Metasploitable 2: Ethical Hacking & Penetration Testing Environment
Master hands-on penetration testing with Metasploitable 2. Learn reconnaissance, port scanning with Nmap, vulnerability assessment with OpenVAS, and complete exploit walkthroughs including vsftpd, Samba, Java RMI, NFS, SSH brute-forcing, and Tomcat.
Explore related topics
Course content
5 sections • 15 lectures • 1h 15m total length
Requirements
- Basic familiarity with Linux command line commands, TCP/IP networking concepts (IP addresses, subnets, ports), and a computer capable of running virtual machines.
Description
Course Overview
Metasploitable 2 is an intentionally vulnerable Ubuntu Linux virtual machine designed for security professionals, ethical hackers, and bug hunters to test common security vulnerabilities, develop exploit payloads, and practice real-world penetration testing methodologies in a safe, legal sandbox environment.
What You Will Learn
Lab Architecture & Discovery
VirtualBox hypervisor setup, host-only network configuration, active/passive ARP reconnaissance with NetDiscover.
Reconnaissance & Auditing
Deep service enumeration with Nmap scripts, banner grabbing, and enterprise-grade automated scanning with OpenVAS/GVM.
Exploit Execution & Root Shells
Exploitation of vsftpd 2.3.4, Samba usermap_script, Java RMI, NFS root mounts, and Bindshell command execution.
Authentication & Web Attacks
Custom wordlist generation with CeWL, SSH brute-forcing with MSF, PHP CGI injection, and Apache Tomcat WAR deployment.
Target Vulnerabilities & Attack Surface Matrix
| Port | Service / Target | Vulnerability / CVE | Exploit Technique | Access Gained |
|---|---|---|---|---|
| 21/TCP | vsftpd 2.3.4 | Backdoor Smiley :) |
Port 6200 Backdoor Trigger | Root Shell |
| 22/TCP | OpenSSH 4.7p1 | Weak Credentials | MSF auxiliary/scanner/ssh/ssh_login | User / Root |
| 139, 445 | Samba 3.0.20 | CVE-2007-2447 | usermap_script Shell Metacharacters | Root Shell |
| 1099/TCP | Java RMI Registry | Default RMI Deserialization | exploit/multi/misc/java_rmi_server | Root Shell |
| 1524/TCP | Ingreslock | Direct Bind Shell | Netcat / Telnet direct connect | Root Shell |
| 2049/TCP | NFS Export | Misconfigured / Export |
Remote NFS Mount & SSH Key Injection | Root Shell |
| 5900/TCP | VNC Server | Known / Weak Password | VNC Password Brute-Force & Viewer | Desktop Session |
| 80/TCP | Apache / PHP | CVE-2012-1823 | PHP CGI Query String Argument Injection | www-data Shell |
| 8180/TCP | Apache Tomcat 5.5 | Default Admin Credentials | Malicious WAR Web Application Deployment | Tomcat Shell |
Lab Requirements & Tools Used
- Host System: Windows 10/11, macOS, or Linux with minimum 8GB RAM and hardware virtualization enabled.
- Hypervisor: Oracle VirtualBox (recommended) or VMware Workstation.
- Attacker VM: Kali Linux or Parrot Security OS.
- Target VM: Metasploitable 2 (Ubuntu 8.04 LTS derivative).
- Tools Covered: Nmap, OpenVAS/Greenbone, Metasploit Framework (msfconsole), NetDiscover, CeWL, Hydra, Netcat, and VNCViewer.