HOW TO WORK ON SOME PORT ON Metasploit able

firstly we do recon, to determine our ip address we firstly do recon on our sublet

when i get the ip address from the sublet then i scan the ip address to know what servers are open and active

i discover some severs port are open and i tried to deep scanned also to find some

FOR PORT 21

i found out that the FTP server is open and even allowed anonymus login

TCP was also discovered

SMB server also and so

so i run ip a command from my metaspoiltable terminal and scan the ip address for port 21 which is FTP server and i login with anonymous

so i tried tp login FTP server with anonymous and i create directory to add to the the ftp server

so i login and added the directory i created since it allow read and write permission

this just to show the stuff i created an i add it

And i got shell for port 21

Analysis for Port 21 (FTP)

Service Detection

• Command: nmap -p 21 -sV -sC 10.0.2.3
• Result: vsftpd 2.3.4

Login / Auth Check

• Anonymous Login Supported / Insecure Default Credentials. The server accepts the username anonymous with a blank password, allowing unauthenticated users to read directory listings.

Software Vulnerabilities

• Command: nmap --script vuln -p 21 10.0.2.3
• Result: Highly Vulnerable (Critical). The target runs vsftpd 2.3.4, which contains a famous pre-installed malicious backdoor (CVE-2011–2523). If a user attempts to log in using a username ending with a smiley face :), the system opens a direct listening root shell on port 6200.

Access Control Policy

• Defenseless Posture. The FTP daemon communicates over an unencrypted channel, exposing all session logs and data packet transmissions to sniffing attacks. It actively executes commands parsed through the login parameter without enforcing boundary filters

FOR PORT SSH port 22

After the audit

after the audit i attempts to identify the service and its version

after the version i try to identify the SSH server’s public host-key fingerprints.

The initials NMAP scan identified TCP port 22 as open and running the SSH service.

The ssh host key enumeration identified RSA DSA and host keys. the result preovide information about the remote service’s identify and cryptographic configuration .

Potential security risks: the detected OpenSSH version is old and warrants further assessment to determine and contain known vulnerabilities and is exploitable.

this is the vululnerable exploit.

Analysis for Port 22 (SSH)

Service Detection

• Command: nmap -p 22 -sV -sC 10.0.2.3
• Result: OpenSSH 4.7p1 (Ubuntu Linux)

Login / Auth Check

• Weak Password Policy / Insecure Defaults. While the server securely demands standard username/password authentication, it permits the use of weak, static administrative account credentials (e.g., msfadmin / msfadmin).

Software Vulnerabilities

• Command: nmap --script vuln -p 22 10.0.2.3
• Result: Vulnerable to Key Guessing (CVE-2008–0166). The target operating system uses a flawed Debian OpenSSL package with a predictable Random Number Generator (RNG). An attacker can pre-compute cryptographic keys to compromise the server via rapid brute-force guessing attacks.

Access Control Policy

• Permissive Configuration. The service fails to implement account lockout thresholds or rate-limiting filters. It allows continuous remote dictionary brute-force attempts without dropping the network connection

FOR PORT 23 Telnet

i try login with the username and password i got during footprinting

Showed a successful Talnet connection but didnt report any specific vulnerability

potential Security risks: Telnet does not encrypt communication by default credentials and session information may be exposed to network observers.

Analysis for Port 23 (Telnet)

Get O’Block’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Service Detection

• Command: nmap -p 23 -sV -sC 10.0.2.3
• Result: Linux telnetd

Login / Auth Check

• Horrendously Misconfigured / Cleartext Transmission. The server prompts for traditional authentication, but all credentials (usernames and passwords) are transmitted over the wire completely unencrypted, allowing easy sniffing. Furthermore, it yields full access to weak default credentials (msfadmin).

Software Vulnerabilities

• Command: nmap --script vuln -p 23 10.0.2.3
• Result: Vulnerable via Host Trust Abuse. Due to unsafe configuration files across legacy remote handling modules on the machine (like + + wildcards inside the .rhosts file), an attacker can pivot or manipulate adjacent parameters to obtain a root login without completing password authentication.

Access Control Policy

• Extremely Poor Security Posture. The Telnet application completely lacks encryption, session integrity checks, or traffic isolation. It acts as an open remote shell entrypoint that exposes the machine to full control via automated password-cracking tools

FOR PORT 25 SMTP

after i run the command to check for service banner and scripts then vulnerability detection scripts

So i echo sends EHLO local immediately into the connection. The sleep 2 keeps the connection open for 2 seconds so you can read the server's response before netcat closes.

Based on the footprinting results icollected, the target SMTP server does not support authentication (the AUTH capability is missing). This means there is no log in stuff.

not vulnerable and i can’t try guess login as admin

Service Detectionnmap -p 25 -sV -sC 10.0.2.3Postfix ESMTP (Ubuntu)

Login / Auth CheckBanner Grab / EHLONo Authentication Supported. The 250-AUTH parameter is entirely absent, confirming standard username/password logins are disabled on Port 25.

Software Vulnerabilities--script smtp-vuln*Not Vulnerable to standard automated checks (e.g., CVE-2010-4344 is an Exim-specific flaw; target runs Postfix).

User Enumeration--script smtp-enum-usersFailed / Inconclusive. The server does not leak valid local operating system accounts through automated VRFY or RCPT methods.

Access Control Policy--script smtp-open-relaySecure. The server is not an open relay, indicating it enforces strict traffic-filtering boundaries

the SMTP service on 10.0.2.3 maintains a strong default security posture on Port 25. While basic network identity data (such as the software name, OS family, and hypervisor type) is cleanly exposed during initial footprinting, the service effectively restricts unauthorized access by eliminating login endpoints, masking user enumeration patterns, and explicitly blocking open mail relaying.

FOR PORT 80 http

Service Mappingnmap -p 80 -sV -sC 10.0.2.3Apache httpd 2.2.8 (Ubuntu) with WebDAV enabled

Path Mappingnmap -p 80 --script http-enum 10.0.2.3Identified administrative interfaces (/phpMyAdmin/, /tikiwiki/) and diagnostic pages (/phpinfo.php)

Access Policynmap -p 80 --script http-enum 10.0.2.3Over-permissive directory configurations allowing public directory listings on /doc/ and /icons/.

Web ServerApache 2.2.8Explicitly leaks software version; allows targeted version tracking.

Backend LanguagePHP 5.2.4–2ubuntu5.10Discloses precise runtime framework and operating system distribution patch.

ExtensionsDAV/2 (WebDAV)Confirms distributed authoring extensions are active on the web application server.

Access ControlHTTP/1.1 200 OKPublic access permitted on root directory; no global authentication challenges.

Exposed Endpoints/phpMyAdmin/, /phpinfo.phpExposes sensitive operational architecture, diagnostics, and administrative dashboards.

FOR PORT 53

output shows that the vuln script finished running but didn't list any security flaws

then i try to use another way to comfirm

still same thing because the server has recursive lookups disabled, the standard network exploits for this port are blocked.

Service Detection

• Command: nmap -p 53 -sV -sC 10.0.2.3
• Result: ISC BIND 9.4.2 running on an Oracle VirtualBox virtual machine.
• No Public Recursion Supported. The server rejects recursive lookups from external network zones, confirming it only serves authoritative zones or restricts lookup capabilities to local system processes.

Software Vulnerabilities

• Command: nmap --script vuln -p 53 10.0.2.3
• Result: Not Vulnerable to standard automated checks. While older BIND versions are historically linked to spoofing flaws and the lack of open recursion mitigates automated exploitation paths.

Cache Poisoning & Zone Transfer

• Command: nmap --script dns-zone-transfer -p 53 10.0.2.3
• Result: Secure / Inconclusive. The server restricts zone transfers (AXFR) to unauthorized hosts, protecting internal network topology and domain mappings from data leakage.

Access Control Policy

• Strict Filtering Enforced. The name server drops or denies recursive queries from outside network segments, preventing attackers from leveraging the asset for DNS amplification or distributed denial-of-service (DDoS) reflection attacks.

Conclusion Summary

The DNS service on 10.0.2.3 maintains a defensive operational posture on Port 53. While essential service identity footprints (such as the software version and hypervisor platform) are openly exposed during initial version scanning, the application effectively limits its attack surface by disabling public recursive queries, shielding zone data, and blocking external cache manipulation tactics.

FOR PORT 445

then i use msfconsole to exploit

then i now have a remote command-line shell directly inside the Metasploitable 2 machine. because i’m now interactively controlling the target server.

Analysis for Port 445 (SMB / Samba)

Service Detection

• Command: nmap -p 445 -sV -sC 10.0.2.3
• Result: Samba 3.0.20-Debian

Login / Auth Check

• Anonymous Share Enumeration Permitted. The server allows unauthenticated external clients to list local share names (such as IPC$) without requiring valid system user credentials.

Software Vulnerabilities

• Command: nmap --script vuln -p 445 10.0.2.3
• Result: Highly Vulnerable (Critical — CVE-2007–2447). The target runs Samba 3.0.20, which is vulnerable to the “usermap_script” Arbitrary Command Execution flaw. Because the application handles username input unsafely inside shell scripts, an attacker can append shell metacharacters to a login name to execute operating system commands as the root user.

Exploitation & Verification

• Framework: Metasploit Framework (msfconsole)
• Module Used: exploit/multi/samba/usermap_script

The Samba service on 10.0.2.3 presents an extremely compromised operational posture on Port 445. Unlike the securely restricted DNS and SMTP layers, this entrypoint provides a direct, unauthenticated pathway to full machine compromise. By exploiting an input validation flaw inside the username handler, an external attacker can completely bypass authentication structures to establish a persistent root execution shell, granting absolute administrative control over the host filesystem.