## https://sploitus.com/exploit?id=88054789-E1E3-5DA3-86E4-387A3D4ACCA8
# Task 4: Exploitation & System Security
**Cybersecurity & Ethical Hacking Internship — ApexPlanet Software Pvt. Ltd.**
**Timeline:** Days 37–48
## Project Overview
This project demonstrates a complete, controlled penetration testing workflow against **Metasploitable2**, a deliberately vulnerable Linux virtual machine, using **Kali Linux** as the attacking platform. The engagement covers exploitation of a known FTP backdoor, post-exploitation enumeration, password attacks via brute force and offline hash cracking, a phishing-awareness simulation, malware analysis fundamentals, and system hardening with measurable before/after results.
All activity was performed inside an isolated, host-only VirtualBox network with no internet-facing exposure. No systems outside this lab were accessed or targeted at any point.
## Objectives
- Exploit a known, CVE-documented vulnerability (vsftpd 2.3.4 backdoor, CVE-2011-2523) using Metasploit
- Perform structured post-exploitation enumeration and identify indicators of compromise (IOCs)
- Demonstrate SSH credential brute-forcing with Hydra
- Extract and crack password hashes offline with John the Ripper
- Build a harmless phishing-awareness demonstration page
- Cover malware categories and static analysis fundamentals using a benign EICAR test file
- Harden the target against the demonstrated vulnerability and verify the fix with a before/after network scan
## Tools Used
| Category | Tool |
|---|---|
| Attacker OS | Kali Linux |
| Target OS | Metasploitable2 (Ubuntu 8.04, kernel 2.6.24-16-server) |
| Exploitation | Metasploit Framework (msfconsole) |
| Port/Service Scanning | Nmap |
| Password Attacks | Hydra, John the Ripper |
| Hypervisor | Oracle VirtualBox (Host-Only Adapter) |
## Virtual Lab Setup
| Machine | Role | IP Address |
|---|---|---|
| Kali Linux | Attacker | 192.168.56.10 |
| Metasploitable2 | Target | 192.168.56.101 |
Both machines are attached to a **VirtualBox Host-Only Network**, isolating the lab from any external or bridged network interface. This was verified with `ping`, `ifconfig`/`ip addr`, and `route` before any exploitation began.
### Network Diagram
```
┌─────────────────────┐ Host-Only Network ┌──────────────────────────┐
│ Kali Linux │◄──────────────────────────────────►│ Metasploitable2 │
│ 192.168.56.10 │ 192.168.56.0/24 │ 192.168.56.101 │
│ (Attacker) │ │ (Target) │
└─────────────────────┘ └──────────────────────────┘
```
## Ethical Disclaimer
This project was conducted **exclusively** against a deliberately vulnerable machine (Metasploitable2) that I own and control, inside an isolated virtual lab with no route to any production system, third-party network, or the public internet. No technique demonstrated here was used, or is intended to be used, against any system without explicit authorization. This work is submitted strictly for educational purposes as part of a structured internship curriculum.
## Learning Outcomes
- Applied the full penetration testing methodology (recon → scanning → exploitation → post-exploitation → reporting) against a real, if intentionally vulnerable, Linux target
- Learned that Metasploit's default payload selection is build-dependent — the same exploit module required different configuration (LHOST/payload) than documentation examples assumed, reinforcing the need to check `show options` rather than copy commands blindly
- Learned that legacy Linux systems often run services under **xinetd** rather than standalone init scripts, which changes how those services are located, restarted, and disabled
- Observed that a one-shot backdoor shell (vsftpd's port 6200 listener) is fragile: it does not clean up correctly after failed reconnection attempts, leaving stale `CLOSE_WAIT` sockets — a real, network-visible indicator of compromise
- Practiced the distinction between disabling a vulnerable service and blocking its port at the firewall (`filtered` vs. `closed` vs. `open` in Nmap output), and why both layers matter for defense-in-depth
- Understood that offline package-based patching isn't always available (Metasploitable2's repositories are unreachable by design), requiring manual/targeted remediation instead
## Repository Structure
```
Task4-Exploitation-System-Security/
├── README.md # This file
├── REPORT.md # Full penetration testing report
├── screenshots/ # Evidence for every phase
├── notes/ # Raw command logs, working notes
├── commands/ # Reusable command references
├── metasploit/ # Exploitation phase artifacts
├── hydra/ # Brute-force attack logs
├── john/ # Password cracking artifacts
├── phishing/ # Phishing-awareness demo page
├── malware-analysis/ # EICAR-based analysis notes
├── hardening/ # Before/after scan results, hardening steps
└── report-assets/ # Diagrams, supporting images for REPORT.md
```
## Installation / Lab Setup Guide
To reproduce this lab environment:
1. Install [Oracle VirtualBox](https://www.virtualbox.org/).
2. Download and import **Kali Linux** (attacker machine) as a VirtualBox VM.
3. Download **Metasploitable2** ([sourceforge.net/projects/metasploitable](https://sourceforge.net/projects/metasploitable/)) and import it as a second VM.
4. In VirtualBox, set both VMs' network adapters to **Host-Only Adapter**, on the same host-only network.
5. Boot both machines. Confirm connectivity:
```bash
# On Kali
ip addr show
ping 192.168.56.101
```
6. Log into Metasploitable2 with the default lab credentials (`msfadmin:msfadmin`) only to verify it's reachable — do not rely on this account existing on any non-lab system.
**Do not** bridge either VM's network adapter to a physical NIC or Wi-Fi interface. This lab is only safe to run fully isolated.
## Usage
Each phase's commands are documented in `REPORT.md` and mirrored as raw logs in `notes/`. To follow along:
```bash
# Example: re-run the core exploitation phase
msfconsole -q -x "use exploit/unix/ftp/vsftpd_234_backdoor; set RHOSTS 192.168.56.101; set LHOST 192.168.56.10; run"
```
Full command sequences for scanning, exploitation, password attacks, and hardening are in `commands/` and referenced by phase in `REPORT.md`.
## Screenshots
All evidence screenshots are stored in `screenshots/`, numbered and named by phase (e.g. `phase4-exploit-session.png`, `phase6-netstat-close-wait.png`, `phase7-hydra-success.png`, `phase8-john-cracked.png`, `phase9-phishing-page.png`, `phase10-eicar-analysis.png`, `phase11-nmap-before-after.png`). See `REPORT.md` for inline context on what each one demonstrates.
## License
This project is released under the [MIT License](LICENSE) for the documentation and original code/scripts authored here (e.g. the phishing-awareness demo page). Metasploit, Nmap, Hydra, and John the Ripper are third-party tools used under their own respective licenses and are not redistributed in this repository.
## References
- [CVE-2011-2523 — vsftpd 2.3.4 Backdoor](https://nvd.nist.gov/vuln/detail/CVE-2011-2523)
- [Rapid7 — vsftpd_234_backdoor Metasploit Module](https://www.rapid7.com/db/modules/exploit/unix/ftp/vsftpd_234_backdoor/)
- [Metasploitable2 Documentation](https://docs.rapid7.com/metasploit/metasploitable-2/)
- [OWASP Top 10](https://owasp.org/www-project-top-ten/)
- [MITRE ATT&CK Framework](https://attack.mitre.org/)
- [THC-Hydra](https://github.com/vanhauser-thc/thc-hydra)
- [John the Ripper](https://www.openwall.com/john/)
## Scope Note
Remediation in this project targeted the **specific demonstrated vulnerability** (vsftpd 2.3.4 backdoor) and a small
set of legacy unauthenticated services (chargen, daytime, discard, echo, time). Metasploitable2 intentionally
hosts many other outdated, vulnerable services (Samba, UnrealIRCd, distccd, unauthenticated PostgreSQL/MySQL, VNC,
NFS, telnet, rlogin/rexec) that were **not** in scope for this task's remediation and remain present —
this is noted explicitly rather than implied to be fixed.