Owning the Linux Box: Metasploitable 2 (Module M2)
Pentest Range series · Part 2 of 5 · by Vinh NTT
Metasploitable 2 has been the world's teaching ground for network exploitation for over a decade — an Ubuntu-era server deliberately riddled with classic, well-documented flaws. In the CertInstructor Pentest Range it lives at 10.10.10.11, and Module M2 walks you through eleven labs that take it apart from first scan to final report.
Simulation only. Every command and exploit in M2 is simulated in your browser. Nothing real is scanned or attacked.
The M2 kill chain — eleven labs
The labs are sequenced as a single engagement. Recon feeds credential access, which feeds exploitation, which branches into the web stack and a set of trust/enumeration paths, and it all ends from the defender's chair:
| Stage | Lab | Phase | ATT&CK idea |
|---|---|---|---|
| 01 | Nmap | Reconnaissance | Map services, versions, weaknesses |
| 02 | Hydra | Credential Access · online | Guess live logins against running services |
| 03 | Cracking | Credential Access · offline | Crack captured hashes on your own machine |
| 04 | Metasploit | Exploitation · Initial Access | Exploit a flagged CVE — no password needed |
| 05 | Web Recon | Recon · Web content discovery | Enumerate hidden dirs & files behind port 80 |
| 06 | Web Exploitation | Exploitation · Injection (A03) | DVWA: SQLi, command injection, a web-shell foothold |
| 07 | Web Client-Side | XSS / CSRF / Access Control (A01/A03) | Attack DVWA in the victim's browser |
| 08 | r-services | Initial Access · Trust & Backdoors | Walk in with no password via host-trust + the 1524 root backdoor |
| 09 | NFS Enumeration | Discovery · Service enum → root | SMTP user-enum + an NFS no_root_squash export → read /etc/shadow
|
| 10 | X11 Capture | Collection · Remote screen capture | An open X server (xhost +) → dump the victim's screen, no exploit |
| 11 | Blue Team | Detection & Defense | Reconstruct the whole attack from the logs |
Step by step: your first lab (Nmap)
The Nmap recon lab is the template for how every lab in the range works, so let's do it properly once.
- From the range portal, enter the Linux platform (M2) — you'll land on the M2 Lab Launcher.
- Open Stage 01 · Nmap. The terminal drops you onto the Kali box, aimed at
10.10.10.11. -
Run a basic scan: type
nmap 10.10.10.11. You'll see the open ports come back — FTP, SSH, Telnet, SMB, and more. (Mission 01 ticks off.) -
Detect versions: run
nmap -sV 10.10.10.11. Now you know which vsftpd, which Samba — the version is what tells you whether a known CVE applies. (Mission 02.) -
Hunt vulnerabilities: run
nmap --script vuln 10.10.10.11to fire the NSE vulnerability scripts and surface flagged issues like the vsftpd 2.3.4 backdoor (CVE-2011-2523). (Mission 03.) -
Check weak auth: run
nmap --script auth 10.10.10.11(or--script ftp-anon) to find anonymous/empty-credential services. (Mission 04.) - Take the quiz. The knowledge check ties each finding back to its CVE and technique. Nail it and the lab is complete.
Notice the loop: run a command → satisfy an objective → understand why on the quiz. Every one of the other ten labs works exactly this way — only the tool and the target service change.
Working the rest of the module
- Hydra → Cracking is the classic credential-access pair: guess live logins online with Hydra, then take the hashes you capture and break them offline with a wordlist. Doing them back to back teaches you when each approach is the right call.
- Metasploit shows you initial access via a flagged CVE — a foothold with no password at all.
- The web branch (Web Recon → Web Exploitation → Web Client-Side) is a mini web-app course on its own: discover hidden content, then attack DVWA with SQL injection, command injection and a web shell, then pivot to the client-side flaws (XSS, CSRF, broken access control) that fire in the victim's browser.
-
r-services, NFS enum and X11 are the "no exploit required" labs — the ones that teach you that misconfiguration and misplaced trust are as dangerous as any CVE. The NFS lab in particular walks a beautiful chain: enumerate users over SMTP, abuse an
no_root_squashexport to read/etc/shadow, and plant a SUID root shell. - Blue Team closes the module: hunt the traces your own attacks left in the logs and reconstruct the kill chain from the defender's side.
Where M2 fits in your certification path
M2 is offensive security proper — the recon-to-exploitation-to-post-exploitation lifecycle that CompTIA PenTest+ is built around. If the web labs are your favourite part, that's the injection and application-security domain; if the trust/enumeration labs click, that's the "attacks don't need exploits" lesson every good pentester internalises.
Next step when you're ready: the CompTIA PenTest+ CertMaster Labs (PT0-003 V3) put this same lifecycle onto official, exam-aligned lab environments with feedback. Free range first; CertMaster Labs when you want the credential.
Up next
You've owned a Linux box end to end. Windows plays by different rules — SMBv1, Active Directory, NTLM hashes — and it's next.
→ Continue to Module M3 — The Windows Kill Chain (Metasploitable 3)
About the author — Vinh NTT , founder of CertInstructor, 20+ years in IT-security training. Full CompTIA security stack (Security+, CySA+, PenTest+, SecurityX); two-time EC-Council Instructor Circle of Excellence Award winner (2022 & 2023). The Pentest Range is his original work, shared free.
0件のコメント