## https://sploitus.com/exploit?id=9150DFCF-4BDD-5D2E-B527-5E5AC292A4A9
# Metasploitable2 Penetration Testing Series
A series of vulnerability verification and exploitation write-ups performed against **Metasploitable2**, an intentionally vulnerable Linux VM used for security training. Each finding was independently enumerated, exploited, and documented with full methodology, command sequences, and remediation guidance.
**Lab environment:** Kali Linux (audit host) → Metasploitable2 (target), isolated virtual network.
## Findings
| # | Finding | Severity | CVE | Technique |
|---|---------|----------|-----|-----------|
| 1 | [vsFTPd 2.3.4 Backdoor](./01-vsftpd-backdoor) | Critical | CVE-2011-2523 | Malicious binary trigger → root shell on TCP 6200 |
| 2 | [SSH Credential Brute-Force](./02-ssh-bruteforce) | Critical | — | Dictionary + username-as-password attack via Metasploit |
| 3 | [rlogin Unauthenticated Root Access](./03-rlogin-unauth-root) | Critical | — | Legacy r-services trust misconfiguration |
| 4 | [Slowloris HTTP DoS](./04-slowloris-dos) | High | — | Low-bandwidth connection-exhaustion denial of service |
| 5 | [MySQL Unauthenticated Root Access](./05-mysql-unauth-root) | High | — | Remote root DB access with no password |
| 6 | [Telnet Cleartext Credential Capture](./06-telnet-cleartext) | High | CWE-319 | Passive traffic capture + Wireshark stream analysis |
| 7 | [Linux Hardening Checklist](./07-linux-hardening-checklist) | — | — | 30-point hardening methodology (Kali VM baseline) |
## Methodology
Each write-up follows the same structure:
1. **Reconnaissance** — service/port identification
2. **Exploitation** — step-by-step attack execution with commands
3. **Verification** — proof of access (shell, credentials, or service impact)
4. **Remediation** — concrete fix, mapped to the relevant CWE/compliance control where applicable
## Tooling
Metasploit Framework, Nmap, Hydra, Wireshark/tcpdump, native Linux/MySQL/FTP/Telnet clients.
## Disclaimer
All testing was performed exclusively against an isolated, intentionally vulnerable lab target (Metasploitable2) for educational purposes. No production systems or third-party infrastructure were involved.
---
**Author:** Fares Khzouz