Metasploitable2 Exploitation Lab

A complete penetration testing walkthrough of Metasploitable2, documenting the enumeration, vulnerability analysis, exploitation, and post-exploitation of each vulnerable service.

This project was created as a hands-on learning exercise to practice penetration testing methodologies in a safe lab environment. Each service is documented individually using a consistent reporting structure similar to a professional penetration testing report.

Disclaimer

This project was conducted against the intentionally vulnerable Metasploitable2 virtual machine inside a private lab environment. All techniques demonstrated here are for educational purposes only.

---

Lab Environment

Machine	IP Address	Operating System
Kali Linux (Attacker)	192.168.29.128	Kali Linux
Metasploitable2 (Target)	192.168.29.130	Ubuntu Linux

---

Methodology

The assessment followed a structured penetration testing workflow:

1. Service Discovery
2. Enumeration
3. Vulnerability Identification
4. Exploitation
5. Proof of Access
6. Impact Assessment
7. Mitigation Recommendations

Each service follows the same documentation structure:

• Service Information
• Enumeration
• Vulnerability
• Exploitation
• Proof of Access
• Impact
• Mitigations
• References

---

Services Assessed

Port	Service	Status	Write-up
21	FTP (vsftpd)	✅	Port-21.md
22	SSH	✅	Port-22.md
23	Telnet	✅	Port-23.md
25	SMTP	✅	Port-25.md
53	DNS	✅	Port-53.md
80	HTTP	✅	Port-80.md
111	rpcbind	✅	Port-111.md
139/445	Samba	✅	Port-139-445.md
512-514	r-services	✅	Port-512-514.md
1099	Java RMI	✅	Port-1099.md
1524	Bindshell	✅	Port-1524.md
2049	NFS	✅	Port-2049.md
2121	ProFTPD	✅	Port-2121.md
3306	MySQL	✅	Port-3306.md
3632	distccd	✅	Port-3632.md
5432	PostgreSQL	✅	Port-5432.md
6667	UnrealIRCd	✅	Port-6667.md
8180	Apache Tomcat	✅	Port-8180.md

---

Repository Structure

.
├── Ports/
|   ├── Port-21.md
|   ├── Port-22.md
|   ├── Port-23.md
|   ├── Port-25.md
|   ├── Port-53.md
|   ├── Port-80.md
|   ├── Port-111.md
|   ├── Port-139-445.md
|   ├── Port-512-514.md
|   ├── Port-1099.md
|   ├── Port-1524.md
|   ├── Port-2049.md
|   ├── Port-2121.md
|   ├── Port-3306.md
|   ├── Port-3632.md
|   ├── Port-5432.md
|   ├── Port-6667.md
|   └── Port-8180.md
|
├── LAB-NOTES.md
├── LICENSE
├── README.md
└── TOOLS.md

---

Tools Used

• Nmap
• Netcat
• Metasploit Framework
• Hydra
• Enum4linux
• smbclient
• rpcinfo
• showmount
• dig
• nslookup
• ftp
• ssh
• telnet
• mysql
• psql
• msfvenom
• Gobuster
• Nikto

A detailed explanation of each tool can be found in TOOLS.md.

---

Skills Demonstrated

• Network Enumeration
• Service Enumeration
• Banner Grabbing
• SMB Enumeration
• DNS Enumeration
• NFS Enumeration
• Database Enumeration
• Password Attacks
• Default Credential Abuse
• Remote Code Execution
• Web Application Assessment
• Tomcat Manager Exploitation
• Reverse Shell Deployment
• Post-Exploitation Enumeration
• Vulnerability Validation
• Security Reporting

---

Key Takeaways

This project demonstrates that not every exposed service is directly exploitable.

Some services resulted in:

• Remote Code Execution (RCE)
• Weak Credential Authentication
• Information Disclosure
• Misconfiguration Abuse

Understanding the difference between these findings is an important part of penetration testing and reporting.

---

Related Documents

• LAB-NOTES.md — Chronological walkthrough of the assessment.
• TOOLS.md — Explanation of every tool used.

---

References

• Metasploitable2
• OWASP Testing Guide
• Nmap Documentation
• Metasploit Framework
• Rapid7 Vulnerability Database
• CVE Program