CVE-2011-2523 PoC — vsftpd 操作系统命令注入漏洞

Description

Python exploit for vsftpd 2.3.4 - Backdoor Command Execution 

介绍

# CVE-2011-2523
Python exploit for vsftpd 2.3.4 - Backdoor Command Execution 
## Description
- vsftpd, which stands for `Very Secure FTP Daemon`,is an FTP server for Unix-like systems, including Linux. It is licensed under the GNU General Public License. It supports IPv6 and SSL.

- In July 2011, it was discovered that vsftpd version 2.3.4 downloadable from the master site had been compromised.  Users logging into a compromised vsftpd-2.3.4 server may issue a `:)` smileyface as the username and gain a command shell on port `6200`.  This was not an issue of a security hole in vsftpd, instead, someone had uploaded a different version of vsftpd which contained a backdoor. Since then, the site was moved to Google App Engine.


## Requirements

```bash
sudo apt update
sudo apt install python3
sudo apt install python3-pip
pip install argparse
```

## Installation

```bash
git clone https://github.com/vaishnavucv/CVE-2011-2523.git
cd ./CVE-2011-2523
chmod +x exploit.py
```


## Usage

python3 exploit.py -host Target_$IP 

**Example :** python3 exploit.py -host 192.168.168.128

文件快照

备注