Vulnerability-Assessment-Exploitation-Lab

Metasploitable 2 Penetration Testing Lab

Executive Summary

This project documents a successful, full-lifecycle penetration test against the Metasploitable 2 Linux environment. The assessment follows the Penetration Testing Execution Standard (PTES), covering initial reconnaissance, exploitation, and post-exploitation credential recovery. The primary objective was to demonstrate the security risks associated with unpatched legacy services and weak password policies.

Technical Lab Architecture

Executing this lab required a specialized virtualization strategy to bridge the architecture gap on an Apple Silicon M5 chip:

• Attacker Machine: Kali Linux (ARM edition) virtualized via UTM.
• Target Machine: Metasploitable 2 (x86 architecture) emulated via UTM/QEMU.
• Networking: Configured with a Bridged Interface to allow direct, isolated communication between the ARM and x86 environments.

Phase 1: Reconnaissance and Advanced Enumeration

Initial discovery was performed via ICMP "ping" sweeps to verify host availability, followed by a deep-dive service scan to map the target's attack surface.

Command: sudo nmap -sV -O -p- -T4 192.168.1.119 -oN logs/nmap_full_scan.txt

Key Findings

The scan revealed over 30 open ports. The most critical entry point identified was vsftpd 2.3.4 on Port 21.

Phase 2: Exploitation (CVE-2011-2523)

The enumeration phase identified a notorious backdoor in the vsftpd 2.3.4 service. This vulnerability allows for unauthenticated Remote Code Execution (RCE).

Execution Flow

• Framework: Metasploit Framework (msfconsole).
• Exploit: exploit/unix/ftp/vsftpd_234_backdoor.
• Payload: cmd/unix/interact.
• Result: After an initial timeout due to emulation latency, a second attempt successfully triggered the backdoor and provided a command shell with Root (UID 0) privileges.

Phase 3: Post-Exploitation and Credential Recovery

With root access established, the focus shifted to demonstrating the impact of data exfiltration and credential theft.

Data Exfiltration

• File Access: I successfully accessed the /etc/shadow file, which contains encrypted password hashes for all system users.
• Documentation: This proves that any attacker with root access can gain persistent access by cracking or replacing user passwords.

Offline Cracking via John the Ripper

I performed an offline dictionary attack to recover plain-text credentials. The use of the outdated MD5-crypt ($1$) algorithm allowed for near-instantaneous recovery of system accounts.

Remediation Strategy

Based on the findings, the following security controls are recommended:

• Update Services: Decommission vsftpd 2.3.4 and replace it with a modern, secure file transfer protocol like SFTP.
• Password Policy: Enforce a minimum 12-character password complexity requirement to mitigate dictionary attacks.
• Upgrade Hashing Algorithms: Migrate system password storage from MD5 to SHA-512 ($6$) or Yescrypt.
• Network Segmentation: Implement firewalls to close unnecessary management ports like Telnet and RSH.

Skills Demonstrated

• Virtualization and Emulation (UTM/QEMU)
• Network Protocol Analysis (Nmap)
• Vulnerability Assessment and CVE Research
• Remote Code Execution (Metasploit)
• Cryptography and Password Hash Analysis (John the Ripper)