsftpd 2.3.4 Backdoor**](https://hackindex.io/services/ftp/exploitation/vsftpd-234)

### Notes

- These are the **only FTP backdoor/vulnerability detection scripts** provided by Nmap for ProFTPD and vsftpd.
- Results should be treated as **confirmation checks**, not broad vulnerability coverage.
- Use `-Pn` if the target blocks ICMP probes.
- Save output for documentation and reporting

```bash
nmap -sV -p "$TARGET_PORT" --script ftp-proftpd-backdoor,ftp-vsftpd-backdoor "$TARGET_IP" -oN "ftp_nmap_${TARGET_IP}.txt"
```

## References

- [CVE-2010-20103 (ProFTPD Backdoor)](https://nvd.nist.gov/vuln/detail/CVE-2010-20103) - NVD entry for the malicious backdoor embedded in ProFTPD 1.3.3c (hidden command execution with root privileges).
- [CVE-2011-2523 (vsftpd Backdoor)](https://nvd.nist.gov/vuln/detail/CVE-2011-2523) - NVD entry for the backdoor in vsftpd 2.3.4 that opens a shell on a crafted connection.
- [Nmap NSE Script: ftp-vsftpd-backdoor](https://nmap.org/nsedoc/scripts/ftp-vsftpd-backdoor.html) - Documentation for the Nmap script that detects the vsftpd 2.3.4 backdoor condition.
- [Nmap NSE Script: ftp-proftpd-backdoor](https://nmap.org/nsedoc/scripts/ftp-proftpd-backdoor.html) - Documentation for the Nmap script that checks for the ProFTPD 1.3.3c backdoor (CVE-2010-20103).

## Guides

- [FTP Anonymous Access Check](https://hackindex.io/services/ftp/vulnerability-discovery/ftp-anonymous-access.md): Detect misconfigured FTP servers allowing unauthenticated anonymous logins, exposing sensitive files or enabling unauthorised data upload/download.
- [FTP Bounce Attack Check](https://hackindex.io/services/ftp/vulnerability-discovery/ftp-bounce-attack-check.md): Exploits misconfigured FTP servers using PORT command to proxy scans or connections through a third-party host, bypassing firewall restrictions.
- [FTP Cleartext Credential Transmission](https://hackindex.io/services/ftp/vulnerability-discovery/ftp-cleartext-credential-transmission.md): Identifies FTP services transmitting credentials in cleartext, demonstrating sniffable authentication and the risks of unencrypted legacy file transfer protocols.
- [FTP Version Vulnerability Check](https://hackindex.io/services/ftp/vulnerability-discovery/ftp-version-vulnerability-check.md): Identifies FTP server versions with known CVEs by banner grabbing and cross-referencing against vulnerability databases to detect unpatched or outdated daemons.
- [FTP Writable Directory Check](https://hackindex.io/services/ftp/vulnerability-discovery/ftp-writable-directory-check.md): Identifies writable FTP directories by testing anonymous or authenticated access, enabling upload of malicious files or further exploitation of misconfigured servers.
- [ProFTPD 1.3.3c Backdoor Detection](https://hackindex.io/services/ftp/vulnerability-discovery/proftpd-backdoor-detection.md): Detect and exploit the ProFTPD 1.3.3c supply-chain backdoor (CVE-2010-4221) introduced via compromised source, enabling unauthenticated remote root access.
- [vsftpd 2.3.4 Backdoor Detection](https://hackindex.io/services/ftp/vulnerability-discovery/vsftpd-backdoor-detection.md)