> For the complete documentation index, see [llms.txt](https://itszaiden.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itszaiden.gitbook.io/pentesting/writeups/dockerlabs/very-easy/firsthacking.md). # FirstHacking Exploited vsftpd 2.3.4 backdoor with Metasploit to gain instant root shell. ## 1 - Reconnaissance We begin with a fast Nmap scan to identify open ports: `nmap 172.17.0.2 -p- --open -sS -Pn --min-rate 5000 -T5` **Result: port 21 is open** ## 2 - Enumeration Now we run a service/version detection scan, targeting only the open ports we found on the previous scan: `nmap 172.17.0.2 -p 21 -sS -Pn -sCV` Result:

(FirstHacking) Targeted Port Scan

We will use `searchsploit vsftpd 2.3.4` to see if there exist any exploits for that service version. We found a Backdoor Command Execution exploit, so using `msfconsole` we use it. ## 3 - Exploitation We setup the exploit using `set RHOSTS 172.17.0.2` and run it, obtaining instantly a root shell.

(FirstHacking) Root Shell

### 4 - Summary **Initial Access:**\ Nmap enumeration revealed FTP running vsftpd 2.3.4. **Exploitation:**\ Used the Metasploit module for the vsftpd 2.3.4 backdoor (CVE-2011-2523), which granted immediate RCE. **Privilege Escalation:**\ Not required – the exploit provided a direct root shell.