Metasploitable2: Reconnaissance and UnrealIRCd Backdoor Exploitation

Disclaimer

Metasploitable2 is an intentionally vulnerable virtual machine, published specifically for security training and practice. This project was carried out entirely within an isolated virtual lab that I own and control, for educational purposes only.

Overview

This project documents a full attack chain against Metasploitable2: discovering the host on the network, fingerprinting its services, identifying a known backdoor in UnrealIRCd, and exploiting it to gain shell access.

Objective

Practice and document the standard recon-to-exploitation workflow: find the target, enumerate its services, identify an exploitable vulnerability, exploit it, and confirm the level of access gained.

Lab Environment

• Attacker: Linux (Kali), Nmap, Metasploit Framework
• Target: Metasploitable2 (Ubuntu-based, intentionally vulnerable)
• Network: Private, isolated subnet (192.168.245.0/24)

Tools Used

• Nmap
• Metasploit Framework (msfconsole)
• unix/irc/unreal_ircd_3281_backdoor exploit module

Methodology

1. Ran nmap -sn 192.168.245.0/24 to discover live hosts on the subnet.
2. Ran nmap -sT -A <target-ip> to fingerprint the OS and get detailed host information.
3. Confirmed connectivity with ping.
4. Ran nmap -sV <target-ip> to enumerate open ports and service versions, which surfaced UnrealIRCd running on port 6667.
5. In Metasploit, selected unix/irc/unreal_ircd_3281_backdoor, a known exploit for a backdoor inserted into UnrealIRCd 3.2.8.1 (CVE-2010-2075).
6. Configured the payload, RHOSTS, and LHOST, then ran the exploit.
7. Confirmed shell access with whoami, which returned root.
8. Browsed the filesystem (ls -l, cd /etc) and read /etc/shadow to confirm the level of access obtained.

Results

• Nmap identified the target and its open services, including UnrealIRCd on port 6667.
• The backdoor exploit succeeded on the first attempt and returned a shell with root privileges, no separate privilege escalation needed.
• The shadow file was readable, confirming full filesystem access at the OS level.

MITRE ATT&CK Mapping

Detection & Defense Notes

• This backdoor existed because of a compromised software distribution, not a design flaw in UnrealIRCd itself. It's a strong example of why verifying package integrity (checksums, signed releases) matters.
• A shell spawned from an IRC daemon process is an unusual parent-child process relationship that host-based monitoring should flag.
• Any read access to /etc/shadow by a non-root-owned process or an unexpected session should trigger an alert in a properly configured environment.

Lessons Learned

Nmap's version detection did the heavy lifting here. Recognizing UnrealIRCd 3.2.8.1 as a specific, known-vulnerable version is what turned a generic scan result into an actual finding. That's the same skill a vulnerability analyst or SOC analyst uses when triaging scan output against a CVE database.

Limitations

Metasploitable2 has no patches or hardening applied by design. This demonstrates the exploitation mechanics, not what it takes to compromise a maintained, monitored production system.

Screenshots

• Nmap host discovery
• Service/version scan showing UnrealIRCd
• Exploit configuration
• Successful shell with whoami output
• A cropped/redacted view of the filesystem browsing (do not include the full /etc/shadow hash dump)