vulnerability-exploitation-initial-access

## https://sploitus.com/exploit?id=162BC9F4-28E1-5B08-ADCC-A996E13E1A76
# Metasploitable2 – Vulnerability Exploitation & Initial Access

## Overview
This repository documents Week 2 of a self-directed Ethical Hacking Internship (Secure Dev Labs, Batch 03): the **Vulnerability Exploitation & Initial Access** phase of the penetration testing lifecycle. Building on the [Week 1 reconnaissance findings](https://github.com/AyeshaKhan-Enigma/pre-exploitation-recon), this phase moves from passive observation to active validation — confirming which of the previously identified vulnerabilities can genuinely be exploited, and to what level of access they grant.

> ⚠️ All exploitation activity was performed exclusively against Metasploitable2, a machine intentionally built to be attacked, legally owned and operated by the intern inside an isolated Host-Only/NAT lab network — never bridged to a real network. No production systems, third-party infrastructure, or real-world targets were involved. This project is for educational/portfolio purposes only.

## Environment

| Component | Details |
|---|---|
| Attacker machine | Kali Linux (VMware Workstation) |
| Target machine | Metasploitable2 (VMware, isolated Host-Only/NAT network) |
| Attacker IP | `192.168.164.128` |
| Target IP (Metasploitable2) | `192.168.164.129` |

## Methodology

1. **Recon review & prioritization** — Reviewed the 23 open ports from Week 1, mapped them to known CVEs and default-configuration weaknesses, and prioritized 7 attack vectors by severity and exploitability.
2. **Vulnerability validation** — Confirmed each candidate vulnerability against the live service (version banners, automated pre-exploitation checks) before attempting exploitation.
3. **Controlled exploitation** — Attempted exploitation of each validated vulnerability using the Metasploit Framework, recording both successful and unsuccessful attempts with full command output and screenshots.
4. **Initial Access verification** — Confirmed privilege level obtained (root vs. limited user) and session stability for every successful exploit.
5. **Documentation** — Captured evidence (command output, screenshots) for each attempt; all local VM usernames/hostnames consistent with Week 1.

## Findings Summary

| # | Target | Vulnerability | Method | Result |
|---|---|---|---|---|
| 1 | Backdoor shell (1524/tcp) | Unauthenticated root shell | Netcat direct connect | ✅ Root |
| 2 | vsftpd 2.3.4 (21/tcp) | CVE-2011-2523 | Metasploit module | ✅ Root |
| 3 | UnrealIRCd (6667/tcp) | CVE-2010-2075 | Metasploit module | ✅ Root |
| 4 | Samba (139/tcp) | CVE-2007-2447 | Metasploit module | ✅ Root |
| 5 | Tomcat Manager (8180/tcp) | Weak credentials | Credential brute-force | ❌ Unsuccessful |
| 6 | PostgreSQL (5432/tcp) | Default credentials | Metasploit module | ✅ postgres (non-root) |
| 7 | Java RMI (1099/tcp) | Unauthenticated registry | Metasploit module | ✅ Root |

**6 of 7 prioritized attack vectors were successfully exploited** — 5 yielding full root-level Initial Access, 1 yielding limited non-root service-account access, and 1 (Tomcat Manager) thoroughly tested and confirmed unexploitable with the credentials attempted.

Full writeups for each finding, including evidence and remediation guidance, are in [`/findings`](./findings).

## Key Skills Demonstrated

- Prioritizing an attack surface by CVE severity and exploitability
- Metasploit Framework workflow: module selection, `RHOSTS`/`LHOST`/payload configuration, execution
- Distinguishing root vs. limited-privilege access, and verifying session stability
- Validating a vulnerability (banner/version checks) before committing to exploitation
- Documenting both successful and unsuccessful exploitation attempts with equal rigor
- Real-world troubleshooting: attacker-side network recovery, payload/port-conflict resolution, tool installation

## Tools Used

See [`tools-used.md`](./tools-used.md) for full environment/tool versions.

## Disclaimer

All exploitation activity was performed exclusively against Metasploitable2, an intentionally vulnerable practice machine, running in an isolated, self-owned lab environment. No unauthorized testing was performed against any third-party or production system.