emilebarnard242/pentest-metasploitable2Structured penetration testing lab documenting a full attack chain from network reconnaissance to root exploitation of vsftpd 2.3.4 backdoor, with blue team detection notes and MITRE ATT&CK mapping.
Disclaimer: This lab was conducted entirely within an isolated virtual network between two locally-hosted VMs. No external systems, live networks, or real infrastructure were targeted at any point. All techniques demonstrated are for educational purposes only and were delivered as a structured lecture to peers.
This repository documents a structured penetration testing lecture delivered using a Kali Linux attacker VM and a Metasploitable2 target VM. The goal was to walk through a realistic attack chain — from passive network observation through to root-level access on the victim machine — using industry-standard tools found in real SOC and red team environments.
The lab was designed to bridge the gap between theory and practice, showing how each phase of the attack lifecycle connects to the next. The network was fully isolated between the two VMs to contain all traffic, prevent any unintended scanning of the host network, and ensure that Wireshark captures remained clean and contained.
The lecture was delivered to peers and received strong positive feedback, particularly around the clarity of the kill chain walkthrough and the live Wireshark demonstration.
[Phase 1] Network Isolation & Traffic Observation → Wireshark on eth0 [Phase 2] Reconnaissance → nmap -sV service version scan [Phase 3] Target Enumeration → Metasploitable2 web interface review [Phase 4] Exploitation → vsftpd 2.3.4 backdoor via Metasploit [Phase 5] Post-Exploitation → Root shell confirmed, wall broadcast
| Component | Details |
|---|---|
| Attacker VM | Kali Linux (192.168.56.102) |
| Target VM | Metasploitable2 Ubuntu (192.168.56.101) |
| Network | Host-only isolated adapter (no internet) |
| Tools Used | Wireshark, Nmap, Metasploit Framework |
| Exploit | unix/ftp/vsftpd_234_backdoor |
| Outcome | Root shell on target (uid=0(root)) |
Wireshark — understanding how to isolate and filter traffic to observe the TCP handshake, HTTP requests and responses, and DHCP activity between two hosts. This is the kind of packet analysis that underlies incident response and network forensics.
Nmap — using service version detection (-sV) to build an accurate picture of
what is running on a target. A SOC analyst needs to understand what attackers see
during reconnaissance in order to detect and triage it effectively.
Metasploit — understanding how a known CVE (vsftpd 2.3.4 backdoor) is weaponised and how the framework automates payload delivery. Recognising the indicators of this attack in logs and network traffic is a direct SOC skill.
Post-exploitation — understanding what an attacker does once they have a root shell, and how evidence of those actions manifests across the system.
Royal Navy Transitioning into Cybersecurity
Certifications: CompTIA Security+ | Splunk Core Certified User (SPLK-1001)
Currently studying: Blue Team Labs (BTL1) — exam targeted August 2026
