Skip to content
HackIndex logo

HackIndex

vsftpd 2.3.4 Backdoor Detection

2 min read Mar 16, 2026

In July 2011, a backdoored version of vsftpd 2.3.4 was distributed through the official download mirror. The backdoor triggers when a username ending in :) is sent during login, causing the server to open a root shell on port 6200. This page covers detecting the condition. Exploitation is covered in vsftpd 2.3.4 Backdoor.

Confirm the Version First

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p $PORT $TARGET_IP 
21/tcp open  ftp  vsftpd 2.3.4

The backdoor only exists in the specific compromised tarball distributed during a short window in July 2011. Any other vsftpd version is not affected. If the version is 2.3.4, proceed with the detection check.

Backdoor Detection with nmap

┌──(kali㉿kali)-[~]
└─$ nmap -p $PORT --script ftp-vsftpd-backdoor $TARGET_IP 
PORT   STATE SERVICE
21/tcp open  ftp
| ftp-vsftpd-backdoor:
|   VULNERABLE:
|   vsFTPd version 2.3.4 backdoor
|     State: VULNERABLE (Exploitable)
|     Risk factor: High
|     Description:
|       vsFTPd version 2.3.4 which contains a backdoor.
|     Disclosure date: 2011-07-04
|_    References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2523

State: VULNERABLE (Exploitable) confirms the backdoor is active and the shell port is reachable. The NSE script sends the trigger username and probes port 6200 for a shell response.

A negative result:

| ftp-vsftpd-backdoor:
|_  ERROR: Server may not be backdoored

This means the server did not respond to the trigger on port 6200, either because it is running a clean build or because port 6200 is filtered.

Check Port 6200 Separately

If you want to check whether port 6200 is open independently of the NSE script:

┌──(kali㉿kali)-[~]
└─$ nmap -Pn -p 6200 $TARGET_IP

An open port 6200 alongside vsftpd 2.3.4 on port 21 is a strong indicator. The NSE script is still the definitive check because it confirms both the trigger response and the port.

Distribution Package Consideration

vsftpd 2.3.4 packages distributed by major Linux distributions such as Debian and Ubuntu were not affected because they were built from source before the compromise and maintained independently. The backdoor was specific to the tarball available on the official project download site during a short period. Distribution-packaged 2.3.4 installs are typically safe.

The NSE result is authoritative regardless of how the package was installed.

What This Confirms

A positive result means sending a username ending in :) will trigger the backdoor and open a root shell on port 6200. The full exploitation workflow is in vsftpd 2.3.4 Backdoor.

References