This project demonstrates a vulnerability assessment conducted against Metasploitable 2, an intentionally vulnerable Linux virtual machine, using Kali Linux as the attacker system.
The objective of this assessment was to:
- Discover live hosts
- Enumerate open services
- Identify security weaknesses
- Validate findings through manual investigation
- Assess associated risks
- Document recommendations for remediation
- Kali Linux
- Metasploitable 2
- VMware Workstation
- Nmap
- Netcat (nc)
- Telnet
- FTP
- SMBClient
- PostgreSQL Client (psql)
- Operating System: Kali Linux
- IP Address: 192.168.210.130
- Operating System: Metasploitable 2
- IP Address: 192.168.210.129
- Network Verification
- Service Enumeration
- Service Investigation
- Finding Validation
- Risk Assessment
- Documentation
Before beginning the assessment, connectivity between the attacker and target systems was verified.
- Host reachable
- Successful communication established between systems
An Nmap service version scan was performed against the target.
nmap -sV 192.168.210.129
- FTP (21)
- SSH (22)
- Telnet (23)
- HTTP (80)
- SMB (139,445)
- PostgreSQL (5432)
- MySQL (3306)
- Bindshell (1524)
The Telnet service accepted default credentials, allowing remote access to the target system.
Username: msfadmin
Password: msfadmin
- Successfully authenticated
- Access obtained as user
msfadmin
High
A bindshell service was exposed on port 1524 and provided direct root access without authentication.
- Immediate root shell obtained
- No authentication required
Critical
The FTP service allowed anonymous authentication.
- Anonymous login successful
- Directory listing accessible
Medium
The SMB service allowed anonymous enumeration of shares and resources.
- Multiple shares discovered
- Anonymous access to shared resources confirmed
Medium
Database services were identified during enumeration.
- MySQL service identified on port 3306
- PostgreSQL service identified on port 5432
The PostgreSQL service accepted default credentials.
- Successful database authentication
- Remote access obtained using default credentials
High
| Finding | Severity |
|---|---|
| Unauthenticated Root Bindshell | Critical |
| Telnet Default Credentials | High |
| PostgreSQL Default Credentials | High |
| Anonymous FTP Access | Medium |
| Anonymous SMB Enumeration | Medium |
For detailed analysis, refer to:
findings.mdrisk-assessment.md
- Network Enumeration
- Service Identification
- Vulnerability Assessment
- Risk Assessment
- Linux Administration
- Security Documentation
- Nmap Scanning
- SMB Enumeration
- FTP Enumeration
- Database Service Assessment
- Evidence Collection
During this project I learned:
- How to perform host discovery and service enumeration using Nmap.
- How to validate vulnerabilities manually instead of relying solely on automated scan results.
- The security risks associated with default credentials and anonymous access.
- The impact of exposed services on an organization's attack surface.
- How to assess findings based on risk and business impact.
- How to document technical findings in a structured security assessment report.
- The importance of proper lab setup and troubleshooting during cybersecurity projects.
This project was performed in a controlled lab environment using Metasploitable 2, an intentionally vulnerable virtual machine designed for cybersecurity training and education. No unauthorized systems were targeted during this assessment.
This project is licensed under the MIT License. See the LICENSE file for more information.
Prince Yadav
Cybersecurity Student | GRC | Security Operations | Linux | Web Security
GitHub: https://github.com/prince-unk