Overview
This project documents a structured penetration test conducted against a Metasploitable2 virtual machine — an intentionally vulnerable Linux system designed for security training. Using Kali Linux as the attack platform and the Metasploit Framework (MSF), I performed a full offensive cycle: from passive network discovery through to active exploitation and post-exploitation shell access.
The lab environment used an isolated host-only network, ensuring all activity remained ethical and contained. Every step followed a methodical approach aligned with real-world penetration testing workflows.
Lab Environment
Attacker Machine
Kali Linux — Metasploit Framework, Nmap, Netcat
Target Machine
Metasploitable2 — intentionally vulnerable Linux distro
Network
Isolated host-only network — no external exposure
Framework
Metasploit Framework 6 (msfconsole)
Phase 1 — Reconnaissance
The engagement began with an Nmap scan to fingerprint open ports, running services, and OS details on the target.
Phase 2 — Exploitation
With services identified, I targeted multiple known CVEs using Metasploit modules. Below are the key exploits executed during the assessment.
VSFTPd 2.3.4 Backdoor (CVE-2011-2523)
Exploited the backdoor command injection vulnerability in VSFTPd 2.3.4. A smiley-face username :) triggers a root shell on port 6200. Gained immediate root access within seconds of connection.
Samba "username map script" RCE (CVE-2007-2447)
Used exploit/multi/samba/usermap_script against Samba 3.0.20. The misconfigured username map script allowed arbitrary command injection via the Samba MSRPC call, yielding a root Meterpreter session.
UnrealIRCd 3.2.8.1 Backdoor (CVE-2010-2075)
Leveraged a compiled-in backdoor in UnrealIRCd 3.2.8.1 running on port 6667. Sending the magic string AB; followed by a shell command executes it server-side with daemon privileges.
Telnet — Default / Weak Credential Access
Authenticated to the Telnet service (port 23) using default credentials msfadmin:msfadmin. Gained interactive shell access, then escalated privileges by leveraging SUID binaries found on the filesystem.
MySQL — Anonymous / Blank Root Login
Accessed MySQL (port 3306) with blank root password. Enumerated databases and user hashes with select user, password from mysql.user, then cracked the hashes offline to retrieve credentials used elsewhere on the system.
Metasploit Session — Samba Exploit
Phase 3 — Post-Exploitation
After gaining root shells via multiple vectors, post-exploitation tasks were performed to simulate full compromise impact assessment:
Credential Harvesting
Dumped /etc/shadow and MySQL user hashes. Cracked MD5 hashes using John the Ripper to reveal plaintext credentials used across services.
File System Enumeration
Identified sensitive files, SUID binaries, cron jobs, and world-writable scripts that would allow persistent re-entry or privilege escalation.
Persistence Mechanisms
Simulated backdoor persistence by writing an authorized SSH key to root's ~/.ssh/authorized_keys, demonstrating long-term access capability.
Network Pivoting Potential
Mapped internal network interfaces and ARP tables from the compromised host to identify further pivot targets — simulating a real lateral movement scenario.
CVEs Exploited
Key Takeaways
This exercise reinforced several critical offensive and defensive security lessons:
- Unpatched services are catastrophic. Every exploited service ran a version with a known, documented CVE — highlighting the importance of continuous patch management.
- Default credentials remain the easiest attack vector. Telnet and MySQL access was trivial due to unchanged default passwords.
- Metasploit's automation power is real. Gaining root shells within minutes of identifying services illustrates why security teams must assume breach and monitor for lateral movement.
- Defense-in-depth matters. No single control would have stopped all attack vectors — only layered security (firewall, patching, credential hygiene, network segmentation) reduces overall risk.