Metasploitable 2 PENETRATION TESTING REPORT

Assessment Type: Vulnerability Assessment and Penetration Testing (VAPT)
Target: Metasploitable 2
Target IP: 10.82.105.114
Testing Platform: Kali Linux
Environment: Authorized Isolated Virtual Lab
Assessment Date: 23 September 2026
Prepared By: Anju

Document Control

Document Title: Metasploitable 2 Penetration Testing Report

Assessment Type: Vulnerability Assessment & Penetration Testing

Target: Metasploitable 2

Target IP: 10.82.105.114

Assessment Environment: Authorized Virtual Lab

Testing Platform: Kali Linux

Assessment Date: 23 September 2026

Report Status: Final

Confidentiality: Training / Educational Use

1. Executive Summary

A penetration testing was conducted against the intentionally vulnerable Metasploitable 2 virtual machine within an authorized and isolated laboratory environment.

The assessment followed a structured penetration-testing methodology consisting of host discovery, port scanning, service enumeration, vulnerability identification, vulnerability validation, controlled exploitation, and impact assessment.

Initial reconnaissance identified the target host at 10.82.105.114. A full TCP port scan with service and version detection identified a large number of exposed network services, including FTP, SSH, Telnet, SMTP, DNS, HTTP, SMB, NFS, database services, VNC, IRC, Apache Tomcat, and other legacy services.

During service enumeration, TCP port 21 was identified as running vsftpd 2.3.4. The service was investigated as a potential attack vector. The vulnerability was subsequently validated in the authorized laboratory environment using the Metasploit Framework, resulting in unauthorized shell access to the target system.

The assessment demonstrates the security risks associated with deploying outdated and vulnerable software and exposing unnecessary network services. The successful compromise of the FTP service demonstrates that an externally accessible vulnerable service can provide an attacker with an initial foothold on a system.

Detailed technical information, evidence, reproduction steps, impact, root cause, and remediation recommendations are provided in the findings section of this report.

2. Assessment Scope

2.1 In-Scope Asset

Item Details
Document Title Metasploitable 2 Penetration Testing Report
Assessment Type Vulnerability Assessment & Penetration Testing
Target Metasploitable 2
Target IP 10.82.105.114
Assessment Environment Authorized Virtual Lab
Testing Platform Kali Linux
Assessment Date 22 September 2026
Report Status Final
Confidentiality Training / Educational Use

2.2 Scope Limitation

Testing was limited to the authorized Metasploitable 2 virtual machine.

No external systems, third-party infrastructure, or unauthorized hosts were included in the assessment.

3. Assessment Objectives

The primary objectives of the assessment were to:

1. Identify exposed network services.
2. Enumerate the discovered services and software versions.
3. Identify potentially vulnerable services and configurations.
4. Validate identified vulnerabilities in the authorized laboratory environment.
5. Demonstrate the potential impact of confirmed vulnerabilities.
6. Document technical findings and supporting evidence.
7. Provide appropriate remediation recommendations.

4. Methodology

The assessment followed a structured penetration-testing process.

4.1 Host Discovery

Network discovery was performed to identify active hosts within the testing environment.

The target Metasploitable 2 system was identified at:

10.82.105.114

The ARP scan output identified the host as a VMware system.

4.2 Port Scanning and Service Detection

A full TCP port scan with service and version detection was performed:

nmap -p- -sCV 10.82.105.114

The scan identified a large number of open TCP ports and associated services.

The target was confirmed to be reachable and exposed a significant network attack surface.

4.3 Service Enumeration

The identified services were examined to determine:

• Running software and versions
• Authentication mechanisms
• Anonymous or unauthenticated access
• Legacy protocols
• Potentially vulnerable software
• Insecure configurations
• Potential attack paths

The enumeration phase identified numerous legacy services and configurations.

4.4 Vulnerability Identification

Potential vulnerabilities were identified by correlating discovered service versions and configurations with known security weaknesses.

Not every discovered service was treated as a confirmed vulnerability.

An exposed service was considered a confirmed finding only when sufficient evidence existed to demonstrate a security weakness or successful exploitation.

4.5 Vulnerability Validation and Exploitation

Potential vulnerabilities were validated within the authorized laboratory environment.

The vsftpd 2.3.4 service on TCP port 21 was successfully exploited using the Metasploit Framework, resulting in shell access to the target.

4.6 Impact Assessment

Following successful exploitation, the resulting access was assessed to determine the practical security impact of the vulnerability.

The assessment considered:

• Level of access obtained
• Ability to execute commands
• Potential for further compromise
• Potential confidentiality, integrity, and availability impact

4.7 Reporting

Confirmed findings were documented using a standardized structure consisting of:

• Finding identification
• Severity
• Affected asset
• Technical description
• Evidence
• Steps to reproduce
• Impact
• Root cause
• Remediation
• References

5. Reconnaissance and Enumeration

5.1 Host Discovery

The target was identified during ARP-based network discovery.

Identified target:

10.82.105.114

Evidence: ARP scan output showing the target IP address.

Screenshot:

5.2 Service Enumeration

The full TCP scan identified numerous exposed services.

The most significant discovered services included:

21/TCP — FTP
Version: vsftpd 2.3.4

22/TCP — SSH
Version: OpenSSH 4.7p1

23/TCP — Telnet
Service: Linux telnetd

25/TCP — SMTP
Service: Postfix

53/TCP — DNS
Version: BIND 9.4.2

80/TCP — HTTP
Version: Apache 2.2.8

111/TCP — RPC
Service: rpcbind

139/TCP — SMB
Service: Samba

445/TCP — SMB
Version: Samba 3.0.20

512/TCP — RSH
Service: rexecd

513/TCP — Rlogin
Service: rlogind

1524/TCP — Bindshell
Information: Metasploitable root shell

2049/TCP — NFS
Version: NFS 2–4

2121/TCP — FTP
Version: ProFTPD 1.3.1

3306/TCP — MySQL
Version: MySQL 5.0.51a

3632/TCP — distccd
Version: distccd v1

5432/TCP — PostgreSQL
Version: PostgreSQL 8.3.x

5900/TCP — VNC
Protocol: VNC 3.3

6000/TCP — X11
Information: Access denied

6667/TCP — IRC
Service: UnrealIRCd

6697/TCP — IRC
Service: UnrealIRCd

8009/TCP — AJP
Service: Apache Jserv

8180/TCP — HTTP
Version: Apache Tomcat 5.5

8787/TCP — DRb
Version: Ruby 1.8

These results demonstrate that the target exposed a large number of network-accessible services.

5.3 FTP Enumeration

TCP port 21 was identified as running:

vsftpd 2.3.4

The Nmap service enumeration also reported that anonymous FTP login was permitted:

ftp-anon: Anonymous FTP login allowed

The FTP service therefore represented a significant area for further investigation.

Screenshot:

6. Confirmed Security Findings

Finding VAPT-01

Remote Code Execution via Vulnerable vsftpd 2.3.4

Details

Finding ID: VAPT-01

Severity: Critical

Affected Host: 10.82.105.114

Affected Port: 21/TCP

Service: FTP

Software: vsftpd 2.3.4

Validation Status: Confirmed

Exploitation: Successful

Result: Shell access obtained

6.1 Description

The target system was found to be running vsftpd version 2.3.4 on TCP port 21.

The identified version contains a known security weakness that can be leveraged to obtain unauthorized access to the affected system.

During the assessment, the vulnerability was successfully validated using the Metasploit Framework in the authorized laboratory environment. Successful exploitation resulted in shell access to the target system.

The Nmap scan confirmed the vulnerable service and version:

21/tcp open ftp vsftpd 2.3.4

The scan also reported that anonymous FTP access was permitted.

6.2 Technical Details

The FTP service was identified during full-port service enumeration.

The service banner disclosed:

vsftpd 2.3.4

Because the identified software version was known to have a security vulnerability, further validation was performed.

The Metasploit Framework was used to test the vulnerability against the authorized target.

6.3 Evidence

Evidence 1 — Service Enumeration

Nmap identified:

21/tcp open ftp vsftpd 2.3.4

Screenshot:

Evidence 2 — Metasploit Configuration

Screenshot:

The screenshot should clearly show:

• Selected exploit/module
• Target IP
• Relevant configuration
• Execution of the module

Evidence 3 — Successful Exploitation

Get Anju’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Screenshot:

The screenshot should demonstrate that exploitation resulted in access to the target.

6.4 Steps to Reproduce

Step 1 — Identify the FTP Service

Perform service enumeration against the target:

nmap -p 21 -sV 10.82.105.114

The target is identified as running:

21/tcp open ftp vsftpd 2.3.4

Step 2 — Identify the Relevant Vulnerability

The discovered software version was investigated for known security vulnerabilities.

The vulnerability was identified as suitable for validation using the Metasploit Framework.

Step 3 — Configure the Metasploit Module

The appropriate Metasploit exploit module was selected and configured against:

Target: 10.82.105.114

Port: 21

Screenshot:

Step 4 — Execute the Exploit

The exploit was executed against the authorized Metasploitable 2 target.

Step 5 — Verify Access

Successful exploitation resulted in shell access to the target system.

The obtained access was verified by executing commands on the compromised system.

Screenshot:

6.5 Impact

Successful exploitation of the vulnerable FTP service resulted in unauthorized shell access to the target system.

An attacker able to exploit the vulnerable service could potentially:

• Execute commands on the compromised host.
• Access files available to the compromised process.
• Modify or delete accessible data.
• Conduct further reconnaissance from the compromised system.
• Attempt privilege escalation.
• Use the compromised system as a pivot point for further attacks.

The actual impact demonstrated during this assessment was successful remote shell access.

6.6 Root Cause

The primary root cause was the deployment of a vulnerable and outdated version of the FTP server software.

The target exposed vsftpd 2.3.4 directly over the network, allowing the vulnerable service to be reached remotely.

The FTP configuration also permitted anonymous access, which further increased the attack surface.

6.7 Remediation

The following remediation actions are recommended:

1. Upgrade the FTP server to a supported and security-patched version.
2. Remove or disable the FTP service if it is not required.
3. Disable anonymous FTP access unless there is a documented business requirement.
4. Restrict FTP access using firewall rules and network segmentation.
5. Apply a formal patch-management process to externally exposed services.
6. Regularly perform vulnerability assessments against internet- or network-facing services.
7. Replace legacy FTP with a secure file-transfer mechanism such as SFTP where appropriate.

6.8 References

Relevant vendor documentation and vulnerability advisories should be referenced in the final version of the report.

7. Additional Security Observations

The assessment identified several additional services and configurations that warrant security review.

These observations are not automatically classified as confirmed vulnerabilities solely because the services were discovered.

Examples include:

• Anonymous FTP access
• Legacy SSH version
• Telnet exposure
• Legacy SMB/Samba service
• Exposed database services
• VNC exposure
• Legacy Apache/Tomcat services
• RSH/Rlogin services
• RPC/NFS services
• Legacy IRC service

The Nmap results provide evidence of these exposed services.
These services should be individually assessed if the objective is to perform a complete vulnerability assessment of the target.

8. Risk Assessment Summary

The following table summarizes the confirmed security finding documented during the assessment.

ID

Finding

Severity

Affected Service

Impact

Status

VAPT-01

Remote Code Execution via vulnerable vsftpd 2.3.4

Critical

FTP / TCP 21

Remote shell access

Confirmed

Risk Interpretation

The confirmed finding was assigned a Critical severity because successful exploitation resulted in unauthorized remote shell access to the target system.

The risk rating reflects the demonstrated technical impact within the authorized laboratory environment.

9. Overall Attack Path

The demonstrated attack path can be summarized as:

Host Discovery

↓

10.82.105.114 identified

↓

Full TCP Port Scan

↓

Multiple services discovered

↓

FTP identified on TCP/21

↓

vsftpd 2.3.4 identified

↓

Vulnerability investigated

↓

Metasploit Framework

↓

Successful exploitation

↓

Unauthorized shell access

This attack path demonstrates how a seemingly simple exposed service can become the initial access vector for compromise when vulnerable software is deployed.

10. Conclusion

The penetration test of the Metasploitable 2 system demonstrated a broad network attack surface consisting of numerous exposed services and legacy software components.

The assessment began with host discovery and progressed through full-port scanning, service enumeration, vulnerability identification, and controlled exploitation.

The most significant confirmed finding documented in this assessment was the vulnerable vsftpd 2.3.4 service exposed on TCP port 21. The vulnerability was successfully exploited using the Metasploit Framework, resulting in unauthorized shell access to the target system.

The assessment also identified numerous additional services that should be reviewed individually during a comprehensive security assessment. However, these services have not been classified as confirmed vulnerabilities in this report without corresponding validation evidence.

The primary security recommendations are to maintain supported and patched software versions, remove unnecessary network-facing services, disable insecure legacy protocols, enforce appropriate authentication controls, restrict network access to administrative services, and conduct regular vulnerability assessments.

Because Metasploitable 2 is intentionally designed as a vulnerable training environment, the findings should be interpreted as security-training results rather than as an assessment of a production system.

Appendix A — Full Port and Service Enumeration

The complete Nmap scan identified the following significant services:

21/tcp FTP vsftpd 2.3.4

22/tcp SSH OpenSSH 4.7p1

23/tcp Telnet Linux telnetd

25/tcp SMTP Postfix

53/tcp DNS BIND 9.4.2

80/tcp HTTP Apache 2.2.8

111/tcp RPC rpcbind

139/tcp SMB Samba

445/tcp SMB Samba 3.0.20

512/tcp RSH rexecd

513/tcp Rlogin rlogind

514/tcp TCP Wrapped

1099/tcp Java RMI

1524/tcp Bindshell

2049/tcp NFS

2121/tcp FTP ProFTPD 1.3.1

3306/tcp MySQL 5.0.51a

3632/tcp distccd distccd v1

5432/tcp PostgreSQL 8.3.x

5900/tcp VNC Protocol 3.3

6000/tcp X11

6667/tcp IRC UnrealIRCd

6697/tcp IRC UnrealIRCd

8009/tcp AJP Apache Jserv

8180/tcp HTTP Apache Tomcat 5.5

8787/tcp DRb Ruby 1.8

These services were identified during the service/version scan.

Appendix B — Evidence Register

Evidence ID

Description

Location

E-01

ARP host discovery

Section 5.1

E-02

Full Nmap scan

Section 5.2

E-03

vsftpd 2.3.4 identification

Finding VAPT-01

E-04

Anonymous FTP detection

Finding VAPT-01

E-05

Metasploit configuration

Finding VAPT-01

E-06

Successful exploitation

Finding VAPT-01

E-07

Shell access verification

Finding VAPT-01

Appendix C — Assessment Limitations

The assessment was conducted against an intentionally vulnerable virtual machine in a controlled laboratory environment.

The results therefore demonstrate the security weaknesses present in the configured training system and should not be interpreted as a direct representation of the security posture of a production environment.

Only vulnerabilities supported by available evidence and validation results have been classified as confirmed findings.