# vsftpd 2.3.4 Backdoor Detection

- **URL:** https://hackindex.io/services/ftp/vulnerability-discovery/vsftpd-backdoor-detection
- **Path:** FTP > Vulnerability Discovery
- **Up:** [Vulnerability Discovery](https://hackindex.io/services/ftp/vulnerability-discovery.md)
- **Published:** 2026-03-16
- **Updated:** 2026-03-16

In July 2011, a backdoored version of vsftpd 2.3.4 was distributed through the official download mirror. The backdoor triggers when a username ending in `:)` is sent during login, causing the server to open a root shell on port 6200. This page covers detecting the condition. Exploitation is covered in [vsftpd 2.3.4 Backdoor](https://hackindex.io/services/ftp/exploitation/vsftpd-234).

- **Version confirmation** nmap -sV identifies whether the server runs exactly vsftpd 2.3.4, the only affected version.
- **NSE backdoor probe** ftp-vsftpd-backdoor sends the smiley trigger and probes port 6200 for a shell response.
- **Port 6200 check** scan the port independently as a secondary indicator alongside the NSE result.
- **Distribution builds** packages from Debian/Ubuntu were not affected, but the NSE result is authoritative regardless of install method.

## Confirm the Version First

```bash
nmap -sV -p $PORT $TARGET_IP
# 21/tcp open  ftp  vsftpd 2.3.4
```

The backdoor only exists in the specific compromised tarball distributed during a short window in July 2011. Any other vsftpd version is not affected. If the version is 2.3.4, proceed with the detection check.

## Backdoor Detection with nmap

```bash
nmap -p $PORT --script ftp-vsftpd-backdoor $TARGET_IP
# PORT   STATE SERVICE
# 21/tcp open  ftp
# | ftp-vsftpd-backdoor:
# |   VULNERABLE:
# |   vsFTPd version 2.3.4 backdoor
# |     State: VULNERABLE (Exploitable)
# |     Risk factor: High
# |     Description:
# |       vsFTPd version 2.3.4 which contains a backdoor.
# |     Disclosure date: 2011-07-04
# |_    References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2523
```

`State: VULNERABLE (Exploitable)` confirms the backdoor is active and the shell port is reachable. The NSE script sends the trigger username and probes port 6200 for a shell response.

A negative result:

```
| ftp-vsftpd-backdoor:
|_  ERROR: Server may not be backdoored
```

This means the server did not respond to the trigger on port 6200, either because it is running a clean build or because port 6200 is filtered.

## Check Port 6200 Separately

If you want to check whether port 6200 is open independently of the NSE script:

```bash
nmap -Pn -p 6200 $TARGET_IP
```

An open port 6200 alongside vsftpd 2.3.4 on port 21 is a strong indicator. The NSE script is still the definitive check because it confirms both the trigger response and the port.

## Distribution Package Consideration

vsftpd 2.3.4 packages distributed by major Linux distributions such as Debian and Ubuntu were not affected because they were built from source before the compromise and maintained independently. The backdoor was specific to the tarball available on the official project download site during a short period. Distribution-packaged 2.3.4 installs are typically safe.

The NSE result is authoritative regardless of how the package was installed.

## What This Confirms

A positive result means sending a username ending in `:)` will trigger the backdoor and open a root shell on port 6200. The full exploitation workflow is in [vsftpd 2.3.4 Backdoor](https://hackindex.io/services/ftp/exploitation/vsftpd-234).

## References

- [ftp-vsftpd-backdoor NSE Script ](https://nmap.org/nsedoc/scripts/ftp-vsftpd-backdoor.html) - Nmap script documentation for vsftpd 2.3.4 backdoor detection
- [CVE-2011-2523](https://nvd.nist.gov/vuln/detail/CVE-2011-2523) - NVD entry for the vsftpd 2.3.4 backdoor