Metasploitable2-Exploit

## https://sploitus.com/exploit?id=E082BBDD-8BE1-5B2F-A235-512540C16912
# Metasploitable2 Exploitation Lab

A complete penetration testing walkthrough of **Metasploitable2**, documenting the enumeration, vulnerability analysis, exploitation, and post-exploitation of each vulnerable service.

This project was created as a hands-on learning exercise to practice penetration testing methodologies in a safe lab environment. Each service is documented individually using a consistent reporting structure similar to a professional penetration testing report.

> **Disclaimer**
>
> This project was conducted against the intentionally vulnerable **Metasploitable2** virtual machine inside a private lab environment. All techniques demonstrated here are for educational purposes only.

---

# Lab Environment

| Machine | IP Address | Operating System |
|----------|------------|------------------|
| Kali Linux (Attacker) | `192.168.29.128` | Kali Linux |
| Metasploitable2 (Target) | `192.168.29.130` | Ubuntu Linux |

---

# Methodology

The assessment followed a structured penetration testing workflow:

1. Service Discovery
2. Enumeration
3. Vulnerability Identification
4. Exploitation
5. Proof of Access
6. Impact Assessment
7. Mitigation Recommendations

Each service follows the same documentation structure:

- Service Information
- Enumeration
- Vulnerability
- Exploitation
- Proof of Access
- Impact
- Mitigations
- References

---

# Services Assessed

| Port | Service | Status | Write-up |
|------:|---------|:------:|----------|
| 21 | FTP (vsftpd) | ✅ | [21-ftp.md](ports/21-ftp.md) |
| 22 | SSH | ✅ | [22-ssh.md](ports/22-ssh.md) |
| 23 | Telnet | ✅ | [23-telnet.md](ports/23-telnet.md) |
| 25 | SMTP | ✅ | [25-smtp.md](ports/25-smtp.md) |
| 53 | DNS | ✅ | [53-dns.md](ports/53-dns.md) |
| 80 | HTTP | ✅ | [80-http.md](ports/80-http.md) |
| 111 | rpcbind | ✅ | [111-rpcbind.md](ports/111-rpcbind.md) |
| 139/445 | Samba | ✅ | [139-445-smb.md](ports/139-445-smb.md) |
| 512-514 | r-services | ✅ | [512-514-rservices.md](ports/512-514-rservices.md) |
| 1099 | Java RMI | ✅ | [1099-java-rmi.md](ports/1099-java-rmi.md) |
| 1524 | Bindshell | ✅ | [1524-bindshell.md](ports/1524-bindshell.md) |
| 2049 | NFS | ✅ | [2049-nfs.md](ports/2049-nfs.md) |
| 2121 | ProFTPD | ✅ | [2121-proftpd.md](ports/2121-proftpd.md) |
| 3306 | MySQL | ✅ | [3306-mysql.md](ports/3306-mysql.md) |
| 3632 | distccd | ✅ | [3632-distccd.md](ports/3632-distccd.md) |
| 5432 | PostgreSQL | ✅ | [5432-postgresql.md](ports/5432-postgresql.md) |
| 6667 | UnrealIRCd | ✅ | [6667-unrealircd.md](ports/6667-unrealircd.md) |
| 8180 | Apache Tomcat | ✅ | [8180-tomcat.md](ports/8180-tomcat.md) |

---

# Repository Structure

```text
metasploitable2-exploit/
│
├── README.md
├── LAB-NOTES.md
├── TOOLS.md
├── CHEATSHEET.md
│
├── ports/
│   ├── 21-ftp.md
│   ├── 22-ssh.md
│   ├── 23-telnet.md
│   ├── 25-smtp.md
│   ├── 53-dns.md
│   ├── 80-http.md
│   ├── 111-rpcbind.md
│   ├── 139-445-smb.md
│   ├── 512-514-rservices.md
│   ├── 1099-java-rmi.md
│   ├── 1524-bindshell.md
│   ├── 2049-nfs.md
│   ├── 2121-proftpd.md
│   ├── 3306-mysql.md
│   ├── 3632-distccd.md
│   ├── 5432-postgresql.md
│   ├── 6667-unrealircd.md
│   └── 8180-tomcat.md
│
└── assets/
```

---

# Tools Used

- Nmap
- Netcat
- Metasploit Framework
- Hydra
- Enum4linux
- smbclient
- rpcinfo
- showmount
- dig
- nslookup
- ftp
- ssh
- telnet
- mysql
- psql
- msfvenom
- Gobuster
- Nikto

A detailed explanation of each tool can be found in **TOOLS.md**.

---

# Skills Demonstrated

- Network Enumeration
- Service Enumeration
- Banner Grabbing
- SMB Enumeration
- DNS Enumeration
- NFS Enumeration
- Database Enumeration
- Password Attacks
- Default Credential Abuse
- Remote Code Execution
- Web Application Assessment
- Tomcat Manager Exploitation
- Reverse Shell Deployment
- Post-Exploitation Enumeration
- Vulnerability Validation
- Security Reporting

---

# Key Takeaways

This project demonstrates that not every exposed service is directly exploitable.

Some services resulted in:

- Remote Code Execution (RCE)
- Weak Credential Authentication
- Information Disclosure
- Misconfiguration Abuse

Understanding the difference between these findings is an important part of penetration testing and reporting.

---

# Related Documents

- **LAB-NOTES.md** — Chronological walkthrough of the assessment.
- **TOOLS.md** — Explanation of every tool used.
- **CHEATSHEET.md** — Quick reference of the commands used during the lab.

---

# References

- Metasploitable2
- OWASP Testing Guide
- Nmap Documentation
- Metasploit Framework
- Rapid7 Vulnerability Database
- CVE Program