This project documents a practical penetration testing exercise focused on identifying and exploiting the vulnerable FTP service vsFTPd 2.3.4 running on a Metasploitable target machine.
The assessment follows a structured penetration testing methodology including reconnaissance, service enumeration, vulnerability identification, exploitation, remote shell access, and verification of successful compromise.
- Identify exposed network services
- Enumerate the target environment
- Detect vulnerable software versions
- Exploit the vsFTPd 2.3.4 backdoor vulnerability
- Obtain remote shell access
- Verify successful exploitation
- Document the complete attack workflow
- Kali Linux
- Metasploitable
- pfSense
- FTP (vsFTPd 2.3.4)
- Nmap
- Metasploit Framework
- Kali Linux
- Metasploitable
- Linux Command Line Tools
The target host was identified through network reconnaissance and connectivity verification.
Activities performed:
- Network identification
- Host discovery
- Connectivity validation
A full service scan was conducted to identify exposed ports and running services.
Key findings:
- FTP service exposed
- vsFTPd version 2.3.4 detected
- Service identified as potentially vulnerable
The detected FTP service version was researched and matched against known public vulnerabilities.
Finding:
- vsFTPd 2.3.4 backdoor vulnerability
- Remote shell access possible through exploitation
The Metasploit Framework was used to exploit the vulnerable FTP service.
Activities:
- Module selection
- Target configuration
- Exploit execution
- Session establishment
Result:
- Successful exploitation
- Remote command shell obtained
Post-exploitation validation confirmed successful access to the target system.
Verification included:
- User identification
- Host verification
- Command execution
- System interaction
vsFTPd 2.3.4 Backdoor
Impact:
- Unauthorized remote access
- Remote command execution
- System compromise
- Potential privilege escalation opportunities
The vulnerable FTP service allowed an attacker to gain remote access to the target system without legitimate credentials.
This demonstrates the risks associated with:
- Outdated software
- Unpatched services
- Vulnerable network-facing applications
- Network Reconnaissance
- Service Enumeration
- Vulnerability Identification
- Exploit Research
- Metasploit Framework Usage
- Remote Access Verification
- Penetration Testing Methodology
- Security Documentation
- Understanding exploit selection processes
- Practical Metasploit usage
- Vulnerability validation techniques
- Service enumeration methodology
- Attack chain analysis
- Security reporting best practices
This project was performed in an isolated laboratory environment for educational and authorized cybersecurity training purposes only.
Nouman Javed Nizami
Cybersecurity Analyst | Penetration Testing Laboratory Project