aish19siddiqua-commits/mtechweek_04Documented penetration test on an isolated Metasploitable2 VM using Metasploit and Nmap, covering remote exploitation, privilege escalation, and mitigation validation with MITRE ATT&CK mapping.
Metasploit-based penetration test on an isolated Metasploitable2 lab VM — remote exploitation via DistCC (CVE-2004-2687), privilege escalation via udev netlink (CVE-2009-1185), and vsftpd 2.3.4 backdoor analysis (CVE-2011-2523), with firewall mitigation validated end-to-end. This repository documents an authorized penetration test performed in an isolated QEMU lab against Metasploitable2, simulating a private company server. The engagement followed a full offensive-security methodology — reconnaissance, exploitation, privilege escalation, and mitigation validation — using the Metasploit Framework and Nmap. Three vulnerabilities were chained/tested: a DistCC remote command execution flaw (CVE-2004-2687), a udev netlink local privilege escalation (CVE-2009-1185), and the vsftpd 2.3.4 backdoor (CVE-2011-2523). Each finding is mapped to MITRE ATT&CK, backed by documented terminal evidence, and paired with a validated mitigation (host firewall rules + patch guidance).
