Skip to content

LAB-NOTES.md

Latest commit

 

History

History
163 lines (113 loc) · 3.19 KB

LAB-NOTES.md

File metadata and controls

163 lines (113 loc) · 3.19 KB
Raw

Metasploitable2 Lab Notes

Overview

This document contains the chronological notes taken during the penetration test of the Metasploitable2 virtual machine.

The objective of this assessment was to discover exposed services, identify vulnerabilities, exploit them where applicable, and document the findings.

Lab Environment

Machine IP Address
Kali Linux 192.168.29.128
Metasploitable2 192.168.29.130

Phase 1 — Reconnaissance

The first step was identifying active hosts and discovering exposed services.

Initial scan:

nmap -Pn -sS -sV -sC -O -p- 192.168.29.130

The scan identified numerous vulnerable services including:

  • FTP
  • SSH
  • Telnet
  • SMTP
  • DNS
  • HTTP
  • SMB
  • NFS
  • MySQL
  • PostgreSQL
  • UnrealIRCd
  • Tomcat
  • DistCC
  • Java RMI
  • ProFTPD

Each service was then assessed individually.

Phase 2 — Enumeration

Each discovered service was enumerated to identify:

  • Software version
  • Authentication mechanisms
  • Available shares
  • Exported resources
  • Web applications
  • Running services
  • Database contents

Enumeration tools included:

  • Nmap NSE
  • Enum4linux
  • smbclient
  • rpcinfo
  • showmount
  • Dig
  • Nikto
  • Gobuster
  • Netcat

Phase 3 — Exploitation

The following attack techniques were successfully demonstrated.

Remote Code Execution

  • vsftpd Backdoor
  • Samba username map script
  • DistCC RCE
  • UnrealIRCd Backdoor
  • ProFTPD Backdoor
  • Tomcat WAR Deployment
  • Bindshell

Weak Credentials

Successful authentication was achieved against:

  • SSH
  • Telnet
  • MySQL
  • PostgreSQL
  • Tomcat Manager

Misconfigurations

The assessment identified insecure configurations including:

  • Anonymous NFS exports
  • Exposed Java RMI Registry
  • Public rpcbind service
  • Information disclosure through DNS
  • Web application exposure

Phase 4 — Post Exploitation

Following successful compromise, the following verification steps were performed when applicable:

whoami
id
hostname
pwd
uname -a

Database services were verified using native SQL commands, while file-sharing services were validated through mounted shares and accessible resources.

Key Findings

Category Examples
Remote Code Execution vsftpd, Samba, DistCC, UnrealIRCd, Tomcat
Weak Credentials SSH, Telnet, MySQL, PostgreSQL
Misconfiguration NFS, rpcbind, Java RMI
Information Disclosure DNS, HTTP

Lessons Learned

Throughout this assessment several important penetration testing concepts were reinforced.

  • Enumeration is often more valuable than exploitation.
  • Weak credentials remain a common attack vector.
  • Misconfigurations frequently lead to compromise.
  • Not every exposed service is directly exploitable.
  • Post-exploitation validation is essential to demonstrate impact.
  • Accurate documentation is as important as successful exploitation.

Conclusion

The Metasploitable2 laboratory provides an excellent environment for learning penetration testing methodologies.

This assessment covered the complete workflow from reconnaissance through exploitation, impact assessment, and mitigation recommendations while emphasizing accurate documentation and reproducible results.