Project 5 — Offensive Security & Adversary Emulation

Part of a 5-project home-lab SOC arc: build → detect & enrich → investigate → monitor & hunt → attack & cross-check.

This project adds the missing half of the picture from Projects 1–4: everything before this was blue team (building detections, investigating incidents, hunting through network data). This one puts me on the attacker's side — reconnaissance, exploitation, and post-exploitation against a real, documented vulnerability — then turns back to the existing SOC to measure what it actually caught.

Summary

Attack Chain at a Glance

Recon (Nmap)  →  Exploit (Metasploit: vsftpd backdoor)  →  Root shell (Meterpreter)
     →  Dump /etc/shadow  →  Crack hash (John)  →  Verify via SSH login
     →  Cross-check against Wazuh / Suricata / Zeek

Key Findings

1. A 2011 CVE still provides a full, realistic attack chain today — from initial recon to root access to credential exposure, with no modern hardening standing in the way on an unpatched host.
2. Root access doesn't end the story — it starts a new one. Root let me dump password hashes, crack one instantly (msfadmin:msfadmin), and prove it worked as a second, independent way into the system via plain SSH — meaning patching the FTP bug alone wouldn't fully secure this host.
3. The target had zero host-based SOC visibility. No Wazuh agent was installed on Metasploitable, so the exploit, the root shell, and the credential access were completely invisible to host-based monitoring — a direct illustration of "you can't detect what you don't monitor."
4. Network-based monitoring (Zeek) was the only visibility layer available — and getting it working uncovered a real chain of 4-5 separate, distinct bugs, from a wrong network interface to a stale config path to an agent needing a full restart rather than a soft one. Full breakdown in docs/04-blue-team-cross-check.md.
5. Suricata (signature-based) correctly stayed silent on a valid-credential SSH login — a legitimate finding about the limits of signature-based detection, not a gap.

Documentation

• docs/01-reconnaissance.md — Nmap scanning, vulnerability identification
• docs/02-exploitation.md — Metasploit module selection and exploitation
• docs/03-post-exploitation.md — credential dumping, cracking, verification
• docs/04-blue-team-cross-check.md — SOC detection gap analysis and the real debugging chain behind it

Lab Environment

• Kali — physical host and attack machine (Nmap, Metasploit, John the Ripper, Suricata, Zeek)
• Metasploitable2 — deliberately vulnerable target VM
• Network — VirtualBox Host-only Adapter (192.168.56.x), the same network introduced in Project 4 so that Kali (the host) could directly reach and monitor traffic to/from the target
• Existing SOC (Projects 1–4) — Wazuh SIEM, Suricata IDS, Zeek NSM, used here purely as the "blue team" side of this engagement

Screenshots

See screenshots/, organized by phase.