## https://sploitus.com/exploit?id=52E1DCC8-B09B-57A6-8B9B-2AF1C1E5A94A
# Metasploitable2 – Post-Exploitation Enumeration (Manual & Automated)
## Overview
This repository documents Week 3 of a self-directed Ethical Hacking Internship (Secure Dev Labs, Batch 03): the **Post-Exploitation Enumeration** phase of the penetration testing lifecycle. Building on Initial Access obtained during Week 2, the goal was to move past "having a shell" and into structured enumeration — first **manually**, across system, user, network, and file-system layers, then **automatically** using LinPEAS to validate findings and surface anything manual review missed.
> ⚠️ All activity in this repository was performed exclusively against Metasploitable2 — a machine intentionally built to be attacked — running in an isolated, self-owned local lab network. No real systems, companies, or user data were targeted. Where enumeration surfaced live credential material (password hashes, cleartext secrets), that material has been **redacted** from this repository and replaced with a description of the finding and its security implication, consistent with responsible disclosure practice. This project is for educational/portfolio purposes only.
## Environment
| Component | Details |
|---|---|
| Attacker machine | Kali Linux (VMware Workstation) |
| Target | Metasploitable2 (VMware, isolated Host-Only/NAT network) |
| Attacker IP | `192.168.164.128` |
| Target IP (Metasploitable2) | `192.168.164.129` |
| Access method | Pre-spawned root backdoor shell, TCP port 1524 (identified in Week 2) |
## Methodology
1. **Re-establish access** — Reconnected to the target via the port 1524 root backdoor using Netcat, carried over unchanged from Week 2's Initial Access.
2. **Manual system enumeration** — OS, kernel, hostname, architecture, running services, scheduled tasks, and environment variables.
3. **Manual user & privilege enumeration** — Local users, groups, administrative accounts, login history, password policy, and privilege-escalation paths.
4. **Manual network enumeration** — Interfaces, routing, ARP cache, DNS, listening services, and active connections.
5. **Manual file-system enumeration** — Home directories, shared folders (Samba/NFS), configuration files, backups, logs, and temporary files.
6. **Automated enumeration** — Ran LinPEAS against the target to cross-check manual findings and identify additional privilege-escalation vectors, including kernel-exploit matching.
7. **Documentation** — Captured evidence (command output, screenshots) for each phase; sensitive credential material redacted before publishing.
## Findings Summary
| # | Area | Key Result | Severity |
|---|---|---|---|
| 1 | User & Privilege Enumeration | `msfadmin` → full root via an active `%admin` sudoers rule, combined with default credentials | 🔴 Critical |
| 2 | File System Enumeration | MySQL `root` account configured with a **blank password** (confirmed via 3 independent sources) | 🔴 Critical |
| 3 | File System Enumeration | NFS exports the **entire root filesystem** to any host, read/write, with `no_root_squash` | 🔴 Critical |
| 4 | File System Enumeration | Samba `[tmp]` share allows **unauthenticated guest read/write** access | 🔴 Critical |
| 5 | File System Enumeration | `/etc/hosts.equiv` and per-user `.rhosts` grant wildcard (`+ +`) r-command trust | 🔴 Critical |
| 6 | Automated Enumeration | Kernel 2.6.24 matches multiple known local privilege-escalation CVEs (incl. Dirty COW) | 🟠 High |
| 7 | File System Enumeration | A ready-to-run anti-forensic log-wiping script (`reset_logs.sh`) found in root's home directory | 🟠 High |
| 8 | Automated Enumeration | MySQL service runs as the `root` OS user rather than a restricted account | 🟠 High |
| 9 | Automated Enumeration | PostgreSQL accepts MD5-authenticated connections from **any** address (`0.0.0.0/0`) | 🟠 High |
| 10 | User & Privilege Enumeration | No account password expiry or minimum-length policy enforced system-wide | 🟡 Medium |
**21 findings** were documented in total across the five enumeration areas — 5 rated Critical, 8 High, 6 Medium, 2 Low. Full writeups for each area, including evidence and remediation guidance, are in [`/findings`](./findings).
## Manual vs. Automated
A deliberate design choice of this project was running **manual enumeration first, automated second** — see [`findings/05-automated-enumeration-linpeas.md`](./findings/05-automated-enumeration-linpeas.md) for the full comparison. In short: manual review surfaced trust-relationship and file-system findings a generic scanner is less likely to prioritize (`hosts.equiv`, `.rhosts`, the anti-forensic script), while LinPEAS surfaced service-hardening and kernel-CVE-matching findings that would be impractical to establish by hand.
## Key Skills Demonstrated
- Manual Linux post-exploitation enumeration across system, user, network, and file-system layers
- Reading and interpreting Linux permission models, `sudoers` rules, and legacy trust files (`.rhosts`, `hosts.equiv`)
- Identifying insecure service configurations (Samba, NFS, PostgreSQL, vsftpd) from their own config files
- Automated privilege-escalation enumeration with LinPEAS, including kernel-version-to-CVE matching
- Cross-validating manual findings against an automated tool to strengthen evidentiary confidence
- Structuring and documenting a professional, evidence-backed enumeration report, with responsible redaction of sensitive material
## Tools Used
See [`tools-used.md`](./tools-used.md) for the full toolkit and versions.
## Disclaimer
All enumeration activity documented in this repository was performed exclusively against Metasploitable2, an intentionally vulnerable virtual machine legally owned and operated by the author inside an isolated Host-Only/NAT lab network — never bridged to a real network. No production systems, third-party infrastructure, or real-world targets were involved. No unauthorized testing was performed against any third-party or production system.