Skip to content
HackIndex logo

HackIndex

ProFTPD 1.3.3c Backdoor Detection

2 min read Mar 16, 2026

In November 2010, the ProFTPD download server was compromised and a backdoor was inserted into the 1.3.3c source tarball. Servers compiled from this compromised release contain a hidden command that gives unauthenticated root access. The backdoor listens for a specific sequence after authentication and opens a shell. This page covers detecting the condition. Exploitation is covered in ProFTPD 1.3.3c Backdoor.

Confirm the Version First

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p $PORT $TARGET_IP 
21/tcp open  ftp  ProFTPD 1.3.3c

The backdoor only exists in 1.3.3c. Any other version is not affected by this specific issue. If the version is 1.3.3c, proceed with the NSE check.

Backdoor Detection with nmap

┌──(kali㉿kali)-[~]
└─$ nmap -p $PORT --script ftp-proftpd-backdoor $TARGET_IP 
PORT   STATE SERVICE
21/tcp open  ftp
| ftp-proftpd-backdoor:
|   VULNERABLE:
|   ProFTPD server backdoor
|     State: VULNERABLE
|     Risk factor: High
|     Description:
|       ProFTPD compiled from a malicious source code
|     Disclosure date: 2010-12-02
|_    References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-20103

State: VULNERABLE confirms the backdoor is present. The NSE script uses a non-destructive probe — it sends the trigger sequence and checks for a recognisable response without executing a full command on the target by default.

If the service does not respond as expected:

| ftp-proftpd-backdoor:
|_  Could not find backdoor on the FTP server.

This means either the server is not running the compromised build, or the backdoor has been patched or disabled.

Manual Check via Banner

The backdoor is present only in the specific compromised tarball. If the banner reports 1.3.3c but the server was compiled from the official uncompromised tarball or a distribution package, the backdoor will not be present. Distribution-packaged ProFTPD 1.3.3c versions are typically clean.

A quick sanity check is the build date. The compromised tarball was available for approximately four days in November 2010. Servers built from official distribution packages after that window are safe even if they report 1.3.3c.

The NSE script result is the authoritative check — trust it over version inference alone.

What This Confirms

A positive result means the server will respond to the backdoor trigger with unauthenticated command execution as root. This gives immediate full system access without credentials. The exploitation workflow is in ProFTPD 1.3.3c Backdoor.

References