Exploit for cis-hardening-metasploitable2

## https://sploitus.com/exploit?id=07E68362-FB5F-5D82-B351-1C1F6C4681C5
# CIS Benchmark Hardening in Practice: A Full Attack-to-Remediation Case Study on Metasploitable2

_Mapping 5 real exploits to CIS, MITRE ATT&CK, and ISO 27001 — then proving remediation actually works._

## Overview

This project answers a practical question: does hardening guidance like CIS Benchmarks actually hold up against real exploits, and how do you validate that it does?

A deliberately vulnerable Linux host (Metasploitable2) was attacked using 5 real-world vulnerabilities, each mapped to CVE, MITRE ATT&CK, CIS Benchmark, and ISO 27001 controls. Remediation was then applied following CIS guidance - some services were eliminated entirely as unnecessary attack surface, others were retained under a simulated business-justification scenario and hardened instead, with custom SIEM detection rules built as a compensating control. Every exploit was re-tested post-hardening to confirm remediation actually held.

## Architecture



_IPs illustrative — see [docs/01-architecture.md](docs/01-architecture.md) for full network detail._

Metasploitable2 (Ubuntu 8.04 base) has no modern Wazuh agent support due to library incompatibility, so all target monitoring is syslog-based - an intentional, realistic constraint reflecting how legacy/unsupported systems are often handled in real environments.

## What This Project Demonstrates

-   **CIS Benchmark-driven vulnerability assessment** — applying CIS Ubuntu controls to a legacy system with no exact-version benchmark match, and documenting that adaptation honestly
    
-   **Risk-based remediation decision-making** — eliminate → if unnecessary vs. harden and monitor → if business justified, applied deliberately rather than uniformly
    
-   **Multi-framework mapping** — every finding tied to CVE/CVSS, MITRE ATT&CK, CIS, and ISO 27001
    
-   **Compensating control engineering** — custom SIEM (Wazuh) detection rules written, tested (`wazuh-logtest`), and validated live for services retained under hardening
    
-   **Full lifecycle validation** — baseline attack → gap analysis → remediation → retest, not just a one-way hardening checklist
    

## Key Findings



 before/after detection results: [docs/03-findings-table.md](docs/03-findings-table.md)

**Baseline result**: 0 of 5 attacks were detected by the SIEM prior to hardening - for two distinct root causes, not one. See [docs/02-methodology.md](docs/02-methodology.md) for the gap analysis.

## Repository Structure

```
cis-hardening-metasploitable2/
├── README.md
├── docs/
│   ├── 01-architecture.md       Lab setup, network, tooling
│   ├── 02-methodology.md        Phase-by-phase process, gap analysis
│   ├── 03-findings-table.md     Full master table (CVE/MITRE/CIS/ISO/results)
│   └── 04-lessons-learned.md    Operational and technical lessons
└── screenshots/
    ├── phase1-baseline/
    ├── phase3-hardening/
    └── phase5-retest/

```

Configuration snippets and custom rule logic are described in the docs.

## Tech Stack

Wazuh 4.14.6 · VirtualBox (NAT Network) · Metasploitable2 · Kali Linux · Debian 12 · CIS Ubuntu 12.04 Benchmark (closest available reference to MS2's Ubuntu 8.04 base) · Metasploit Framework

## Full Writeup

Detailed narrative, technical deep-dives, and lessons learned: [Medium Link](https://divyanshu-g.medium.com/cis-benchmark-hardening-in-practice-a-full-attack-to-remediation-case-study-on-metasploitable2-b35d078da360)