## https://sploitus.com/exploit?id=D38E83F9-3A93-5052-940B-A328EE11AC87
# Enterprise Network Penetration Testing Lab
A self-built, isolated penetration-testing engagement against a legacy Windows 2000
target, performed end-to-end using industry-standard methodology: reconnaissance →
enumeration → vulnerability identification → exploitation → post-exploitation →
professional reporting.
## Objective
Demonstrate practical, hands-on penetration-testing skills by identifying and
exploiting real, historically significant Windows vulnerabilities in a fully
isolated lab environment, then documenting the engagement the way a professional
pentest report is written — with validated findings, evidence, CVE references,
MITRE ATT&CK mapping, and remediation guidance.
## Lab Architecture
The target machine was kept entirely on an isolated VMware network segment with no
bridged adapter, no connection to the host LAN, and no internet access — standard
safe-lab practice for working with intentionally vulnerable legacy systems.
## Scope
| Item | Detail |
|---|---|
| Attacker | Kali Linux (VMware), `192.168.18.132` |
| Target | Windows 2000 Professional SP4, `192.168.18.129`, hostname `TP088281` |
| Network | Isolated VMware virtual network, `192.168.18.0/24` |
| Authorization | Self-owned lab environment; no external systems in scope |
## Tools Used
- **Nmap** — host discovery, service/version scanning, NSE vulnerability scripts
- **Metasploit Framework** — vulnerability validation and exploitation
- **Meterpreter / windows/shell payloads** — post-exploitation access
## Methodology
1. **Reconnaissance** — Nmap service and version scanning
2. **Enumeration** — SMB protocol, OS discovery, and share enumeration via Nmap NSE
3. **Vulnerability Identification** — Nmap `--script vuln` plus Metasploit module
research targeted at the confirmed OS/service pack
4. **Exploitation** — Controlled exploitation of five distinct critical
vulnerabilities, each validated before and/or during exploitation
5. **Post-Exploitation** — Privilege/group verification via `net localgroup
administrators`, system identification via `ver` / `hostname`
6. **Reporting** — Full professional write-up in [`report/`](report/)
## Findings Summary
| # | Vulnerability | CVE | Severity | Result |
|---|---|---|---|---|
| 1 | MS08-067 (Server Service) | CVE-2008-4250 | Critical | ✅ Exploited — remote shell |
| 2 | MS05-039 (Plug and Play) | CVE-2005-1983 | Critical | ✅ Exploited — remote shell |
| 3 | MS06-040 (Server Service) | CVE-2006-3439 | Critical | ✅ Exploited — remote shell |
| 4 | MS04-011 (LSASS) | CVE-2003-0533 | Critical | ✅ Exploited — remote shell |
| 5 | MS04-007 (ASN.1 / KillBill) | CVE-2004-0221 | Critical | ✅ Exploited — remote shell |
Full technical detail, evidence, and remediation guidance for each finding is in the
[penetration-testing report](report/penetration-testing-report.docx).
## Repository Structure
```
enterprise-pentest/
├── README.md
├── scans/ # Raw Nmap output (.txt)
├── evidence/ # Screenshots of validation & exploitation
├── reconnaissance/ # Recon notes
├── enumeration/ # Enumeration notes
├── exploitation/ # Per-finding exploitation notes
├── privilege-escalation/ # Post-exploitation notes
├── mitre-mapping/ # MITRE ATT&CK technique mapping
├── methodology/ # Methodology writeup
└── report/
└── penetration-testing-report.docx
```
## What I Learned
- How to move through a full pentest methodology — from a single Nmap scan to a
complete professional deliverable — rather than jumping straight to exploitation
- The difference between a **scanner-reported vulnerability** and a **validated
finding**: several Nmap/Metasploit results needed manual confirmation before
being trusted (e.g. an incorrectly-flagged MS17-010 result was ruled out because
it doesn't affect Windows 2000)
- That exploitation isn't always clean on the first attempt — several modules
needed a payload change (Meterpreter → `windows/shell/reverse_tcp`) or a retry
after transient service instability before succeeding
- How repeated exploitation of legacy, unpatched services can itself degrade
target stability — a real demonstration of why timely patching matters
- How to write findings the way a professional engagement does: with CVE
references, severity ratings, validation methodology, and remediation guidance,
not just "I got a shell"
## Safety Note
This project was conducted entirely within an isolated home lab against
intentionally vulnerable, self-owned virtual machines. No production systems,
third-party infrastructure, or public-facing hosts were involved. No passwords,
hashes, or other sensitive data were captured or published in this repository.