CVE-2011-2523

CRITICAL NUCLEI LAB

vsftpd 2.3.4 - Backdoor Command Execution

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 54 public exploits for CVE-2011-2523. PoCs published by HerculesRD, Metasploit, padsalatushal, including Metasploit module exploits/unix/ftp/vsftpd_234_backdoor. A Nuclei detection template is also available.

AI-analyzed exploit summary This exploit leverages a backdoor in vsftpd 2.3.4 by sending a specific username string to trigger a command execution vulnerability, opening a reverse shell on port 6200. It uses Telnet for both FTP interaction and shell access.

Description

vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.

Exploits (54)

exploitdb WORKING POC VERIFIED
by HerculesRD · pythonremoteunix
https://www.exploit-db.com/exploits/49757

This exploit leverages a backdoor in vsftpd 2.3.4 by sending a specific username string to trigger a command execution vulnerability, opening a reverse shell on port 6200. It uses Telnet for both FTP interaction and shell access.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: vsftpd 2.3.4
No auth needed
Prerequisites: Network access to the vulnerable vsftpd service · vsftpd 2.3.4 running with the backdoor present
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by Metasploit · rubyremoteunix
https://www.exploit-db.com/exploits/17491

This Metasploit module exploits a backdoor in VSFTPD 2.3.4, which spawns a shell on port 6200 when a specific username pattern is used. It connects to the FTP service, triggers the backdoor, and interacts with the spawned shell.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: VSFTPD v2.3.4
No auth needed
Prerequisites: Network access to the target FTP service (port 21) · VSFTPD 2.3.4 with the backdoor present
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 15 stars
by padsalatushal · poc
https://github.com/padsalatushal/CVE-2011-2523

This repository contains a functional exploit for CVE-2011-2523, which targets a backdoor in vsftpd 2.3.4. The exploit sends a crafted username (`:)`) to trigger a shell on port 6200, demonstrating remote command execution.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: vsftpd 2.3.4
No auth needed
Prerequisites: Target running vsftpd 2.3.4 with the backdoor · Network access to port 21 (FTP) and 6200
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 6 stars
by Lynk4 · poc
https://github.com/Lynk4/CVE-2011-2523

This repository contains a functional exploit for CVE-2011-2523, a backdoor in vsftpd 2.3.4 that allows remote command execution by sending a crafted username and connecting to a shell on port 6200. The exploit uses Python's telnetlib to interact with the vulnerable FTP server.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: vsftpd 2.3.4
No auth needed
Prerequisites: Network access to the vulnerable vsftpd server · vsftpd 2.3.4 with the backdoor present
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 4 stars
by 4m3rr0r · poc
https://github.com/4m3rr0r/CVE-2011-2523-poc

This repository contains a functional Python exploit for CVE-2011-2523, targeting the backdoor in vsFTPd 2.3.4. The exploit triggers the backdoor by sending a crafted username and password, then connects to the spawned shell on port 6200.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: vsFTPd 2.3.4
No auth needed
Prerequisites: Target running vsFTPd 2.3.4 · Network access to the target on port 21
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 3 stars
by BolivarJ · poc
https://github.com/BolivarJ/CVE-2011-2523

This repository contains a functional Python exploit for CVE-2011-2523, targeting a backdoored version of vsFTPd 2.3.4. The exploit triggers a remote shell on port 6200 by sending a crafted username to the FTP service.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: vsFTPd 2.3.4 (backdoored version)
No auth needed
Prerequisites: Target must be running the backdoored vsFTPd 2.3.4 binary · Port 21 (FTP) must be accessible · Port 6200 must be reachable for the backdoor shell
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 3 stars
by NullBrunk · poc
https://github.com/NullBrunk/CVE-2011-2523

This repository contains a functional Python exploit for CVE-2011-2523, which targets a backdoor in VsFTPd 2.3.4. The exploit sends a crafted USER/PASS command to trigger the backdoor and spawns a root shell on port 6200.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: VsFTPd 2.3.4
No auth needed
Prerequisites: Network access to the target FTP service · VsFTPd 2.3.4 running on the target
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 3 stars
by nobodyatall648 · poc
https://github.com/nobodyatall648/CVE-2011-2523

This repository contains a functional exploit for CVE-2011-2523, a backdoor in vsftpd 2.3.4 that opens a shell on port 6200 when the username ends with ':)'. The exploit establishes an FTP connection, triggers the backdoor, and provides an interactive shell.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: vsftpd 2.3.4
No auth needed
Prerequisites: Network access to the target FTP server · vsftpd 2.3.4 running on the target
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 2 stars
by Gill-Singh-A · poc
https://github.com/Gill-Singh-A/vsFTP-2.3.4-Remote-Root-Shell-Exploit

This repository contains a functional Python exploit for CVE-2011-2523, a backdoor in vsFTPd 2.3.4 that allows remote root access. The exploit triggers the backdoor via FTP authentication, then uses a telnet connection to inject SSH keys and enable root login.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: vsFTPd 2.3.4
No auth needed
Prerequisites: Network access to vsFTPd 2.3.4 · FTP port (21) accessible · Exploit port (6200) accessible
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 2 stars
by cowsecurity · poc
https://github.com/cowsecurity/CVE-2011-2523

This repository contains a functional Python exploit for CVE-2011-2523, a backdoor in vsFTPd 2.3.4. The exploit triggers the backdoor by sending a specific username and password, then connects to the spawned shell on port 6200.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: vsFTPd 2.3.4
No auth needed
Prerequisites: Network access to the target vsFTPd server · vsFTPd version 2.3.4
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 2 stars
by MFernstrom · poc
https://github.com/MFernstrom/OffensivePascal-CVE-2011-2523

This repository contains a FreePascal implementation of an exploit for CVE-2011-2523, which is a backdoor in vsFTPD 2.3.4. The exploit involves sending a username with ':)' to trigger a backdoor on port 6200, granting root access.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: vsFTPD 2.3.4
No auth needed
Prerequisites: Network access to the target vsFTPD server
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 1 stars
by krill-x7 · poc
https://github.com/krill-x7/CVE-2011-2523

This repository contains a functional Python exploit for CVE-2011-2523, which targets a backdoor in vsftpd 2.3.4. The exploit sends a crafted username containing ':)' to trigger a shell on port 6200, allowing remote command execution as root.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: vsftpd 2.3.4
No auth needed
Prerequisites: Network access to the target FTP server · vsftpd 2.3.4 running on the target
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 1 stars
by cybermads · poc
https://github.com/cybermads/CVE-2011-2523

This repository contains a functional exploit for CVE-2011-2523, a backdoor in vsftpd 2.3.4. The exploit triggers the backdoor by sending a crafted USER command with ':)' and then connects to port 6200 to execute commands.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: vsftpd 2.3.4
No auth needed
Prerequisites: Network access to the target vsftpd server · vsftpd 2.3.4 running on the target
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WRITEUP 1 stars
by vedpakhare · poc
https://github.com/vedpakhare/vsftpd-234-vuln-report

This repository provides a detailed technical writeup on the exploitation of CVE-2011-2523, a backdoor in vsftpd 2.3.4 that opens a command shell on port 6200 when a username ending in ':)' is received. It includes exploitation steps using Metasploit and demonstrates root shell access.

Classification
Writeup 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: vsftpd 2.3.4
No auth needed
Prerequisites: vsftpd 2.3.4 running on target · Network access to the FTP service
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WRITEUP
by kmrlbhr · poc
https://github.com/kmrlbhr/pwntilldawn-10.150.150.12

This repository contains a detailed technical writeup and manual exploit code for CVE-2011-2523, a backdoor in vsftpd 2.3.4 that grants root access via a bind shell on port 6200 when a username containing ':)' is used.

Classification
Writeup 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: vsftpd 2.3.4
No auth needed
Prerequisites: Network access to the target FTP service · vsftpd 2.3.4 running on the target
devstral-2 · analyzed Jun 08, 2026 Full analysis →
nomisec WORKING POC
by H4R335HR · poc
https://github.com/H4R335HR/vsftpd-234-backdoor

This repository contains a functional Python exploit for CVE-2011-2523, which triggers a backdoor in vsftpd 2.3.4 by sending a username containing ':)' to spawn a root shell on TCP/6200. The exploit includes verification of the target banner, triggering the backdoor, and an interactive shell session.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: vsftpd 2.3.4
No auth needed
Prerequisites: Network access to the target FTP service · vsftpd 2.3.4 running on the target
devstral-2 · analyzed Jun 05, 2026 Full analysis →
nomisec WRITEUP
by Amirmuhammadmarvi · poc
https://github.com/Amirmuhammadmarvi/network-security-lab

This repository contains a detailed technical report and README documenting the exploitation of CVE-2011-2523 (vsftpd 2.3.4 backdoor) in a controlled lab environment. It includes step-by-step exploitation steps, reconnaissance findings, and remediation recommendations.

Classification
Writeup 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: vsftpd 2.3.4
No auth needed
Prerequisites: network access to target · FTP client · netcat
devstral-2 · analyzed Jun 03, 2026 Full analysis →
nomisec WRITEUP
by nitinsukthe · poc
https://github.com/nitinsukthe/OpenVAS-Vulnerability-Assessment-Incident-Response

This repository provides a detailed technical analysis of CVE-2011-2523, a backdoor in a compromised version of vsftpd 2.3.4. It includes vulnerability details, attack mechanisms, remediation steps, and incident response workflows, but does not contain functional exploit code.

Classification
Writeup 100%
Attack Type
Other
Complexity
Moderate
Reliability
Theoretical
Target: vsftpd 2.3.4 (Backdoored Release)
No auth needed
Prerequisites: Compromised vsftpd source package installed
devstral-2 · analyzed Jun 03, 2026 Full analysis →
nomisec WRITEUP
by nitinsukthe · poc
https://github.com/nitinsukthe/OpenVAS-Vulnerability-Assessment---Incident-Response

This repository provides a detailed technical analysis of CVE-2011-2523, a backdoor in a compromised version of vsftpd 2.3.4. It includes vulnerability details, attack mechanisms, remediation steps, and incident response workflows.

Classification
Writeup 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: vsftpd 2.3.4 (Backdoored Release)
No auth needed
Prerequisites: Compromised vsftpd 2.3.4 package installed
devstral-2 · analyzed Jun 02, 2026 Full analysis →
nomisec WRITEUP
by Chathura123git · poc
https://github.com/Chathura123git/ethical-hacking-CVE-2011-2523

This repository provides a detailed technical writeup on CVE-2011-2523, a backdoor in vsftpd 2.3.4, including exploitation steps, Metasploit commands, and post-exploitation verification. It does not contain functional exploit code but offers comprehensive documentation and screenshots.

Classification
Writeup 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: vsftpd 2.3.4
No auth needed
Prerequisites: vsftpd 2.3.4 running on target · network access to port 21
devstral-2 · analyzed May 24, 2026 Full analysis →
nomisec WRITEUP
by Jhatchi · poc
https://github.com/Jhatchi/NexaCorp-DFIR-INC-2026-001

This repository contains a detailed DFIR investigation report and detection engineering artifacts for a simulated intrusion involving CVE-2011-2523, a backdoor in vsftpd 2.3.4. It includes a comprehensive analysis of the exploit, attacker activity, and detection rules but does not contain functional exploit code.

Classification
Writeup 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: vsftpd 2.3.4
No auth needed
Prerequisites: vsftpd 2.3.4 running on target · network access to port 21
devstral-2 · analyzed May 19, 2026 Full analysis →
nomisec WORKING POC
by ByteForgeFr · poc
https://github.com/ByteForgeFr/CVE-2011-2523

This repository contains a functional exploit for CVE-2011-2523, which targets a backdoor in VsFTPd 2.3.4. The exploit sends a crafted USER and PASS command to trigger the backdoor, then connects to port 6200 to obtain a root shell.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: VsFTPd 2.3.4
No auth needed
Prerequisites: Network access to the target FTP server
devstral-2 · analyzed May 19, 2026 Full analysis →
nomisec WRITEUP
by Taisa456 · poc
https://github.com/Taisa456/network-security-snort

This repository provides a detailed technical writeup and lab setup for demonstrating Snort IDS/IPS capabilities against CVE-2011-2523 (vsftpd 2.3.4 backdoor). It includes custom Snort rules, attack simulation scripts, and a comparison of IDS vs. IPS modes.

Classification
Writeup 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: vsftpd 2.3.4
No auth needed
Prerequisites: Snort 3 installed on Kali Linux · Metasploitable 2 target · Network configuration with three VMs
devstral-2 · analyzed May 19, 2026 Full analysis →
nomisec WRITEUP
by Prafullya-Shandilya · poc
https://github.com/Prafullya-Shandilya/metasploitable-pentest-report

This repository contains a detailed penetration test report for Metasploitable 2, including findings for CVE-2011-2523 (vsftpd 2.3.4 backdoor). It provides technical details, methodology, and evidence of exploitation but does not include functional exploit code.

Classification
Writeup 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: vsftpd 2.3.4
No auth needed
Prerequisites: Metasploitable 2 VM · Kali Linux · Nmap · Metasploit · Netcat
devstral-2 · analyzed May 19, 2026 Full analysis →
nomisec WRITEUP
by IvoAlbacete · poc
https://github.com/IvoAlbacete/Kali-Metasploitable

This repository provides a detailed technical analysis of CVE-2011-2523, a backdoor vulnerability in vsftpd 2.3.4. It includes steps for exploitation, traffic analysis, and defensive measures, with evidence from tools like Nmap and Wireshark.

Classification
Writeup 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: vsftpd 2.3.4
No auth needed
Prerequisites: vsftpd 2.3.4 running on target · network access to port 21
devstral-2 · analyzed Apr 29, 2026 Full analysis →
nomisec WORKING POC
by Mithileshan · poc
https://github.com/Mithileshan/soc-investigation-lab

This repository contains a functional exploit for CVE-2011-2523, targeting vsftpd 2.3.4. It demonstrates a complete attack chain, including exploitation via a backdoor triggered by a specific username string, leading to a root shell.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: vsftpd 2.3.4
No auth needed
Prerequisites: vsftpd 2.3.4 running on target · network access to port 21
devstral-2 · analyzed Apr 25, 2026 Full analysis →
nomisec WRITEUP
by emilebarnard242 · poc
https://github.com/emilebarnard242/pentest-metasploitable2

This repository is a detailed technical writeup documenting the exploitation of CVE-2011-2523 (vsftpd 2.3.4 backdoor) on Metasploitable2, including network isolation, reconnaissance, and exploitation phases. It provides in-depth analysis of the vulnerability, attack workflow, and defensive implications.

Classification
Writeup 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: vsftpd 2.3.4
No auth needed
Prerequisites: Network access to target · Nmap for reconnaissance · Metasploit or manual exploit for vsftpd backdoor
devstral-2 · analyzed Apr 16, 2026 Full analysis →
nomisec WRITEUP
by RinAliyeva · poc
https://github.com/RinAliyeva/metasploitable2-vsftpd-exploitation

This repository provides a detailed technical walkthrough of exploiting CVE-2011-2523, a backdoor in vsFTPd 2.3.4, including reconnaissance, exploitation steps, and post-exploitation analysis. It demonstrates the vulnerability mechanics and impact but does not include functional exploit code.

Classification
Writeup 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: vsFTPd 2.3.4
No auth needed
Prerequisites: Network access to target · vsFTPd 2.3.4 running on target
devstral-2 · analyzed Apr 10, 2026 Full analysis →
nomisec WORKING POC
by Dahalsamir · poc
https://github.com/Dahalsamir/CVE-2011-2523-exploit

This repository contains a functional Python exploit for CVE-2011-2523, which targets a backdoor in vsFTPd 2.3.4. The exploit triggers the backdoor by sending a crafted username and connects to a hidden shell on port 6200.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: vsFTPd 2.3.4
No auth needed
Prerequisites: vsFTPd 2.3.4 running on target · Port 21 and 6200 accessible
devstral-2 · analyzed Apr 10, 2026 Full analysis →
nomisec WRITEUP
by Tr00jan99 · poc
https://github.com/Tr00jan99/PwnTillDawn-Portal-Walkthrough

This repository provides a detailed walkthrough of exploiting CVE-2011-2523, a backdoor in vsFTPd, including steps for reconnaissance, enumeration, vulnerability scanning, and exploitation using Netcat. It includes technical details and commands but does not contain functional exploit code.

Classification
Writeup 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: vsFTPd (version not specified)
No auth needed
Prerequisites: Network access to target · vsFTPd with backdoor present
devstral-2 · analyzed Mar 22, 2026 Full analysis →
nomisec WORKING POC
by brettsm · poc
https://github.com/brettsm/vsftpd2.3.4-backdoor-exploit

This repository contains a functional Python exploit for CVE-2011-2523, a backdoor in vsftpd 2.3.4. The exploit sends a malicious USER command to trigger the backdoor, then connects to the opened port 6200 to obtain a root shell.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: vsftpd 2.3.4
No auth needed
Prerequisites: Target running vsftpd 2.3.4 with the backdoor · Network access to the target's FTP port (21) and backdoor port (6200)
devstral-2 · analyzed Mar 20, 2026 Full analysis →
nomisec WRITEUP
by yagnikkrish · poc
https://github.com/yagnikkrish/metasploitable-penetration-testing-lab

This repository documents a penetration testing lab targeting CVE-2011-2523, a backdoor in vsFTPd 2.3.4. It includes methodology, exploitation steps using Metasploit, and mitigation strategies, but lacks actual exploit code.

Classification
Writeup 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: vsFTPd 2.3.4
No auth needed
Prerequisites: Metasploit Framework · Kali Linux · Metasploitable 2
devstral-2 · analyzed Mar 01, 2026 Full analysis →
nomisec WRITEUP
by Efehamzaa · poc
https://github.com/Efehamzaa/Metasploit-Red-Pentest-Lab

This repository appears to be a writeup or lab documentation for exploiting CVE-2011-2523, a backdoor vulnerability in vsftpd 2.3.4. The README describes a lab exercise involving the exploitation of this vulnerability on Metasploitable 2 and post-exploitation steps.

Classification
Writeup 70%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: vsftpd 2.3.4
No auth needed
Prerequisites: Access to a vulnerable vsftpd 2.3.4 instance · Network connectivity to the target
devstral-2 · analyzed Feb 19, 2026 Full analysis →
nomisec WORKING POC
by tshaq17 · poc
https://github.com/tshaq17/vsftpd-2.3.4---Backdoor-Command-Execution

This repository contains a functional exploit for CVE-2011-2523, a backdoor in vsftpd 2.3.4 that allows remote command execution as root. The exploit triggers the backdoor by sending a username containing ':)' to the FTP service, which opens a root shell on port 6200.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: vsftpd 2.3.4
No auth needed
Prerequisites: Target running vsftpd 2.3.4 · Network access to port 21 (FTP)
devstral-2 · analyzed Feb 19, 2026 Full analysis →
nomisec WRITEUP
by Mirza-22144 · poc
https://github.com/Mirza-22144/Vulnerability-Assessment-Exploitation-Lab

This repository documents a penetration test against Metasploitable 2, focusing on the exploitation of CVE-2011-2523 in vsftpd 2.3.4. It includes detailed steps for reconnaissance, exploitation using Metasploit, and post-exploitation activities like credential recovery.

Classification
Writeup 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: vsftpd 2.3.4
No auth needed
Prerequisites: Metasploitable 2 target machine · Kali Linux attacker machine · Network connectivity between attacker and target
devstral-2 · analyzed Feb 19, 2026 Full analysis →
nomisec WRITEUP
by KlyneZyro · poc
https://github.com/KlyneZyro/Metasploitable2-VAPT-Report

This repository contains a detailed VAPT report for Metasploitable 2, focusing on the exploitation of CVE-2011-2523 (vsftpd 2.3.4 backdoor) to achieve unauthenticated remote root access. It includes post-exploitation steps, persistence mechanisms, and remediation strategies.

Classification
Writeup 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: vsftpd 2.3.4
No auth needed
Prerequisites: Metasploitable 2 environment · Network access to target · Nmap for reconnaissance · Metasploit for exploitation
devstral-2 · analyzed Feb 19, 2026 Full analysis →
nomisec WORKING POC
by avivyap · poc
https://github.com/avivyap/CVE-2011-2523

This repository contains a functional exploit script for CVE-2011-2523, which targets a backdoor in vsftpd 2.3.4. The script automates the detection of the vulnerable version and triggers the backdoor to establish a reverse shell on port 6200.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: vsftpd 2.3.4
No auth needed
Prerequisites: Target must be running vsftpd 2.3.4 · Port 21 must be open and accessible · Netcat (nc) must be installed on the attacker's machine
devstral-2 · analyzed Feb 19, 2026 Full analysis →
nomisec WRITEUP
by seerat-fatima21 · poc
https://github.com/seerat-fatima21/vsftpd-exploit

This repository provides a detailed technical walkthrough of exploiting the vsFTPd 2.3.4 backdoor vulnerability (CVE-2011-2523), including reconnaissance, exploitation steps, and mitigation strategies. It documents the use of Metasploit and manual techniques to achieve remote command execution.

Classification
Writeup 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: vsFTPd 2.3.4
No auth needed
Prerequisites: Network access to the target FTP service · vsFTPd 2.3.4 running on the target
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by hklabCR · poc
https://github.com/hklabCR/CVE-2011-2523

The repository contains a functional Python exploit for CVE-2011-2523, a backdoor in vsftpd 2.3.4, which triggers a reverse shell on port 6200. It includes both a modified PoC and a manual exploitation guide using Metasploit.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: vsftpd 2.3.4
No auth needed
Prerequisites: Network access to vsftpd 2.3.4 · vsftpd 2.3.4 running on target
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by lghost256 · poc
https://github.com/lghost256/vsftpd234-exploit

This Python script exploits CVE-2011-2523, a backdoor in vsftpd 2.3.4, by sending a crafted username and password to trigger a reverse shell. It establishes a connection to the target FTP server and executes a base64-encoded payload to spawn a bash shell.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: vsftpd 2.3.4
No auth needed
Prerequisites: Target must be running vsftpd 2.3.4 with the backdoor present · Network access to the target FTP server
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WRITEUP
by JohanMV · poc
https://github.com/JohanMV/explotacion-vsftpd-nmap_Laboratorio_1

This repository provides a laboratory guide for exploiting CVE-2011-2523, a backdoor vulnerability in vsftpd 2.3.4. It includes instructions for identifying the vulnerability, selecting an exploit, and validating its effectiveness, but does not contain actual exploit code.

Classification
Writeup 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: vsftpd 2.3.4
No auth needed
Prerequisites: Access to a vulnerable vsftpd 2.3.4 instance · Network connectivity to the target
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by sug4r-wr41th · poc
https://github.com/sug4r-wr41th/CVE-2011-2523

This repository contains a functional exploit for CVE-2011-2523, a backdoor in vsFTPd 2.3.4. The exploit sends a crafted username and password to trigger the backdoor, which opens a shell on port 6200 for remote command execution.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: vsFTPd 2.3.4
No auth needed
Prerequisites: vsFTPd 2.3.4 running on target · Network access to target port 21
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by Lychi3 · poc
https://github.com/Lychi3/vsftpd-backdoor

This repository contains a functional exploit for CVE-2011-2523, a backdoor in vsftpd 2.3.4 that allows remote command execution as root. The exploit sends a maliciously crafted username (containing ':)') to trigger the backdoor, which opens a shell on port 6200.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: vsftpd 2.3.4
No auth needed
Prerequisites: Network access to the target FTP server · vsftpd 2.3.4 running on the target
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec TROJAN
by vaishnavucv · poc
https://github.com/vaishnavucv/CVE-2011-2523

The repository contains a ransomware-style message demanding Bitcoin payment for decryption, with no actual exploit code or technical details related to CVE-2011-2523. This is a deceptive attempt to extort users.

Classification
Trojan 100%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: none
No auth needed
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec SUSPICIOUS
by AnugiArrawwala · poc
https://github.com/AnugiArrawwala/CVE-Research

The repository contains no exploit code or technical details, only a link to a TryHackMe room and a video. This appears to be a social engineering lure rather than a legitimate PoC.

Classification
Suspicious 90%
Attack Type
Other
Complexity
Theoretical
Reliability
Theoretical
Target: unknown
No auth needed
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by 0xB0y426 · poc
https://github.com/0xB0y426/CVE-2011-2523-PoC

This repository contains a functional Python exploit for CVE-2011-2523, targeting vsftpd 2.3.4. The exploit leverages a backdoor in the FTP server to establish a reverse shell on port 6200, allowing remote command execution.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: vsftpd 2.3.4
No auth needed
Prerequisites: Network access to the target FTP server · vsftpd 2.3.4 running on the target
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by Tenor-Z · poc
https://github.com/Tenor-Z/SmileySploit

This repository contains a functional exploit for CVE-2011-2523, targeting the vsFTPd 2.3.4 backdoor. The exploit triggers a reverse shell by sending a crafted username with a smiley emoticon ':)' during authentication, then connects to the backdoor on port 6200.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: vsFTPd 2.3.4
No auth needed
Prerequisites: Network access to the target vsFTPd server · vsFTPd version 2.3.4 running on the target
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by Shubham-2k1 · poc
https://github.com/Shubham-2k1/Exploit-CVE-2011-2523

This repository contains a functional Python exploit for CVE-2011-2523, targeting a backdoor in VSFTPd 2.3.4. The exploit triggers the backdoor via crafted USER/PASS commands and establishes a reverse shell on port 6200.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: VSFTPd 2.3.4
No auth needed
Prerequisites: Target running VSFTPd 2.3.4 · Network access to port 21 (FTP) and 6200 (backdoor)
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WRITEUP
by XiangSi-Howard · poc
https://github.com/XiangSi-Howard/CTF---CVE-2011-2523

This repository provides a detailed walkthrough of exploiting CVE-2011-2523, a backdoor in vsftpd 2.3.4, to gain root access and exfiltrate sensitive files. It includes step-by-step instructions for setting up the environment, exploiting the vulnerability, and cracking passwords.

Classification
Writeup 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: vsftpd 2.3.4
No auth needed
Prerequisites: vsftpd 2.3.4 with backdoor · Network access to vulnerable machine · Netcat for exploitation
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by 0xSojalSec · poc
https://github.com/0xSojalSec/-CVE-2011-2523

This repository contains a functional Python exploit for CVE-2011-2523, targeting the VSFTPD 2.3.4 backdoor. The exploit sends a crafted username and password to trigger the backdoor, which opens a shell on port 6200.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: VSFTPD 2.3.4
No auth needed
Prerequisites: Network access to the target VSFTPD service · VSFTPD 2.3.4 running on the target
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by 0xSojalSec · poc
https://github.com/0xSojalSec/CVE-2011-2523

This repository contains a functional Python exploit for CVE-2011-2523, targeting the VSFTPD 2.3.4 backdoor. The exploit uses socket and telnetlib to trigger the backdoor and spawn a root shell on port 6200.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: VSFTPD 2.3.4
No auth needed
Prerequisites: Target running VSFTPD 2.3.4 · Network access to the target's FTP port (default 21)
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by Gr4ykt · poc
https://github.com/Gr4ykt/CVE-2011-2523

This repository contains a functional exploit for CVE-2011-2523, a backdoor in vsftpd 2.3.4 that listens on port 6200 for command execution. The exploit uses Telnet to authenticate and then connects to the backdoor port for an interactive shell.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: vsftpd 2.3.4
Auth required
Prerequisites: vsftpd 2.3.4 running with the backdoor · network access to the target · valid credentials for authentication
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by HerculesRD · poc
https://github.com/HerculesRD/vsftpd2.3.4PyExploit

This Python exploit targets CVE-2011-2523, a backdoor in vsftpd 2.3.4 that opens a shell on port 6200 when a specific username is used. The exploit establishes a Telnet connection to the backdoor shell after authenticating with the crafted credentials.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: vsftpd 2.3.4
Auth required
Prerequisites: vsftpd 2.3.4 with the backdoor present · network access to the target on port 21
devstral-2 · analyzed Feb 18, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
by hdm, MC · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/ftp/vsftpd_234_backdoor.rb

This Metasploit module exploits a backdoor in VSFTPD v2.3.4, which spawns a shell on port 6200 when a specific username pattern is used. It connects to the FTP service, triggers the backdoor, and establishes a command execution session.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: VSFTPD v2.3.4
No auth needed
Prerequisites: Network access to the target FTP service · VSFTPD v2.3.4 with the backdoor present
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Nuclei Templates (1)

VSFTPD 2.3.4 - Backdoor Command Execution
CRITICALVERIFIEDby pussycat0x
Shodan: product:"vsftpd"

References (6)

Core 6
Core References
Third Party Advisory x_refsource_misc
https://security-tracker.debian.org/tracker/CVE-2011-2523
Third Party Advisory x_refsource_misc
https://access.redhat.com/security/cve/cve-2011-2523
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://www.openwall.com/lists/oss-security/2011/07/11/5
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
https://packetstormsecurity.com/files/102745/VSFTPD-2.3.4-Backdoor-Command-Execution.html

Scores

CVSS v3 9.8
EPSS 0.9428
EPSS Percentile 99.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-78
Status published
Products (4)
debian/debian_linux 8.0
debian/debian_linux 9.0
debian/debian_linux 10.0
vsftpd_project/vsftpd 2.3.4
Published Nov 27, 2019
Tracked Since Feb 18, 2026