Metasploitable2 Vulnerabilities

Hello Everyone,

Today I’m going to demonstrate how to exploit some vulnerabilities on Metasploitable2 by using Kali Linux. Metasploitable is a Ubuntu distribution involves vulnerabilities that are in the distribution on-purpose. So, Metasploitable is an effective product to train and improve on the field of cyberhacking.

Note: Your Kali and Metasploitable must be on the same network!

Lets begin with scanning our target host and see which ports are open and which are not. We use “nmap” to scan host ports.

Screenshot 1

Lets review the options of the command above:

• -sS (TCP SYN SCAN) : Performs a “stealth” scan by sending only SYN packets. It’s faster and less detectable by firewalls and intrusion detection systems.
• -sV (Service Version Detection) : Tries to determine the version of services running on open ports. Useful for finding known vulnerabilities.
• -O (Operating System Detection) : Attempts to identify the target’s operating system by analyzing TCP/IP stack behavior.

Note: “-O” option can only be used with root(sudo) privileges.

As shown in the above screenshot, more ports are open than usual.

Now, we’ll use the “msfconsole”. This is one of the tools that includes vulnerability tools in it. Just type “msfconsole” to get in.

Screenshot 2

EXPLOITATION

FTP (Port 21)

To exploit FTP(File Transfer Protocol) we will use the open port 21 which is used by FTP. We use “search” to search in the modules. As shown in the Screenshot 1, there is an open FTP port with Version vsftpd 2.3.4 . For this reason we’ll use module 1 with the Description VSFTPD v2.3.4 . You can clearly see the module numbers in Screenshot 3 .

Screenshot 3

Type “use 1” to select the module 1 . Then we have to make some configurations for the exploitation because if we don’t specify where to attack, the module can’t attack the target host. Lets see what options we need by typing “show options”.

Screenshot 4

set RHOSTS(the target host\hosts) by executing the command “ set rhosts {{TARGET IP}} “. The port number 21 configured by default and other options are not required. Type “run” or “exploit” to start the exploitation.

If you see “Command shell session 1 opened (attacker ip:portNumber → target ip:portNumber) at …..” Congratulations, you’re in the target’s shell!

Now you can take information send pings or whatever you like! Check the screenshot below.

Target Host’s Shell