Share 
## https://sploitus.com/exploit?id=526EF479-7495-5D09-B63D-CC1532C21508
# Penetration Testing Lab Notes
## CyberShield Security β€” Junior Penetration Tester Training

---

## Lab Environment

| Component | Details |
|-----------|---------|
| Attacker | Kali Linux β€” 192.168.100.29 |
| Target 1 | Metasploitable 2 β€” 192.168.100.4 |
| Target 2 | Metasploitable 2 β€” 192.168.100.5 |
| Network | VirtualBox NAT Network β€” 192.168.100.0/24 |
| Framework | Metasploit v6.4.135 |

---

## Repository Structure

```
pentest-lab-notes/
β”œβ”€β”€ README.md                              ← this file
β”œβ”€β”€ task1-service-identification/
β”‚   └── notes.md    β€” ip a, ping, nmap alternatives, scan results
β”œβ”€β”€ task2-module-selection/
β”‚   └── notes.md    β€” search, 4-filter method, payload types, LHOST vs RHOSTS
β”œβ”€β”€ task3-validating-viability/
β”‚   └── notes.md    β€” check column, smb_version, smbclient, netcat
β”œβ”€β”€ task4-exploit-execution/
β”‚   └── notes.md    β€” exploit, session opened, reverse shell flow diagram
β”œβ”€β”€ task5-session-validation/
β”‚   └── notes.md    β€” enumeration, /etc/passwd, ifconfig, ps aux, payload in process list
└── task6-additional-options/
    └── notes.md    β€” bind shell, reverse vs bind comparison, meterpreter upgrade
```

---

## Engagement Summary

### Target 1 β€” 192.168.100.4 (vsftpd exercise)

| Item | Detail |
|------|--------|
| Vulnerability | vsftpd 2.3.4 backdoor β€” CVE-2011-2523 |
| Module | exploit/unix/ftp/vsftpd_234_backdoor |
| Payload | cmd/unix/interact (auto-selected, no config needed) |
| Access | root (uid=0) |
| Session type | Meterpreter |
| Key lesson | Backdoor exploits β€” no payload configuration required |

### Target 2 β€” 192.168.100.5 (Samba exercise)

| Item | Detail |
|------|--------|
| Vulnerability | Samba 3.0.20 username map script β€” CVE-2007-2447 |
| Module | exploit/multi/samba/usermap_script |
| Payload 1 | cmd/unix/reverse_netcat (reverse shell) |
| Payload 2 | cmd/unix/bind_perl (bind shell) |
| Payload 3 | meterpreter x86/linux (upgraded from shell) |
| Access | root (uid=0) all three times |
| Session type | Command shell β†’ upgraded to Meterpreter |
| Key lesson | Payload types, LHOST/RHOSTS, shell upgrade without re-exploitation |

---

## The 6-Task Methodology

```
Task 1 β€” Identify     β†’  ip a, ping, nmap -sV
Task 2 β€” Select       β†’  search, 4 filters, set RHOSTS/PAYLOAD/LHOST/LPORT
Task 3 β€” Validate     β†’  check command OR manual: smb_version + smbclient
Task 4 β€” Exploit      β†’  exploit, session opened, access confirmed
Task 5 β€” Enumerate    β†’  id, whoami, uname -a, cat /etc/passwd, ifconfig, ps aux
Task 6 β€” Extend       β†’  try alternate payloads, background, sessions -u
```

---

## Key Concepts Reference

### LHOST vs RHOSTS β€” Never Mix These Up
```
RHOSTS = 192.168.100.5    the TARGET  (where you attack)
LHOST  = 192.168.100.29   YOUR Kali   (where the shell calls back)
```

### Reverse vs Bind Shell
```
Reverse:  Target ──outbound──► Kali listener
          Target calls you. Bypasses inbound firewall rules.
          Preferred for real engagements.

Bind:     Kali ──inbound──► Target listener
          You call the target. Fails behind NAT/firewall.
          Useful when target is directly reachable.
```

### Module Rank Priority
```
excellent β†’ great β†’ good β†’ normal β†’ average β†’ low β†’ manual
Always start with excellent rank modules.
```

### Payload Type Quick Reference
```
cmd/unix/reverse_netcat     simple reverse shell, netcat
cmd/unix/bind_perl          bind shell via Perl
cmd/unix/reverse_bash       reverse shell via /dev/tcp
linux/x86/meterpreter/reverse_tcp    staged meterpreter
linux/x86/meterpreter_reverse_tcp    stageless meterpreter
```

### nmap Quick Reference
```
nmap -sV 192.168.100.5              standard version scan
nmap -Pn -sV 192.168.100.5         skip host discovery (fix for ARP hang)
nmap -sS -sV 192.168.100.5         SYN scan, stealthier
nmap -sV -p 21,22,80,139,445       specific ports only, fastest
```

---

## Services Found on Target 2 (192.168.100.5)

| Port | Service | Version | CVE | Exploitable |
|------|---------|---------|-----|-------------|
| 21 | ProFTPD | 1.3.1 | CVE-2010-4221 | Yes β€” excellent |
| 22 | OpenSSH | 4.7p1 | β€” | Brute force only |
| 23 | Telnet | β€” | β€” | Credential access |
| 25 | Postfix | β€” | β€” | Limited |
| 53 | BIND | 9.4.2 | β€” | Limited |
| 80 | Apache | 2.2.8 | β€” | Web app testing |
| 139/445 | Samba | 3.0.20 | CVE-2007-2447 | Yes β€” excellent βœ“ used |
| 3306 | MySQL | 5.0.51a | β€” | No root password |
| 5432 | PostgreSQL | 8.3 | β€” | Post-auth only |
| 8009 | AJP13 | β€” | β€” | Ghostcat potential |
| 8180 | Tomcat | 1.1 | β€” | WAR upload RCE |