vsftpd-2.3.4---Backdoor-Command-Execution

vsftpd-2.3.4---后门命令执行 vsftpd 2.3.4（CVE-2011-2523）是一个严重漏洞，可导致获取 Root Shell。在本仓库中，我将手动和自动（Python）方式逐步演示如何利用该漏洞，仅供教育目的。 该漏洞是什么？ 首先，这是一个服务端漏洞，因此我们可以远程利用它。其原理是：当使用包含 : 的用户名连接默认端口 21 上的 FTP 服务时，系统会被触发打开一个 TCP 端口 6200，并提供一个 Root Shell，这样任何人都可以连接并获取目标服务器的 Root 访问权限，这简直是灾难。那么让我们一步步实际操作。我会先手动解释以让你全面了解，然后提供...

CVE-2026-88282

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled FTP username containing shell metacharacters to be executed as arbitrary root commands during a subsequent FTP-account update...

CVE-2026-88282 GV-LPCLPC2011/2211 - Stored FTP-Username Command Injection

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled FTP username containing shell metacharacters to be executed as arbitrary root commands during a subsequent FTP-account update...

EUVD-2026-75316

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled FTP username containing shell metacharacters to be executed as arbitrary root commands during a subsequent FTP-account update...

CVE-2026-88282

GeoVision GV-LPC2211 (LPC series) V1.13 contains a stored command injection vulnerability in its FTP username field. An administrator who sets an FTP username containing shell metacharacters can trigger arbitrary root command execution during a subsequent FTP-account update operation. The vulnera...

PT-2026-89323

🚨 HIGH: CVE-2026-88282 CVSS 7.2 GeoVision GV-LPC2211 V1.13 vulnerable to command injection via FTP username with shell metacharacters. Admin-level exploit leads to arbitrary root command execution. CVE Vulnerability PatchNow https://t.co/IQAFupHc3X...

vsFTPd-2.3.4-Exploit

vsFTPd 2.3.4 漏洞利用 针对 vsFTPd 2.3.4 后门的 Python 概念验证 — CVE-2011-2523 描述 vsFTPd（Very Secure FTP Daemon）是一款常用于类 Unix 系统的 FTP 服务器。 2011 年发布的 vsFTPd 2.3.4 版本被植入了恶意后门。这并非 vsFTPd 代码本身存在的正常漏洞 ，而是分发的源代码包被篡改，其中包含了一个后门。 当被篡改的版本处理包含 : 的特制 FTP 用户名时，后门可以在 TCP 端口 6200 上打开一个命令 Shell。 本项目是一个小型 Python...

Exploit for OS Command Injection in Vsftpd_Project Vsftpd

vsftpd 2.3.4 Backdoor Exploit A small, dependency-free Python...

EUVD-2005-1962

Malware in sbrugna...

CVE-2025-50927

A reflected cross-site scripting XSS vulnerability in the List All FTP User Function in EHCP v20.04.1.b allows authenticated attackers to execute arbitrary JavaScript via injecting a crafted payload into the ftpusername parameter...

CVE-2005-1960

The getemails function in C.J. Steele Tattle allows remote attackers to execute arbitrary commands via shell metacharacters in certain log entries, as demonstrated using shell metacharacters in an FTP username...

CVE-2024-8264 Sensitive information in agent log file when detailed logging is enabled with Robot Schedule Enterprise prior to version 3.05

Fortra's Robot Schedule Enterprise Agent prior to version 3.05 writes FTP username and password information to the agent log file when detailed logging is enabled...

CVE-2024-8264

CVE-2024-8264 affects Fortra’s Robot Schedule Enterprise Agent prior to version 3.05. When detailed logging is enabled, the agent logs FTP usernames and passwords, exposing credentials. The threat is described across multiple sources in the connected documents, which confirm the vulnerability is ...

Titan FTP Server 6.26.630 SITE WHO Denial of Service

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Titan FTP Server 6.26.630 SITE WHO DoS', 'Description' = %q The Titan FTP server v6.26 build 630 can be DoS'd by issuing "SITE WHO". You need a...

CVE-2005-1960

The getemails function in C.J. Steele Tattle allows remote attackers to execute arbitrary commands via shell metacharacters in certain log entries, as demonstrated using shell metacharacters in an FTP username...

CVE-2005-1960

The getemails function in C.J. Steele Tattle allows remote attackers to execute arbitrary commands via shell metacharacters in certain log entries, as demonstrated using shell metacharacters in an FTP username...

DeluxeFtp 6.x - Local Password Disclosure

DeluxeFtp 6.x - Local Password Disclosure / DeluxeFtp 6.x Local Password Disclosure Exploit by Kozan Application: DeluxeFtp 6.x and probably prior versions Vendor: www.deluxeftp.com Vulnerable Description: DeluxeFtp 6.x discloses passwords to local users. Bug Discovered by: Lostmon Exploit Coded...