## https://sploitus.com/exploit?id=D5929A9C-0BAE-5BF5-9D2D-8E59DD6AC615
# CY376 Red Team Project — Exploiting Known CVEs in a Deliberately Vulnerable Lab Environment
**Student:** Joseph Ahenkora
**Index Number:** FCM.41.018.024.23
**Course:** CY376 — Network Monitoring, Security and Auditing
**Team:** Red Team
## Summary
This repository contains the supporting evidence, methodology notes, and
final report for a red-team assessment carried out against Metasploitable3,
an intentionally vulnerable virtual machine, inside an isolated,
instructor-approved lab network. Two vulnerabilities were identified and
exploited:
1. **CVE-2015-3306** — an unauthenticated arbitrary file copy vulnerability
in the `mod_copy` module of ProFTPD 1.3.5, exploited via Metasploit's
`exploit/unix/ftp/proftpd_modcopy_exec` module to obtain an interactive
reverse shell.
2. **SQL Injection** in a custom Payroll web application (`payroll_app.php`),
allowing authentication bypass and extraction of employee records and
stored account credentials.
Full technical detail, methodology, CVSS analysis, MITRE ATT&CK mapping, and
remediation guidance for both findings is in the final report under `docs/`.
## Tools Used
- Kali Linux (attacker platform)
- Nmap 7.99 — service/version enumeration
- Metasploit Framework 6.4.135-dev — exploitation of CVE-2015-3306
- Firefox — manual SQL injection testing
- VMware Workstation — hypervisor, isolated Host-Only lab network
## Repository Structure
```
.
├── docs/ Final report (.docx and .pdf)
├── evidence/
│ ├── exploit1_proftpd_cve-2015-3306/ Screenshots — recon through shell access
│ └── exploit2_sqli_payroll/ Screenshots — SQLi discovery through extraction
├── scripts/
│ ├── 01_recon_nmap.sh Nmap command used for service enumeration
│ ├── 02_exploit1_proftpd_modcopy.rc Metasploit resource script (module config used)
│ └── 03_exploit2_sqli_payloads.md SQL injection payloads and notes
└── README.md
```
## How to Run
All commands below assume an isolated lab network with a Metasploitable3
target reachable from a Kali attacker VM. **Do not run against any host you
do not own or have not been authorised to test.**
```bash
# 1. Reconnaissance
bash scripts/01_recon_nmap.sh
# 2. Exploit 1 — CVE-2015-3306 (ProFTPD mod_copy)
msfconsole -r scripts/02_exploit1_proftpd_modcopy.rc
# 3. Exploit 2 — SQL injection
# Manual, browser-based — see scripts/03_exploit2_sqli_payloads.md for the
# payloads used against the Payroll Login form.
```
## Evidence
Screenshots for each exploit are captioned and referenced by figure number in
the final report (`docs/CY376_RedTeam_Report_FCM.41.018.024.23.pdf`); raw
copies are kept under `evidence/` in chronological order for each exploit.
## Scope and Ethics
All testing described in this repository was carried out exclusively against
an intentionally vulnerable virtual machine (Metasploitable3) inside an
isolated, host-only virtual network with no route to the internet or any
production system, as part of an instructor-approved CY376 course exercise.
No real user data was used or accessed at any point. Nothing in this
repository is intended for use outside that controlled lab context.