prafullya-shandilya/metasploitable-pentest-reportBlack-box penetration test on Metasploitable 2 — Identified 3 critical vulnerabilities including CVE-2011-2523. Conducted in isolated VMware lab. Tools: Nmap, Metasploit, Netcat.
| Field | Details |
|---|
| Tester | Prafullya Shandilya |
| Target | Metasploitable 2 (Intentionally Vulnerable VM) |
| Attacker | Kali Linux |
| Network | Isolated VMware Host-Only Lab |
| Date | 09 May 2026 |
| Tools | Nmap 7.95, Metasploit v6.4.94, Netcat |
| # | Vulnerability | Port | CVE | Severity | Result |
|---|---|---|---|---|---|
| 1 | Open Root Bindshell | 1524/tcp | N/A | 🔴 Critical | Root shell obtained |
| 2 | vsftpd 2.3.4 Backdoor | 21/tcp | CVE-2011-2523 | 🔴 Critical | Root shell obtained |
| 3 | Sensitive Data Exposure | N/A | N/A | 🟠 High | 30 user accounts dumped |
Phase 1 — Reconnaissance → Nmap port scan (-sV -sC)
Phase 2 — Vulnerability ID → Analysed 23 open ports
Phase 3 — Exploitation → Metasploit + manual Netcat
Phase 4 — Post Exploitation → whoami, id, uname, passwd dump
Phase 5 — Documentation → Full report with evidence
metasploitable-pentest-report/
├── README.md ← This file
├── pentest-report.docx ← Full professional report
├── nmap_results.txt ← Anonymised Nmap output
├── finding-01-bindshell-port1524.txt ← Finding 1 evidence
├── finding-02-vsftpd-CVE-2011-2523.txt ← Finding 2 evidence
└── screenshots/
├── 01_nmap_scan.png ← Nmap terminal output
├── 02_bindshell_root.png ← Root shell via netcat
└── 03_vsftpd_exploit.png ← Root shell via Metasploit
| Machine | Role | OS |
|---|---|---|
| Attacker | Kali Linux | Debian-based Linux |
| Target | Metasploitable 2 | Ubuntu 8.04 (Intentionally Vulnerable) |
| Host | VMware Workstation | Windows 11 |
| Network | Host-Only (Isolated) | No internet connection |
All testing was performed legally in a private lab. No real systems were harmed.