How to Attack FTP Service - VSFTPD 2.3.4

Learn how to exploit the VSFTPD 2.3.4 FTP Service using Nmap and Metasploit. This guide walks you through the steps to efficiently identify and attack vulnerable FTP services.

Tool	Function	Platform	License	Primary Use
Nmap	Network discovery and security scanning	Cross-platform	Open-source	Network mapping and port scanning
Metasploit	Penetration testing framework	Cross-platform	Open-source	Exploitation and vulnerability testing

STRATEGY

We can exploit this ftp service in many methods. Today I will make a strategy to exploit this service using a PAYLOAD of Metasploit. First of all, we need to gather information about the version of the FTP service. 

To do Information Gathering, we will use NMAP, and for Exploitation, we will use Metasploit.

What is Payload?

Payload is a script (python, bash, Go, R, etc.) that can do scripted action and get access automatically.

Host and Victim Device Info.:

Machine	Details
Attack Machine	192.168.0.106
Metasploitable 2 - Host/Victim	192.168.0.107

Information Gathering

Introduction to NMAP (Network Mapper)

Nmap, short for Network Mapper, is a versatile and powerful tool used by network administrators and security professionals to discover devices, scan open ports, and identify potential vulnerabilities in a network. Whether mapping out your network or probing an external system, Nmap provides detailed insights into the services running on various hosts, helping you assess the security posture and uncover hidden threats. 

Using Nmap, we will find the version of the FTP Service we want to exploit.

The version of FTP Service:

To find the version of the FTP service, we need to follow below steps:

Here we can see our FTP service version is "vsftpd 2.3.4".

EXPLOITATION

Introduction to Metasploit

Metasploit is a widely used penetration testing framework that simplifies the process of exploiting vulnerabilities in systems. With its extensive database of exploits, payloads, and auxiliary modules, Metasploit allows security professionals to simulate real-world attacks, test defenses, and gain a deeper understanding of potential security risks. Whether you're performing a vulnerability assessment or developing custom exploits, Metasploit is an indispensable tool in the ethical hacker's toolkit.

METHOD of EXPLOITATION

To exploit the FTP service, we need to search for an exploit file. One more thing, to search anything in Metasploit, we will use a basic format which is "search {file_name}".

Example: search vsftpd

Here, we found an exploit is "vsftpd_234_backdoor. Now we need to use this exploit file to attack the FTP service. To use this file the default format is "use {file_name}/{list_number}".

Example 1: use exploit/unix/ftp/vsftpd_234_backdoor

Example 2: use 1

Now exploit has been selected. Now we need to see the settings/options of this exploit file.

Here we can see the RHOSTS (Remote Host) section is blank. Now what is the meaning of RHOST? RHOST means the IP address of the target machine. As we seen upper that, our host machine IP is 192.168.0.107. Now lets setup this IP to the RHOST section.

Now let's see if is it set or still blank.

As we are watching the RHOST has been set. Now we need run an exploit command to run the file to get access to the victim machine.

After running the command you need to wait a few seconds or minutes to create a shell session. 

•

•

•

As we can see shell session 1 opened. That means we got access to our victim machine and now we can run UNIX/Linux command to this shell to explore the machine. So, as proof of the project that we got access to our victim machine, let's try to see to which user we are logged in.

DISCLAIMER

The information provided in this guide is for educational and informational purposes only. The techniques and tools discussed, including Nmap and Metasploit, are intended for ethical use in controlled environments or with explicit permission from the system owner. Unauthorized access or testing of networks, systems, or devices without permission is illegal and unethical. The author and publisher are not responsible for any misuse or damages resulting from the use of this information. Always ensure you have proper authorization before performing any penetration testing or security assessments.