Metasploitable2: from zero to root in minutes

Context

Metasploitable2 is an intentionally insecure Linux image, a standard practice target for learning web and network testing. It ran locally in Docker and was never exposed beyond the lab network.

What the skills did

• Recon. A port scan and service fingerprinting mapped the exposed network services and the web application.
• Enumeration. The web application was reviewed for exposed content, and the services were checked for default configuration. The landing page published a working credential, the kind of disclosure that turns recon into a shortcut.
• Access and escalation. The credential gave an authenticated shell. An over-permissive sudo configuration then allowed the account to reach root.
• Independent finding. A separate check found that the web server accepted file uploads with no authentication. This path does not depend on the first, so fixing the credential alone would not close it.
• Reporting. Three documents were produced and rendered to PDF.

What it shows

• Speed is a property of the target. Most of the speed came from the target handing over its own access path. Don't read the run as a claim about real-world pace.
• Dormant risk gets its own finding. Several old, well-known services were not reachable from outside because of how the container's ports were set up. The report records them as informational, so a future port change isn't mistaken for a new problem.
• Scope discipline held. The engagement stopped once full access was proven and did not exploit the extra demo applications.

Lessons

• Read the landing page before scanning. Lab and real systems alike sometimes publish their own shortcuts.
• Check for a second path to the same objective. One fix can leave the other path open.
• Report timings with their precision and caveats. An unqualified "six minutes" invites the wrong comparison.

Generated files

Three PDFs, rendered from Markdown by the skill's render script.