HOW TO WORK ON SOME PORT ON Metasploit able

FOR PORT 21

so i run ip a command from my metaspoiltable terminal and scan the ip address for port 21 which is FTP server and i login with anonymous

And i got shell for port 21

Analysis for Port 21 (FTP)

Service Detection

• Command: nmap -p 21 -sV -sC 10.0.2.3
• Result: vsftpd 2.3.4

Login / Auth Check

• Anonymous Login Supported / Insecure Default Credentials. The server accepts the username anonymous with a blank password, allowing unauthenticated users to read directory listings.

Software Vulnerabilities

• Command: nmap --script vuln -p 21 10.0.2.3
• Result: Highly Vulnerable (Critical). The target runs vsftpd 2.3.4, which contains a famous pre-installed malicious backdoor (CVE-2011–2523). If a user attempts to log in using a username ending with a smiley face :), the system opens a direct listening root shell on port 6200.

Access Control Policy

• Defenseless Posture. The FTP daemon communicates over an unencrypted channel, exposing all session logs and data packet transmissions to sniffing attacks. It actively executes commands parsed through the login parameter without enforcing boundary filters

FOR PORT SSH port 22

after the version i try to identify the SSH server's public host-key fingerprints.

The initials NMAP scan identified TCP port 22 as open and running the SSH service.

The ssh host key enumeration identified RSA DSA and host keys. the result preovide information about the remote service's identify and cryptographic configuration .

Potential security risks: the detected OpenSSH version is old and warrants further assessment to determine and contain known vulnerabilities and is exploitable.

Analysis for Port 22 (SSH)

Service Detection

• Command: nmap -p 22 -sV -sC 10.0.2.3
• Result: OpenSSH 4.7p1 (Ubuntu Linux)

Login / Auth Check

• Weak Password Policy / Insecure Defaults. While the server securely demands standard username/password authentication, it permits the use of weak, static administrative account credentials (e.g., msfadmin / msfadmin).

Software Vulnerabilities

• Command: nmap --script vuln -p 22 10.0.2.3
• Result: Vulnerable to Key Guessing (CVE-2008–0166). The target operating system uses a flawed Debian OpenSSL package with a predictable Random Number Generator (RNG). An attacker can pre-compute cryptographic keys to compromise the server via rapid brute-force guessing attacks.

Access Control Policy

• Permissive Configuration. The service fails to implement account lockout thresholds or rate-limiting filters. It allows continuous remote dictionary brute-force attempts without dropping the network connection

FOR PORT 23 Telnet

potential Security risks: Telnet does not encrypt communication by default credentials and session information may be exposed to network observers.

Analysis for Port 23 (Telnet)

Service Detection

• Command: nmap -p 23 -sV -sC 10.0.2.3
• Result: Linux telnetd

Login / Auth Check

• Horrendously Misconfigured / Cleartext Transmission. The server prompts for traditional authentication, but all credentials (usernames and passwords) are transmitted over the wire completely unencrypted, allowing easy sniffing. Furthermore, it yields full access to weak default credentials (msfadmin).

Software Vulnerabilities

• Command: nmap --script vuln -p 23 10.0.2.3
• Result: Vulnerable via Host Trust Abuse. Due to unsafe configuration files across legacy remote handling modules on the machine (like + + wildcards inside the .rhosts file), an attacker can pivot or manipulate adjacent parameters to obtain a root login without completing password authentication.

Access Control Policy

• Extremely Poor Security Posture. The Telnet application completely lacks encryption, session integrity checks, or traffic isolation. It acts as an open remote shell entrypoint that exposes the machine to full control via automated password-cracking tools

FOR PORT 25 SMTP

Service Detectionnmap -p 25 -sV -sC 10.0.2.3Postfix ESMTP (Ubuntu)

Login / Auth CheckBanner Grab / EHLONo Authentication Supported. The 250-AUTH parameter is entirely absent, confirming standard username/password logins are disabled on Port 25.

Software Vulnerabilities--script smtp-vuln*Not Vulnerable to standard automated checks (e.g., CVE-2010-4344 is an Exim-specific flaw; target runs Postfix).

User Enumeration--script smtp-enum-usersFailed / Inconclusive. The server does not leak valid local operating system accounts through automated VRFY or RCPT methods.

Access Control Policy--script smtp-open-relaySecure. The server is not an open relay, indicating it enforces strict traffic-filtering boundaries

the SMTP service on 10.0.2.3 maintains a strong default security posture on Port 25. While basic network identity data (such as the software name, OS family, and hypervisor type) is cleanly exposed during initial footprinting, the service effectively restricts unauthorized access by eliminating login endpoints, masking user enumeration patterns, and explicitly blocking open mail relaying.

FOR PORT 80 http

Service Mappingnmap -p 80 -sV -sC 10.0.2.3Apache httpd 2.2.8 (Ubuntu) with WebDAV enabled

Path Mappingnmap -p 80 --script http-enum 10.0.2.3Identified administrative interfaces (/phpMyAdmin/, /tikiwiki/) and diagnostic pages (/phpinfo.php)

Access Policynmap -p 80 --script http-enum 10.0.2.3Over-permissive directory configurations allowing public directory listings on /doc/ and /icons/.

Web ServerApache 2.2.8Explicitly leaks software version; allows targeted version tracking.

Backend LanguagePHP 5.2.4–2ubuntu5.10Discloses precise runtime framework and operating system distribution patch.

ExtensionsDAV/2 (WebDAV)Confirms distributed authoring extensions are active on the web application server.

Access ControlHTTP/1.1 200 OKPublic access permitted on root directory; no global authentication challenges.

Exposed Endpoints/phpMyAdmin/, /phpinfo.phpExposes sensitive operational architecture, diagnostics, and administrative dashboards.

FOR PORT 53

Service Detection

• Command: nmap -p 53 -sV -sC 10.0.2.3
• Result: ISC BIND 9.4.2 running on an Oracle VirtualBox virtual machine.
• No Public Recursion Supported. The server rejects recursive lookups from external network zones, confirming it only serves authoritative zones or restricts lookup capabilities to local system processes.

Software Vulnerabilities

• Command: nmap --script vuln -p 53 10.0.2.3
• Result: Not Vulnerable to standard automated checks. While older BIND versions are historically linked to spoofing flaws and the lack of open recursion mitigates automated exploitation paths.

Cache Poisoning & Zone Transfer

• Command: nmap --script dns-zone-transfer -p 53 10.0.2.3
• Result: Secure / Inconclusive. The server restricts zone transfers (AXFR) to unauthorized hosts, protecting internal network topology and domain mappings from data leakage.

Access Control Policy

• Strict Filtering Enforced. The name server drops or denies recursive queries from outside network segments, preventing attackers from leveraging the asset for DNS amplification or distributed denial-of-service (DDoS) reflection attacks.

Conclusion Summary

The DNS service on 10.0.2.3 maintains a defensive operational posture on Port 53. While essential service identity footprints (such as the software version and hypervisor platform) are openly exposed during initial version scanning, the application effectively limits its attack surface by disabling public recursive queries, shielding zone data, and blocking external cache manipulation tactics.

FOR PORT 445

Analysis for Port 445 (SMB / Samba)

Service Detection

• Command: nmap -p 445 -sV -sC 10.0.2.3
• Result: Samba 3.0.20-Debian

Login / Auth Check

• Anonymous Share Enumeration Permitted. The server allows unauthenticated external clients to list local share names (such as IPC$) without requiring valid system user credentials.

Software Vulnerabilities

• Command: nmap --script vuln -p 445 10.0.2.3
• Result: Highly Vulnerable (Critical — CVE-2007–2447). The target runs Samba 3.0.20, which is vulnerable to the "usermap_script" Arbitrary Command Execution flaw. Because the application handles username input unsafely inside shell scripts, an attacker can append shell metacharacters to a login name to execute operating system commands as the root user.

Exploitation & Verification

• Framework: Metasploit Framework (msfconsole)
• Module Used: exploit/multi/samba/usermap_script

The Samba service on 10.0.2.3 presents an extremely compromised operational posture on Port 445. Unlike the securely restricted DNS and SMTP layers, this entrypoint provides a direct, unauthenticated pathway to full machine compromise. By exploiting an input validation flaw inside the username handler, an external attacker can completely bypass authentication structures to establish a persistent root execution shell, granting absolute administrative control over the host filesystem.