Meritshot EdTech — Deep Scan Credentialed Lab | Step-by-Step Guide CONFIDENTIAL

MERITSHOT EDTECH | CYBERSECURITY PROGRAM

Ethical Hacking & Penetration Testing — Project 2

DEEP SCAN CREDENTIALED

VULNERABILITY ASSESSMENT LAB
Step-by-Step Lab Guide with Real Nessus Platform Screenshots

Target [Link] (Metasploitable2)

Scanner Nessus Professional 10.7.2

Scan Type Advanced Credentialed Scan

SSH Credentials msfadmin / msfadmin

Validation Tool Nmap 7.94

Total Steps 12 Steps (Layer 1 + Layer 2)

Total Findings 47 Vulnerabilities (12 Critical)

Date May 2026

Prepared by Meritshot Cybersecurity Team

Classification CONFIDENTIAL — Lab Use Only

Nessus Credentialed Scan — Metasploitable2 | [Link] | May 2026 Page

Meritshot EdTech — Deep Scan Credentialed Lab | Step-by-Step Guide CONFIDENTIAL

Overview — What Is a Credentialed Scan?

A credentialed (authenticated) vulnerability scan allows the Nessus scanner to log into the target system using
valid credentials — in this case SSH username/password for Metasploitable2. Unlike unauthenticated scans that
only see the network surface, credentialed scans inspect the system from the inside: installed packages, kernel
version, running service configurations, file permissions, and local security policies.

This document walks through all steps of the Deep Scan lab from first to last, with a realistic platform screenshot
for every action performed.

Layer 1: Vulnerability Identification & Scanning Layer 2: Analysis & Reporting

Step 1: Start Metasploitable2, verify IP Step 1: Analyze individual vulnerability details

Step 2: Open Nessus at [Link] Step 2: Validate findings using Nmap

Step 3: Create Advanced Scan + configure target Step 3: Review severity levels (Critical/High/Med/Low)

Step 4: Configure SSH credentials (msfadmin) Step 4: Export Nessus report as PDF/HTML

Step 5: Configure Discovery & Assessment settings Step 5: Generate AI VAPT report using Claude

Step 6: Save and Launch scan —

Step 7: View scan results dashboard —

Nessus Credentialed Scan — Metasploitable2 | [Link] | May 2026 Page

Meritshot EdTech — Deep Scan Credentialed Lab | Step-by-Step Guide CONFIDENTIAL

Layer 1: Vulnerability Identification & Credentialed Scanning

Layer 1 | Step 1: Start Target Machine — Metasploitable2

Boot the Metasploitable2 virtual machine in your lab environment. Once booted, log in and verify the IP address
that will be used as the scan target.

Actions Performed:
• Start Metasploitable2 VM in VirtualBox / VMware
• Login with default credentials: msfadmin / msfadmin
• Run ifconfig to confirm the target IP address

Command executed:
ifconfig

Result:
inet addr: [Link] Bcast:[Link] Mask:[Link]

Step 1 — ifconfig output confirming Metasploitable2 target IP: [Link]

Parameter Value

Target IP [Link]

OS Ubuntu 8.04 LTS (Hardy Heron) — Linux 2.6.24

Hostname [Link]

Default Login msfadmin / msfadmin

Nessus Credentialed Scan — Metasploitable2 | [Link] | May 2026 Page

Meritshot EdTech — Deep Scan Credentialed Lab | Step-by-Step Guide CONFIDENTIAL

Layer 1 | Step 2: Open Nessus — Login to Web Interface

Open the Kali Linux browser and navigate to the Nessus web interface. Nessus runs as a local service on port
8834 with HTTPS.

Actions Performed:
1. Open Firefox or Chromium in Kali Linux
2. Navigate to: [Link]
3. Accept the self-signed SSL certificate warning
4. Enter Nessus admin credentials and click Sign In

URL accessed:
[Link]

Step 2 — Nessus Professional login screen at [Link]

After successful login, you will see the My Scans dashboard. The scanner shows Connected status indicating it is
ready to perform scans.

Layer 1 | Step 3: Create Advanced Scan

From the My Scans dashboard, create a new scan using the Advanced Scan template. This template enables full
plugin coverage including credentialed checks, local security checks, and patch auditing.

Nessus Credentialed Scan — Metasploitable2 | [Link] | May 2026 Page

Meritshot EdTech — Deep Scan Credentialed Lab | Step-by-Step Guide CONFIDENTIAL

Navigation Path:
1. Click New Scan button (top right)
2. In the Scan Templates library, select Advanced Scan
3. Advanced Scan provides maximum plugin coverage with credential support

Step 3a — New Scan template selection — Advanced Scan selected

Scan Configuration — Basic Settings:

1. Enter Name: Credentialed_Scan_Metasploitable2
2. Enter Target: [Link]
3. Set Port Range: 1-65535 (full TCP/UDP scan)
4. Set Folder: My Scans

Nessus Credentialed Scan — Metasploitable2 | [Link] | May 2026 Page

Meritshot EdTech — Deep Scan Credentialed Lab | Step-by-Step Guide CONFIDENTIAL

Step 3b — Advanced Scan basic configuration: name, target IP [Link], port range 1-65535

Layer 1 | Step 4: Configure SSH Credentials

Navigate to the Credentials tab in the scan configuration. Adding valid SSH credentials transforms this from an
external scan into a credentialed deep scan — dramatically increasing the number and accuracy of findings.

Navigation Path:
1. In scan config, click the Credentials tab
2. Click Add Credentials
3. Select SSH from the credential type list

SSH Credential Configuration:

Field Value

Authentication Method Password

Username msfadmin

Password msfadmin

SSH Port 22 (default)

Privilege Escalation sudo (escalate to root for full audit)

Nessus Credentialed Scan — Metasploitable2 | [Link] | May 2026 Page

Meritshot EdTech — Deep Scan Credentialed Lab | Step-by-Step Guide CONFIDENTIAL

Step 4 — Credentials tab: SSH credentials configured with msfadmin/msfadmin, sudo escalation enabled

What credentialed scanning enables beyond unauthenticated scanning:

• Enumeration of all installed packages via dpkg -l
• Kernel version and OS patch level inspection
• Reading /etc/passwd, /etc/sudoers, and service configuration files
• Detection of SUID/SGID binaries and world-writable directories
• Comparison of installed package versions against CVE databases

Layer 1 | Step 5: Configure Discovery & Assessment Settings

Configure what the scan checks. The Discovery tab controls how Nessus finds and enumerates the target. The
Assessment tab controls what vulnerability and compliance checks are performed.

Discovery Settings (Ports tab):

• Port Scanning: Enable — Full range 1-65535
• Service Discovery: Enable — Banner grabbing and service version detection
• OS Identification: Enable — Fingerprint the target OS
• Host Enumeration: Enable — ARP and ICMP discovery

Assessment Settings:
• Patch Auditing: Enable — Compare installed packages vs CVE database
• Vulnerability Checks: Enable — Run all vulnerability detection plugins

Nessus Credentialed Scan — Metasploitable2 | [Link] | May 2026 Page

Meritshot EdTech — Deep Scan Credentialed Lab | Step-by-Step Guide CONFIDENTIAL

• Malware Scan: Enable — MD5 hash comparison against known malware

• Configuration Audit: Enable — Check service configurations against best practices

• Local Security Checks: Enable — Inspect local firewall, permissions, accounts

Step 5 — Discovery and Assessment settings: all critical checks enabled for deep credentialed scan

Layer 1 | Step 6: Save and Launch Scan

With all configuration complete — target IP set, SSH credentials added, and all discovery/assessment settings
enabled — save the scan configuration and launch it. Nessus will authenticate into the target and begin a
comprehensive assessment.

Actions Performed:
1. Click Save to save scan configuration
2. Click the Launch button (play icon) to start the scan
3. Monitor scan progress in the My Scans list

What Nessus does during the scan:

• Connects to port 22 and authenticates with msfadmin SSH credentials
• Escalates privileges via sudo to obtain root-level access
• Runs dpkg -l to enumerate all installed packages
• Checks service banners on all 23 open ports

Nessus Credentialed Scan — Metasploitable2 | [Link] | May 2026 Page

Meritshot EdTech — Deep Scan Credentialed Lab | Step-by-Step Guide CONFIDENTIAL

• Reads configuration files: /etc/ssh/sshd_config, /etc/[Link], etc.

• Cross-references findings against the Tenable vulnerability database (190,000+ plugins)
• Generates findings with CVSS scores, CVE references, and remediation steps

Step 6 — Scan running: 75% progress, 8 Critical found, live plugin log showing vsftpd backdoor and UnrealIRCd detected

Scan duration: approximately 43 minutes for Metasploitable2 with full port range and all plugins enabled.

Layer 1 | Step 7: Open Scan Results — Vulnerabilities Dashboard

After the scan completes, click on the scan name and navigate to the Vulnerabilities tab. The dashboard shows
all findings grouped by severity with color-coded severity bars.

Actions Performed:
1. Click on Credentialed_Scan_Metasploitable2 in My Scans
2. Click the Vulnerabilities tab
3. Review the severity summary cards at the top
4. Scroll through the findings list sorted by CVSS score

Nessus Credentialed Scan — Metasploitable2 | [Link] | May 2026 Page

Meritshot EdTech — Deep Scan Credentialed Lab | Step-by-Step Guide CONFIDENTIAL

Step 7 — Scan results dashboard: 12 Critical, 15 High, 11 Medium, 6 Low, 3 Informational findings

CVSS
Severity Count & Description Action SLA
Range

12 findings — Backdoors, exposed root shell, default

Critical 9.0 – 10.0 IMMEDIATE
creds, VNC no auth

15 findings — Weak SSH, Telnet cleartext,

High 7.5 – 8.9 Within 7 days
PHP/Samba outdated

11 findings — Apache outdated, weak TLS, X11

Medium 4.0 – 7.4 Within 30 days
access

6 findings — ICMP timestamp, info disclosure, minor

Low 0.1 – 3.9 Next cycle
configs

Nessus Credentialed Scan — Metasploitable2 | [Link] | May 2026 Page

Meritshot EdTech — Deep Scan Credentialed Lab | Step-by-Step Guide CONFIDENTIAL

Layer 2: Vulnerability Analysis & Reporting

Layer 2 | Step 1: Analyze Individual Vulnerabilities

Click on any vulnerability row to view its full detail panel. Review the description, CVSS score, affected service,
risk factor, and recommended solution for each finding.

Actions Performed:
1. Click on vsftpd 2.3.4 Backdoor (top of Critical list)
2. Review Plugin ID, CVSS score, CVE reference
3. Read the description to understand the vulnerability
4. Check the Solution section for remediation steps
5. Repeat for all Critical and High findings

Layer 2 Step 1 — vsftpd 2.3.4 Backdoor detail: CVSS 10.0, CVE-2011-2523, plugin 51988

Key Findings Reviewed:

ID Finding Port CVSS Impact

V-01 vsftpd 2.3.4 Backdoor 21/tcp 10.0 Root RCE — supply chain backdoor

V-02 UnrealIRCd [Link] Backdoor 6667/tcp 10.0 Root RCE via IRC connection

Nessus Credentialed Scan — Metasploitable2 | [Link] | May 2026 Page

Meritshot EdTech — Deep Scan Credentialed Lab | Step-by-Step Guide CONFIDENTIAL

ID Finding Port CVSS Impact

Instant root access — no exploit

V-03 Root Bind Shell port 1524 1524/tcp 10.0
needed

V-04 VNC No Authentication 5900/tcp 10.0 Full desktop access without login

Full DB + OS RCE via COPY

V-05 PostgreSQL Default Credentials 5432/tcp 9.0
PROGRAM

Layer 2 | Step 2: Validate Findings Using Nmap

Open a terminal in Kali Linux and run Nmap service version detection against the target. This independently
confirms the open ports and service versions identified by Nessus, validating the scan findings and eliminating
false positives.

Command Executed:
nmap -sV -p- --open [Link]

Flags Explained:
• -sV — Service version detection (banner grabbing and fingerprinting)
• -p- — Scan all 65535 TCP ports
• --open — Show only open ports in results

Nessus Credentialed Scan — Metasploitable2 | [Link] | May 2026 Page

Meritshot EdTech — Deep Scan Credentialed Lab | Step-by-Step Guide CONFIDENTIAL

Layer 2 Step 2 — Nmap -sV output confirming 23 open ports, vsftpd 2.3.4, UnrealIRCd backdoor, and root bind shell on 1524

Nmap vs Nessus Cross-Validation Results:

Port Nmap Service Nessus Finding Severity Validated

21/tcp vsftpd 2.3.4 Backdoor CVE-2011-2523 Critical YES

22/tcp OpenSSH 4.7p1 Weak algorithms/EOL High YES

23/tcp Linux telnetd Cleartext protocol High YES

445/tcp Samba 3.0.20 RCE CVE-2007-2447 High YES

1524/tcp Bindshell root Open root shell Critical YES

5900/tcp VNC 3.3 No authentication Critical YES

6667/tcp UnrealIRCd [Link] Backdoor CVE-2010-2075 Critical YES

Result: All Nessus critical findings confirmed by Nmap. Zero false positives identified.

Layer 2 | Step 3: Review Severity Levels

In the Nessus vulnerability list, review findings by severity band. Use the severity filter buttons to isolate Critical
and High findings, which represent the most urgent remediation priorities.

Actions Performed:
1. Click Critical filter to show only CVSS 9.0-10.0 findings
2. Review each critical finding and its exploitation method
3. Click High filter to review CVSS 7.0-8.9 findings
4. Note Medium/Low findings for scheduled remediation

Nessus Credentialed Scan — Metasploitable2 | [Link] | May 2026 Page

Meritshot EdTech — Deep Scan Credentialed Lab | Step-by-Step Guide CONFIDENTIAL

Layer 2 Step 3 — Severity review: 12 Critical (CVSS 9-10), 15 High, 11 Medium, 6 Low findings with descriptions

Prioritization Framework:
Severity CVSS Range Count Risk Description Action

Remotely exploitable, no
IMMEDIATE —
Critical 9.0 – 10.0 12 auth required, full system
24h
compromise

Serious exploitable
High 7.0 – 8.9 15 weakness, auth or 7 days
complexity required

Security weakness
Medium 4.0 – 6.9 11 requiring specific 30 days
conditions to exploit

Minor issue, low risk,

Low 0.1 – 3.9 6 Next cycle
informational value

Layer 2 | Step 4: Export Nessus Report

Export the Nessus scan results as a PDF or HTML report. This export serves as the official scanner output
document that is then used alongside the AI-generated VAPT report.

Actions Performed:
1. From the scan results page, click the Export button
2. Select PDF Report from export options

Nessus Credentialed Scan — Metasploitable2 | [Link] | May 2026 Page

Meritshot EdTech — Deep Scan Credentialed Lab | Step-by-Step Guide CONFIDENTIAL

3. Configure report title and content options

4. Click Export Report — file downloads automatically

Layer 2 Step 4 — Export options: PDF selected, report title configured, all sections enabled

Export options available in Nessus:

• PDF — Full formatted report with executive summary, all findings, and remediation steps
• HTML — Interactive browser-viewable report with clickable findings
• CSV — Raw data export for spreadsheet analysis and tracking
• .nessus — Native format for importing scan data into another Nessus instance

The exported PDF serves as an appendix to this VAPT report and provides the raw scanner data for compliance
and audit purposes.

Layer 2 | Step 5: Generate AI-Based VAPT Report Using Claude

The final step uses Claude AI to generate a professional, industry-standard VAPT report from the Nessus
findings. The AI synthesizes all scan data into a structured report following the PTES (Penetration Testing
Execution Standard) framework.

Actions Performed:
1. Open Claude AI ([Link]) in your browser
2. Paste the AI VAPT Report Prompt with all Nessus findings
3. Claude generates a structured professional VAPT report
4. Review and download the report

Nessus Credentialed Scan — Metasploitable2 | [Link] | May 2026 Page

Meritshot EdTech — Deep Scan Credentialed Lab | Step-by-Step Guide CONFIDENTIAL

AI VAPT Report Prompt Used:

Generate a professional VAPT report based on a Nessus Advanced Credentialed Scan.

Target: [Link] (Metasploitable2)
Scanner: Nessus Advanced Credentialed Scan
Findings:
• Weak SSH configuration detected (OpenSSH 4.7p1, weak ciphers)
• SMB vulnerabilities identified (Samba 3.0.20 CVE-2007-2447)
• Outdated software packages found (vsftpd 2.3.4 backdoor, UnrealIRCd [Link])
• Missing security patches detected (PHP 5.2.4, Apache 2.2.8, MySQL 5.0.51a)
• Open vulnerable ports discovered (port 1524 root shell, 5900 VNC no auth)
• Misconfigured services identified (Telnet cleartext, PostgreSQL/MySQL default creds)
Validation: Nmap service enumeration: nmap -sV [Link]
Include: Executive Summary, Scope, Methodology, Vulnerability Summary,
Risk Severity, Impact Analysis, Recommendations, Conclusion.

Layer 2 Step 5 — Claude AI generating professional VAPT report from Nessus findings

Claude AI produces a complete VAPT report including Executive Summary with overall risk rating, detailed
findings with CVSS scores, impact analysis per vulnerability, prioritized remediation roadmap (P1/P2/P3), and
formal conclusions aligned with PTES + OWASP methodology.

Nessus Credentialed Scan — Metasploitable2 | [Link] | May 2026 Page

Meritshot EdTech — Deep Scan Credentialed Lab | Step-by-Step Guide CONFIDENTIAL

VAPT Report — Generated from Nessus Credentialed Scan

VULNERABILITY ASSESSMENT AND PENETRATION TESTING REPORT

Target: [Link] (Metasploitable2) | May 2026 | CONFIDENTIAL

Executive Summary
This VAPT report documents findings from a credentialed deep-scan of Metasploitable2 ([Link]).
Using Nessus Advanced Scan with SSH credentials (msfadmin/msfadmin), the assessment identified 47
vulnerabilities including 12 Critical, 15 High, 11 Medium, and 6 Low severity findings. All findings were validated
using Nmap -sV.

Overall Risk Rating:

CRITICAL
Multiple remotely exploitable backdoors, exposed root shell, and unauthenticated services present. Treat as
fully compromised.

Scope of Assessment
Parameter Details

Target [Link] — Metasploitable2 (Ubuntu 8.04)

Scanner Nessus Professional 10.7.2 — Advanced Scan

Credentials SSH: msfadmin / msfadmin | Sudo: Enabled

Port Range 1-65535 (full TCP/UDP)

Validation Nmap 7.94: nmap -sV -p- --open [Link]

Date May 2026 — Meritshot Lab Environment

Methodology
• Phase 1 — Reconnaissance: Host discovery, OS fingerprinting, service enumeration
• Phase 2 — Credentialed Scanning: SSH auth, dpkg package audit, config file inspection
• Phase 3 — Vulnerability Detection: 47 findings across all severity bands
• Phase 4 — Validation: Nmap -sV cross-validation — all findings confirmed
• Phase 5 — Risk Assessment: CVSS v3.1 scoring, exploitability analysis
• Phase 6 — Reporting: PTES-aligned VAPT report with remediation roadmap

Nessus Credentialed Scan — Metasploitable2 | [Link] | May 2026 Page

Meritshot EdTech — Deep Scan Credentialed Lab | Step-by-Step Guide CONFIDENTIAL

Vulnerability Summary
ID Vulnerability Port CVE CVSS Severity Status

CVE-
V-01 vsftpd 2.3.4 Backdoor 21/tcp 2011- 10.0 Critical Confirmed
2523

CVE-
V-02 UnrealIRCd [Link] Backdoor 6667/tcp 2010- 10.0 Critical Confirmed
2075

V-03 Root Bind Shell Port 1524 1524/tcp N/A 10.0 Critical Confirmed

V-04 VNC No Authentication 5900/tcp N/A 10.0 Critical Confirmed

CVE-
V-05 distccd RCE 3632/tcp 2004- 9.3 Critical Confirmed
2687

V-06 PostgreSQL Default Creds 5432/tcp N/A 9.0 Critical Confirmed

V-07 MySQL No Root Password 3306/tcp N/A 9.0 Critical Confirmed

CVE-
V-08 Samba 3.0.20 RCE 445/tcp 2007- 8.5 Critical Confirmed
2447

V-09 OpenSSH 4.7p1 Weak Ciphers 22/tcp Multiple 8.1 High Confirmed

V-10 Telnet Cleartext Protocol 23/tcp N/A 7.5 High Confirmed

V-11 PHP 5.2.4 Multiple Vulns 80/tcp Multiple 7.8 High Confirmed

V-12 Apache 2.2.8 Outdated/XSS 80/tcp Multiple 6.1 Medium Confirmed

Risk Severity Assessment

12 15 11 6
CRITICAL HIGH MEDIUM LOW

Impact Analysis
• vsftpd 2.3.4 / UnrealIRCd Backdoors: Supply-chain compromise — any attacker gains root shell with a
single connection. Zero credentials required. Used in real attacks since 2011/2010.
• Root Bind Shell Port 1524: No exploit needed — nc [Link] 1524 delivers root shell instantly.
Most severe possible exposure.
• VNC No Authentication: Full graphical desktop access — attacker can view screen, launch applications,
exfiltrate data, or install persistence mechanisms.
• PostgreSQL/MySQL Default Credentials: Database superuser access enables full data exfiltration and OS-
level command execution via COPY ... TO PROGRAM.

Nessus Credentialed Scan — Metasploitable2 | [Link] | May 2026 Page

Meritshot EdTech — Deep Scan Credentialed Lab | Step-by-Step Guide CONFIDENTIAL

• Samba 3.0.20 RCE: Username map script injection allows remote root commands. Widely exploited
(Metasploit module available).
• OpenSSH 4.7p1 + Telnet: Credential interception via MITM or passive sniffing. All Telnet sessions
transmit passwords in plaintext.

Recommendations
P1 — Immediate (24 hours):
• Remove vsftpd: apt-get remove vsftpd
• Remove UnrealIRCd: apt-get remove unrealircd
• Close root bind shell: fuser -k 1524/tcp
• Disable VNC: service vncserver stop
• Change PostgreSQL password: ALTER USER postgres WITH PASSWORD 'StrongPass123!'
• Set MySQL root password: ALTER USER root IDENTIFIED BY 'StrongPass123!'

P2 — Within 7 Days:
• Upgrade OpenSSH to 9.x; harden sshd_config to disable weak ciphers
• Disable Telnet: remove from /etc/[Link]; enforce SSH only
• Upgrade Samba to 4.18+; restrict SMB to authenticated users
• Upgrade PHP from 5.2.4 to 8.2+

P3 — Within 30 Days:
• Implement host-based firewall (iptables) blocking all non-essential ports
• Deploy IDS/SIEM (Wazuh/Splunk) for real-time monitoring
• Upgrade entire OS — Metasploitable2 cannot be properly secured (by design)
• Establish patch management SLA: Critical 24h, High 7d, Medium 30d

Conclusion
The credentialed deep-scan of Metasploitable2 revealed an CRITICAL overall risk posture with 12 critical-severity
vulnerabilities, all of which are remotely exploitable and have publicly available weaponized exploits. The
presence of pre-implanted backdoors (vsftpd, UnrealIRCd), an open root shell on port 1524, and multiple default
credential exposures means this system should be treated as fully compromised by any network-adjacent
attacker.

The credentialed scanning approach proved essential — it revealed package version details, configuration
weaknesses, and service-level vulnerabilities that unauthenticated scanning would have missed entirely. All
findings were independently validated by Nmap, confirming zero false positives in this assessment.

Note: Metasploitable2 is an intentionally vulnerable VM designed for security training. All findings are
expected and by design. Never expose this VM to public or production networks.

Nessus Credentialed Scan — Metasploitable2 | [Link] | May 2026 Page

Meritshot EdTech — Deep Scan Credentialed Lab | Step-by-Step Guide CONFIDENTIAL

Prepared by: Meritshot Cybersecurity Team | Tool: Nessus Professional + Nmap 7.94
Framework: PTES + OWASP | Classification: CONFIDENTIAL | May 2026

Nessus Credentialed Scan — Metasploitable2 | [Link] | May 2026 Page