## https://sploitus.com/exploit?id=6F6308A3-374C-5D08-9B85-E4ED34A741D9
# Project 2: Penetration Testing — Vulnerability Assessment & Exploitation
**Environment:** Kali Linux (attacker) + Metasploitable2 (target), isolated
UTM Shared Network
## What This Project Demonstrates
- Systematic reconnaissance and service enumeration (`nmap`)
- Exploitation of three distinct vulnerability classes: a software supply-
chain backdoor (vsftpd), a second independent supply-chain backdoor
(UnrealIRCd), and a credential/misconfiguration weakness (Tomcat Manager)
- Reproducibility validation matching real pentest report standards —
every finding re-confirmed from a clean environment state, not reported
on the strength of a single run
- Clear, evidence-based documentation mapped to MITRE ATT&CK
## Environment
| Device | Platform | IP | Role |
|---|---|---|---|
| Kali-Attacker | UTM, ARM64 native | `192.168.64.7` | Attacker |
| Metasploitable2-Target | UTM, x86_64 emulated | `192.168.64.6` | Target |
Both VMs on an isolated UTM Shared Network, with no route to the home-lab
network built in Project 1.
## Methodology
1. **Environment setup** — Kali + Metasploitable2, isolated network
2. **Reconnaissance** — full `nmap -sV` scan, 27 open ports identified,
3 flagged as exploitation targets based on known, high-confidence CVEs
and misconfigurations
3. **Exploitation** — all 3 targets successfully exploited (see individual
writeups below)
4. **Reproducibility validation** — every exploit re-run from a clean VM
boot state, independent of the original session, to confirm findings
are consistent and not a fluke
5. **Reporting** — this README, one-page playbook, and per-target writeups
## Findings Summary
| Target | Vulnerability | Access Gained | MITRE ATT&CK |
|---|---|---|---|
| vsftpd 2.3.4 (port 21) | CVE-2011-2523, supply-chain backdoor | root | T1190 |
| UnrealIRCd 3.2.8.1 (port 6667) | CVE-2010-2075, supply-chain backdoor | root | T1190 |
| Tomcat Manager (port 8180) | Default credentials (`tomcat:tomcat`) | tomcat55 (non-root) | T1110, T1078, T1505.003 |
Full detail per target: see `project2-target1-vsftpd-writeup.md`,
`project2-target2-unrealircd-writeup.md`, `project2-target3-tomcat-writeup.md`.
## Files in This Deliverable
- `project2-README.md` — this file
- `project2-playbook.md` — one-page playbook
- `project2-target1-vsftpd-writeup.md`
- `project2-target2-unrealircd-writeup.md`
- `project2-target3-tomcat-writeup.md`
- `metasploitable2_initial_scan.txt` — original Stage 2 nmap output