Disclaimer: This penetration test was conducted in a private, isolated VMware lab environment for educational purposes only. No real systems were accessed. All IP addresses have been anonymised.
Overview
| Field | Details |
|---|
| Tester | Prafullya Shandilya |
| Target | Metasploitable 2 (Intentionally Vulnerable VM) |
| Attacker | Kali Linux |
| Network | Isolated VMware Host-Only Lab |
| Date | 09 May 2026 |
| Tools | Nmap 7.95, Metasploit v6.4.94, Netcat |
Findings Summary
Methodology
Phase 1 — Reconnaissance → Nmap port scan (-sV -sC)
Phase 2 — Vulnerability ID → Analysed 23 open ports
Phase 3 — Exploitation → Metasploit + manual Netcat
Phase 4 — Post Exploitation → whoami, id, uname, passwd dump
Phase 5 — Documentation → Full report with evidence
Key Results
- 23 open ports identified in reconnaissance
- 2 independent root shells obtained via different attack vectors
- 30 user accounts extracted from /etc/passwd
- 5 additional critical CVEs identified but not exploited
Repository Structure
metasploitable-pentest-report/
├── README.md ← This file
├── pentest-report.docx ← Full professional report
├── nmap_results.txt ← Anonymised Nmap output
├── finding-01-bindshell-port1524.txt ← Finding 1 evidence
├── finding-02-vsftpd-CVE-2011-2523.txt ← Finding 2 evidence
└── screenshots/
├── 01_nmap_scan.png ← Nmap terminal output
├── 02_bindshell_root.png ← Root shell via netcat
└── 03_vsftpd_exploit.png ← Root shell via Metasploit
Lab Environment
About the Tester
- Name: Prafullya Shandilya
- Education: B.Tech, Computer Science — BRCM CET, MDU University
- Certification: Certified Ethical Hacker (CEH) — Ducat India
- Internship: Cybersecurity Engineer — Unityfusion Tech Solution Pvt. Ltd.
- Location: Bangalore, India
- Email: [email protected]
- LinkedIn: [Your LinkedIn URL]
All testing was performed legally in a private lab. No real systems were harmed.
prafullya-shandilya/metasploitable-pentest-report
