The vulnerability you are likely referring to is the vsftpd 2.3.4 Backdoor (often misremembered as "2.0.8" or other versions), a classic supply-chain attack that allowed remote command execution. The Exploit: VSFTPD 2.3.4 Backdoor (CVE-2011-2523)
, a version often found in older systems or vulnerable-by-design machines like Metasploitable 2
The backdoor was elegantly simple: if a user attempted to log in with a username that ended in a smiley face— —the server would quietly open a root shell on
Metasploit Framework: The official Metasploit module code, which is the most reliable way to test for this vulnerability in a controlled environment. How to Identify if You are Vulnerable