FTP-SMB-Exploitation LAB

Practical exploitation of FTP and SMB services using Kali Linux and Metasploitable

📌 Overview

This project demonstrates practical exploitation of common network services (FTP and SMB) in a controlled lab environment using Kali Linux and Metasploitable

The goal is to understand how attackers identify, enumerate, and exploit misconfigured services.

🛠️ Tools Used

• Kali Linux
• Nmap
• Metasploitable
• smbclient

Lab Setup

• Attacker: Kali Linux
• Target: Metasploitable 2
• Tool: Oracle VM VirtualBox
• Network: NAT Network

🌐 Services Exploited

• FTP (File Transfer Protocol)
• SMB (Server Message Block)

🔍 FTP Exploitation and Enumeration

• The target IP address was identified using: ifconfig Target IP: 10.0.2.3
• Used Nmap -A to scan open ports
• Accessed FTP service using: ftp 10.0.2.3 with the The Login credentials: Username: msfadmin Password: msfadmin
• Then i exploited FTP weak/default credentials: msfadmin with the following Commands used to gain access to directory: 1) ls 2) cd vulnerable
• Also Carried out a post Exploitation using the following commands to navigate system: 1) ls 2) cd /home Result: Verified access to system directories and demonstrated ability to navigate the system.

🧪 Conclusion

Nmap scanning revealed that port 21 was open, indicating the presence of an FTP service. Further enumeration and exploitation using Metasploit targeted the vsftpd vulnerability, which allowed unauthorized access to the system. This highlights the risk posed by outdated or misconfigured FTP services, emphasizing the importance of patch management and secure service configuration to prevent potential data breaches. To Prevent this, regular auditing and strong authentication practices are critical

Recommendation

• Disable default credentials
• Restrict FTP access
• Implement strong authentication

🔍 SMB Exploitation and Enumearation

• The target IP address was identified using: ifconfig Target IP: 10.0.2.3
• Used Nmap -SV to scan open ports, Result Shows that Port 445 (SMB) was opened
• Enumerated SMB shares: smbclient -L //10.0.2.3 -N , Result: List of available shares displayed.
• Run some exploit commands and carried out post exploits, Result: Confirmed system access and verified command execution.

🧪 Conclusion

Nmap scanning revealed that port 445 was open, indicating the presence of an SMB service. Further enumeration using smbclient identified multiple shared resources on the system, some of which could be accessed without authentication. This demonstrates the potential for sensitive information exposure and underscores the need for strict access controls and regular auditing of SMB shares to mitigate security risks. Samba misconfigurations in production systems are a common target for attackers. Maintaining updated patches and restricting access can prevent remote code execution attacks

Recommendation

• Patch Samba services
• Disable vulnerable configurations
• Restrict SMB access

Screenshot

The Document containing Screenshot can be accessed via this link: https://docs.google.com/document/d/14uX_Ll7zla4tKhDAdcGILPhE00MnU1Et/edit?usp=sharing&ouid=116271323156061573339&rtpof=true&sd=true