Build a Penetration Testing Lab

Set up an isolated lab and exploit your first real vulnerability using Metasploit.

Introduction

30 Second Summary

Every time a company gets hacked, security professionals ask the same question: how did we miss that? Organizations hire penetration testers to find and exploit weaknesses before real attackers do.

In this project, you will build your own isolated penetration testing lab and perform your first real exploit. You will set up an attacker machine and a deliberately vulnerable target, then use professional tools to scan for weaknesses and gain root access.

What You'll Build

A fully isolated penetration testing lab on your local Windows machine, with a Kali Linux attacker VM and a Metasploitable 2 target VM connected on a private network.

By the end of this project, you'll have:

  • A working Kali Linux attack VM and Metasploitable 2 target VM running on an isolated host-only network inside VirtualBox.
  • Successful root shell access on the target system by exploiting the vsftpd 2.3.4 backdoor using Metasploit Framework.
  • A structured penetration test findings report documenting your methodology, tools used, and remediation recommendations.
  • Secret Mission: Independently exploit a second service (UnrealIRCd backdoor) and add it to your findings report.

Are there any prerequisites?

No prior security experience is needed. This guide walks you through the full setup of every tool from scratch. You just need a Windows PC with at least 8 GB of free RAM and 10 GB of free disk space.

Install VirtualBox and Download Lab Images

Every penetration test starts with a controlled environment. Professional pentesters use virtual machines to safely contain their attack tools and vulnerable targets without risking real systems.

In this step, you will install Oracle VirtualBox (the software that runs virtual machines) and download the two VM images you need: Kali Linux as your attacker machine and Metasploitable 2 as your deliberately vulnerable target.

In this step, get ready to:
  • Install Oracle VirtualBox 7.2.10 on your Windows PC.
  • Install 7-Zip for extracting compressed archive files.
  • Download the Kali Linux and Metasploitable 2 VM images.
Download and install Oracle VirtualBox

VirtualBox is a free, open-source application that lets you run entire operating systems inside windows on your desktop. You need it to host both your Kali Linux attack VM and your Metasploitable 2 target VM.

  • Open your web browser and go to https://www.virtualbox.org/wiki/Downloads.
  • Under VirtualBox platform packages, click the Windows hosts link to download the installer file VirtualBox-7.2.10-174163-Win.exe (approximately 170 MB).
  • Once downloaded, double-click VirtualBox-7.2.10-174163-Win.exe to launch the installer.
  • Click Next on each screen, accepting the default settings.
  • When prompted about network interfaces, click Yes to allow the installation to proceed.
  • Click Install, then Finish once the installation completes.

What is VirtualBox?

VirtualBox is a hypervisor. It creates isolated virtual computers on your real hardware. Each virtual machine gets its own operating system, network interfaces, and storage, completely separated from your host Windows machine.

This isolation is what makes it safe to run intentionally vulnerable systems like Metasploitable 2. Nothing inside a VM can escape to affect your real machine.

Now verify that VirtualBox installed correctly.

  • Press the Windows key to open your search bar.
  • Type Command Prompt and press Enter to open it.
  • Check your VirtualBox version by running this command:
VBoxManage --version

✔️ I see 7.2.10 or higher

VirtualBox is installed and ready. You should see output like 7.2.10r174163. Close the Command Prompt and continue to the next substep.

ⓧ I see an older version

You have an older version of VirtualBox installed. You need version 7.2.10 or higher for this project.

  • Open VirtualBox Manager.
  • Click File in the top menu, then Check for Updates.
  • If no update is offered, go to https://www.virtualbox.org/wiki/Downloads and download the latest Windows installer.
  • Run the new installer. It will upgrade your existing installation.
  • After the upgrade, open a new Command Prompt and run VBoxManage --version again to confirm the version is 7.2.10 or higher.

ⓧ Command not recognized

This means VirtualBox did not install correctly, or the installer did not add it to your system PATH.

  • Try running the installer again by right-clicking VirtualBox-7.2.10-174163-Win.exe and selecting Run as administrator.
  • Accept all defaults and complete the installation.
  • Close your Command Prompt, open a fresh one, and try VBoxManage --version again.
  • If it still fails, try the full path:
"C:\Program Files\Oracle\VirtualBox\VBoxManage.exe" --version

If this returns a version number, VirtualBox is installed but not in your PATH. You can continue with the project. VirtualBox Manager will still launch normally.

Installer asking to reboot?

The VirtualBox installer may ask you to restart your computer to finish setting up network drivers. Go ahead and restart, then re-open Command Prompt and verify the version.

help me troubleshoot VirtualBox installation on Windows

Download 7-Zip and the Kali Linux VM image

The Kali Linux VM image is distributed as a .7z archive. Windows cannot extract this format natively, so you need 7-Zip installed first.

  • Press the Windows key, type 7-Zip, and check whether it appears in your search results.

✔️ I see 7-Zip in search results

7-Zip is already installed. Skip the 7-Zip installation and continue to downloading Kali Linux below.

ⓧ 7-Zip is not installed

  • Open your browser and go to https://www.7-zip.org/.
  • Click the Download link next to 64-bit x64 to get the .exe installer (about 1.6 MB).
  • Run the downloaded installer and click Install.
  • Click Close when the installation finishes.

Now download the Kali Linux VM image.

  • Go to https://www.kali.org/get-kali/.
  • Click Virtual Machines.
  • Find the VirtualBox option (64-bit) and click the download button to get kali-linux-2026.1-virtualbox-amd64.7z (approximately 3.6 GB).
  • Save the file to your Downloads folder. This download may take 10-20 minutes depending on your internet speed.

Why a pre-built image instead of an ISO?

Kali Linux offers pre-built VirtualBox images that are ready to run immediately. They skip the entire operating system installation process, which is not the learning objective here.

The pre-built image also includes VirtualBox Guest Additions (for better display and clipboard integration) already configured.

Download seems stuck or slow?

The Kali image is 3.6 GB. On slower connections, this can take a while. Start the Metasploitable 2 download (next substep) in a separate browser tab while Kali downloads.

help me troubleshoot slow Kali Linux download

Download Metasploitable 2

Metasploitable 2 is a deliberately vulnerable Linux VM created by Rapid7 (the company behind Metasploit). It runs dozens of intentionally insecure services for you to practice against.

Why Metasploitable 2?

Metasploitable 2 provides real network-level vulnerable services like FTP, SSH, and IRC. This teaches you network penetration testing. Other practice targets like DVWA only cover web application attacks.

Network pentesting is foundational. It is Phase 1 on most cybersecurity career roadmaps and teaches skills that carry into every other specialization.

  • Confirm both files are in your Downloads folder: kali-linux-2026.1-virtualbox-amd64.7z and metasploitable-linux-2.0.0.zip.

Missing one of the files?

If a download failed or was interrupted, delete the partial file and restart the download. SourceForge and Kali mirrors sometimes timeout. Try clicking the download link again.

help me troubleshoot failed downloads for Metasploitable 2 or Kali Linux images

Your tools are installed and your VM images are ready. Next up, you will create an isolated virtual network and import both VMs into VirtualBox.

Set Up the Isolated Lab Network and Import VMs

Your tools are installed and your VM images are downloaded. Now it's time to wire them together into an isolated pentesting lab.

A penetration testing lab must be completely separated from your real network. Metasploitable 2 has dozens of known exploitable services running by design. If it were exposed to the internet, anyone could compromise it. In this step, you'll create a private virtual network and connect both VMs to it so they can only talk to each other.

In this step, get ready to:
  • Create an isolated host-only network in VirtualBox.
  • Import and configure the Kali Linux attack VM.
  • Create and configure the Metasploitable 2 target VM.
Create a host-only network

A host-only network creates a private virtual network that exists only between your VMs and your host machine. It has no route to the internet or your home network.

  • In VirtualBox Manager, click File in the top menu bar.
  • Hover over Tools, then click Network Manager.
  • In the Network Manager window, make sure you are on the Host-Only Networks tab.
  • Click Create.
  • A new network adapter appears in the list. Note its name. On Windows, it will be something like VirtualBox Host-Only Ethernet Adapter.

You should see the new network listed in the Network Manager with a green indicator. Leave the DHCP settings at their defaults.

What is a host-only network?

VirtualBox creates a virtual network interface on your Windows machine. VMs attached to this network can communicate with each other and with your host, but they cannot reach the internet or any devices on your home Wi-Fi.

This isolation is critical for a pentesting lab. Metasploitable 2 is deliberately vulnerable, so keeping it locked away from real networks protects you and others.

Don't see the Host-Only Networks tab?

Make sure you opened Network Manager from File > Tools > Network Manager, not from an individual VM's settings. The Host-Only Networks tab only appears in the global Network Manager.

help me find the Network Manager in VirtualBox

Import and configure the Kali Linux VM

The Kali Linux pre-built VM ships as a .7z archive containing a ready-to-use .vbox file. You'll extract it, add it to VirtualBox, and then point its network adapter at the host-only network you just created.

  • Open File Explorer and navigate to where you downloaded kali-linux-2026.1-virtualbox-amd64.7z.
  • Right-click the file, hover over 7-Zip, and click Extract Here (or Extract to kali-linux-2026.1-virtualbox-amd64\).
  • Wait for the extraction to complete. This may take a few minutes depending on your disk speed.

Once extracted, you'll see a folder containing the VM files including a .vbox file.

  • Switch back to VirtualBox Manager.
  • Click Add in the toolbar (or go to Machine > Add).
  • Navigate to the extracted Kali folder and select the .vbox file.
  • Click Open.

The Kali Linux VM now appears in VirtualBox Manager's list on the left. Next, configure its network and memory.

  • Select the Kali Linux VM in the list, then click Settings.
  • Click Network in the left panel.
  • On the Adapter 1 tab, set the Attached to dropdown to Host-only Adapter.
  • In the Name dropdown below it, select the host-only network you just created (VirtualBox Host-Only Ethernet Adapter).
  • Click System in the left panel.
  • Under the Motherboard tab, set Base Memory to 4096 MB (4 GB).
  • Click OK to save the settings.

Why 4 GB of RAM for Kali?

Kali Linux runs a full desktop environment plus security tools like Metasploit Framework, which loads hundreds of exploit modules into memory. 4 GB gives it enough headroom to run smoothly. Your machine has 40 GB total, so this allocation leaves plenty for Windows and the target VM.

Don't see the Add button?

Make sure you are looking at the main VirtualBox Manager toolbar, not inside a VM's settings. The Add button sits in the top toolbar alongside New and Settings. If your toolbar shows different buttons, click Machine in the menu bar and select Add from the dropdown.

help me add an existing VM to VirtualBox Manager

Create and configure the Metasploitable 2 VM

Unlike Kali, Metasploitable 2 ships as a raw .vmdk virtual disk file inside a zip archive. You'll create a brand new VM in VirtualBox and point it at this existing disk.

  • In File Explorer, locate metasploitable-linux-2.0.0.zip where you downloaded it.
  • Right-click the file and select Extract All.
  • Choose a destination and click Extract. Inside the extracted folder, you'll find a Metasploitable.vmdk file.

Now create a new VM that uses this disk.

  • Switch back to VirtualBox Manager.
  • Click New in the toolbar.
  • In the Name field, type Metasploitable2.
  • Set Type to Linux.
  • Set Version to Ubuntu (64-bit).
  • Click Next.
  • Set the memory (RAM) to 1024 MB (1 GB).
  • Click Next.
  • On the hard disk page, select Use an existing virtual hard disk file.
  • Click the folder icon to browse, then navigate to the extracted folder and select Metasploitable.vmdk.
  • Click Finish (or Create).

The Metasploitable2 VM now appears in VirtualBox Manager. Configure its network adapter to match the Kali VM.

  • Select Metasploitable2 in the VM list, then click Settings.
  • Click Network in the left panel.
  • On the Adapter 1 tab, set Attached to to Host-only Adapter.
  • In the Name dropdown, select the same host-only network (VirtualBox Host-Only Ethernet Adapter).
  • Click OK to save.

You should now see both VMs listed in VirtualBox Manager, each with a Powered Off status.

Why both VMs on the same host-only network?

Putting both VMs on the same host-only adapter means Kali can reach Metasploitable 2 over a private network, just like two machines plugged into the same switch in an air-gapped lab. Neither VM can reach the internet, your home router, or any other device on your Wi-Fi.

VirtualBox showing an error about the .vmdk file?

Make sure you extracted the full zip archive before browsing for the disk. If you try to select the .vmdk file while it is still inside the zip, VirtualBox cannot read it. Also confirm you are selecting Metasploitable.vmdk, not another file in the folder.

help me troubleshoot adding a .vmdk file to a new VirtualBox VM

Your isolated lab is fully configured. Both VMs are connected to the same private network and ready to power on. Next up, you'll boot both machines and perform your first network reconnaissance scan against the target.

Boot the Lab and Perform Reconnaissance

Your lab environment is fully configured with both VMs on an isolated host-only network. Now it is time to power everything on and see what the target is actually running.

In a real penetration test, the first phase is reconnaissance. You gather information about your target before attempting anything. In this step, you will boot both machines, confirm they can talk to each other, and use Nmap to discover exactly which services are exposed on the target.

In this step, get ready to:
  • Boot both VMs and identify the target's IP address.
  • Verify network connectivity between attacker and target.
  • Scan the target with Nmap to discover open ports and service versions.
Start both virtual machines

The target must be running before you can scan it. You will boot Metasploitable 2 first, grab its IP address, and then start Kali Linux.

  • In VirtualBox Manager, select your Metasploitable2 VM.
  • Click the Start button in the toolbar (the green arrow).
  • Wait for the login prompt to appear in the VM window.
  • Log in with username msfadmin and password msfadmin.
  • Find the target's IP address by running this command in the Metasploitable terminal:
ifconfig

What am I looking for?

Look at the eth0 section of the output. Find the line that begins with inet addr: followed by an IP address. It will be something like 192.168.56.101. Write this number down. You will use it for every scan in this step.

  • Back in VirtualBox Manager, select your Kali Linux VM.
  • Click Start to boot it.
  • Log in with username kali and password kali.
  • Right-click the desktop and select Open Terminal Here to open a terminal window.

VM won't start?

If you see a "VT-x is not available" error, you need to enable virtualization in your BIOS/UEFI settings. Restart your computer, enter the BIOS, and look for Intel VT-x or AMD-V under CPU settings.

If the VM window opens but stays on a black screen for more than 60 seconds, try increasing the VM's RAM allocation in Settings > System.

Help me troubleshoot my VM not starting in VirtualBox.

Verify connectivity and discover hosts

Before running a detailed scan, confirm that your Kali machine can reach the target. A simple ping proves the host-only network is working correctly.

  • In your Kali terminal, ping the Metasploitable IP to verify connectivity:
ping -c 3 [[TARGET_IP="your Metasploitable IP, e.g. 192.168.56.101"]]

What does this command do?

The -c 3 flag tells ping to send exactly 3 packets and then stop. You should see three replies with response times, confirming the two VMs can communicate over the host-only network.

You should see three lines showing successful replies with response times. If you see "0 received" instead, double-check that both VMs have their network adapter set to the same host-only network.

  • Perform a host discovery scan across the entire lab subnet by running:
nmap -sn 192.168.56.0/24

What does this command do?

The -sn flag tells Nmap to skip port scanning and only check which hosts are alive on the network. The /24 means "scan all 256 addresses in this subnet."

You should see your Kali machine, the Metasploitable target, and possibly the VirtualBox host adapter listed as live hosts. This confirms what machines exist on your isolated network.

Not seeing any hosts?

Make sure both VMs are fully booted before running the scan. Metasploitable 2 takes a moment to bring its network interface online after login.

If you see only your Kali IP, verify that the Metasploitable VM's network adapter is set to Host-only Adapter in its VirtualBox settings. Both VMs must use the same host-only network name.

Help me troubleshoot why Nmap host discovery isn't finding my target VM.

Run a detailed service scan

Now you know which hosts are on the network. The next step is to find out what services those hosts are running and which software versions they use. This is where vulnerabilities become visible.

  • Run a service version scan against the target by running:
nmap -sV [[TARGET_IP="your Metasploitable IP, e.g. 192.168.56.101"]]

What does this command do?

The -sV flag tells Nmap to probe each open port and identify the exact software and version running on it. This is the key difference from a basic port scan. Instead of just "port 21 is open," you get "port 21 is running vsftpd 2.3.4."

The scan will take a minute or two. When it finishes, you will see a table of open ports with their service names and version numbers. Look specifically for port 21 showing vsftpd 2.3.4 in the VERSION column. This is the vulnerable service you will exploit in the next step.

You should see a large number of open ports. Metasploitable 2 is intentionally loaded with vulnerable services. The critical one for this project is port 21 running vsftpd 2.3.4.

  • Save the scan results to a file for your findings report by running:
nmap -sV [[TARGET_IP="your Metasploitable IP, e.g. 192.168.56.101"]] -oN scan_results.txt

What does the -oN flag do?

The -oN flag saves the scan output in "normal" human-readable format to the specified file. The scan still displays results in your terminal as usual, but now a copy is also written to scan_results.txt in your home directory. You will reference this file when writing your penetration test report.

  • Verify the file was created by running:
ls scan_results.txt

You should see scan_results.txt listed in the output. This confirms your scan data is saved.

Scan taking a very long time?

Metasploitable 2 has many open ports, so a full -sV scan can take 2-3 minutes. This is normal. Do not interrupt it with Ctrl+C or you will lose the results.

If the scan hangs for more than 5 minutes, your network connection between the VMs may have dropped. Try pinging the target again to confirm connectivity, then re-run the scan.

Help me figure out why my Nmap service scan is not completing.

You have completed the reconnaissance phase. You now have a detailed map of every service running on the target. Next up, you will use this intelligence to exploit the vsftpd 2.3.4 backdoor and gain root access.

Exploit the vsftpd 2.3.4 Backdoor

Your Nmap scan revealed the services running on the target, including their exact version numbers. Now it's time to weaponize that information.

In this step, you'll use Metasploit Framework to exploit the vsftpd 2.3.4 backdoor you discovered on port 21. This is the same tool and methodology professional penetration testers use on real engagements.

In this step, get ready to:
  • Launch Metasploit Framework and find the vsftpd exploit module.
  • Configure the exploit with your target's IP and payload.
  • Run the exploit and verify you have root access on the target.
Launch Metasploit and select the exploit module

Metasploit Framework is a penetration testing platform that contains thousands of exploit modules. It is pre-installed on Kali Linux and ready to use from the terminal.

  • In your Kali Linux terminal, launch Metasploit by running this command:
msfconsole

What does this command do?

The msfconsole command starts the Metasploit Framework Console. It loads all available exploit modules, payloads, and auxiliary tools into memory.

This takes 30-60 seconds the first time. You'll see an ASCII art banner followed by a summary of available modules, then the msf6 > prompt.

You should see the msf6 > prompt, indicating Metasploit is ready for commands.

Not seeing the msf6 prompt?

If the command hangs or you see database errors, wait a full minute. Metasploit initializes its database on first launch and this can be slow.

If you see a "command not found" error, Metasploit may not be installed. On Kali Linux it is pre-installed, but you can reinstall with sudo apt install metasploit-framework.

Help me troubleshoot Metasploit not launching on Kali Linux.

  • Search for the vsftpd exploit by running this command at the msf6 > prompt:
search vsftpd

You should see a results table listing the module exploit/unix/ftp/vsftpd_234_backdoor with a rank of Excellent.

  • Select this module by running:
use exploit/unix/ftp/vsftpd_234_backdoor

What is this module?

This module exploits a malicious backdoor that was added to the vsftpd 2.3.4 download archive in 2011 (CVE-2011-2523). When a username ending in :) is sent to the FTP server, it opens a command shell on port 6200.

This was a real supply-chain attack where attackers compromised the official vsftpd source code. Your Metasploitable 2 target is still running this backdoored version.

Your prompt changes to msf6 exploit(unix/ftp/vsftpd_234_backdoor) > confirming the module is active.

Module not found in search results?

Make sure you typed search vsftpd exactly. Metasploit search is case-insensitive but the keyword must match.

If the search returns zero results, your Metasploit installation may be incomplete. Try running reload_all at the msf6 > prompt to reload all modules.

Help me find the vsftpd exploit module in Metasploit.

Configure the exploit

Every Metasploit exploit module needs to know its target. You'll set the target IP address and choose a payload that gives you an interactive shell.

  • Set the target IP address by running this command (replace the IP with your Metasploitable 2 IP if different):
set RHOSTS [[TARGET_IP="your Metasploitable 2 IP address"]]
  • Set the payload to an interactive command shell by running:
set PAYLOAD cmd/unix/interact
  • Verify your configuration by running:
show options

What do these settings mean?

  • RHOSTS is the remote host (your target's IP address).
  • PAYLOAD tells Metasploit what to deliver after exploitation. The cmd/unix/interact payload gives you a direct interactive shell without needing a reverse connection.
  • RPORT is already set to 21 (the FTP port) by default. You do not need to change it.

In the show options output, confirm that RHOSTS shows your target IP and RPORT shows 21.

RHOSTS showing a different IP?

If you made a typo, just run the set RHOSTS command again with the correct IP. Each set command overwrites the previous value.

Double-check your target IP by switching to your Metasploitable 2 VM window and running ifconfig again.

Help me configure the vsftpd exploit correctly in Metasploit.

Run the exploit and verify root access

Everything is configured. This is the moment you run the exploit and attempt to gain unauthorized access to the target system.

  • Launch the exploit by running:
exploit

If successful, you will see "Command shell session 1 opened" in the output. You now have a root shell on the target system.

What just happened?

Metasploit connected to the FTP server on port 21 and sent a username containing the :) trigger characters. This activated the backdoor, which opened a listening shell on port 6200. Metasploit then connected to that port and gave you access.

The shell you now have runs as root. This means you have complete control over the target system.

  • Verify your access level by running:
id

You should see uid=0(root) gid=0(root) confirming you have root (administrator) access.

  • Run these additional commands to confirm where you are:
whoami
hostname

The whoami command returns root and hostname returns the Metasploitable target's name.

  • Exit the target shell by typing:
exit
  • Exit Metasploit by typing:
exit

Exploit failed or no session opened?

If you see "Exploit completed, but no session was created," the backdoor port (6200) may not have responded in time. Run exploit again. This exploit is rated Excellent and works reliably, but occasionally needs a second attempt.

Make sure your Metasploitable 2 VM is still running. Check VirtualBox Manager and verify the VM status shows "Running."

If you see a connection refused error, confirm both VMs are on the same host-only network. Return to VirtualBox and verify both VMs have their network adapter set to the same Host-only Adapter.

Help me troubleshoot why the vsftpd exploit is not creating a session.

You just gained root access to your first target using a real exploit. Next up, you'll document your findings in a professional penetration test report.

Document Your Findings

You just exploited a real vulnerability and gained root access on a target system. That is a major milestone.

Professional penetration testers spend as much time writing reports as they do hacking. A clear, structured findings document is what turns a technical exploit into actionable intelligence that organizations use to fix their security gaps. In this step, you will create a proper findings report and preserve your lab for future practice.

In this step, get ready to:
  • Create a structured penetration test findings report.
  • Include your Nmap scan output and note additional vulnerable services.
  • Take VM snapshots to preserve your clean lab state.
Create your findings report

A penetration test report follows a consistent structure: what was tested, what tools were used, what was found, how severe it is, and how to fix it. This format is what hiring managers look for when evaluating junior security analysts.

  • In your Kali Linux terminal, open a new file in nano by running this command:
nano pentest_report.txt
  • Type the following report content into the editor:
PENETRATION TEST FINDINGS REPORT
=================================

Date: [[DATE="today's date, e.g. 2026-06-21"]]
Tester: [[TESTER="your name"]]
Target: 192.168.56.101 (Metasploitable 2)

TOOLS USED
----------
- Nmap (network scanning and service enumeration)
- Metasploit Framework (exploitation)

FINDING #1: vsftpd 2.3.4 Backdoor Command Execution
----------------------------------------------------
Port: 21/tcp
Service: vsftpd 2.3.4
CVE: CVE-2011-2523
Severity: Critical

Access Gained: Root shell (uid=0(root) gid=0(root))
Metasploit Module: exploit/unix/ftp/vsftpd_234_backdoor

Description:
The target is running vsftpd 2.3.4, which contains a backdoor
that was inserted into the source code distribution. A username
ending in :) triggers a command shell listening on port 6200,
granting full root access without authentication.

Remediation:
Upgrade vsftpd immediately to a current release that does not
contain the backdoor. Remove the compromised version from the
system entirely.

What does this report structure cover?

Every professional pentest finding includes these elements:

  • Target and date identify what was tested and when.
  • CVE number links to the public vulnerability database so defenders can research the issue.
  • Severity rating tells the organization how urgently to fix it.
  • Remediation gives the organization a clear action to resolve the vulnerability.

Do not save or close the file yet. You will add more content in the next substep.

Include your scan results and save the report

Your Nmap scan revealed many more vulnerable services beyond the one you exploited. Documenting these shows thoroughness and gives the target organization a full picture of their attack surface.

  • Still in nano, position your cursor below the Remediation section and add the following:

ADDITIONAL VULNERABLE SERVICES OBSERVED
---------------------------------------
(Full scan output saved in: scan_results.txt)

The following additional services were identified during
reconnaissance and represent potential attack vectors:

- Port 22/tcp: SSH
- Port 23/tcp: Telnet (unencrypted remote access)
- Port 25/tcp: SMTP
- Port 80/tcp: HTTP
- Port 139/tcp: NetBIOS/Samba
- Port 445/tcp: Samba
- Port 3306/tcp: MySQL
- Port 5432/tcp: PostgreSQL
- Port 6667/tcp: UnrealIRCd

Each service should be investigated in follow-up testing
for known vulnerabilities and misconfigurations.

END OF REPORT

What if my scan showed different ports?

The ports listed above are typical for Metasploitable 2. If your scan_results.txt shows different ports or services, update your report to match what you actually observed. Your report should reflect your real scan data.

  • Save the file by pressing Ctrl+O, then press Enter to confirm the filename.
  • Exit nano by pressing Ctrl+X.
  • Verify your report saved correctly by running:
cat pentest_report.txt

You should see the full report printed in your terminal, starting with the header and ending with the additional services section.

File is empty or missing?

  • If cat shows nothing, you may have pressed Ctrl+X without saving first. Run nano pentest_report.txt again and re-enter your content. This time, press Ctrl+O and Enter before pressing Ctrl+X.
  • If you see a "Permission denied" error, make sure you are in your home directory by running cd ~ before opening nano.

Why isn't my pentest_report.txt saving in nano?

✔️ Awesome, I've got everything!

Great. Double check you see all sections in your report output, from the header through to the additional services list.

ⓧ I'd like to double check the full code

Here is the complete pentest_report.txt content for comparison:

PENETRATION TEST FINDINGS REPORT
=================================

Date: [[DATE="today's date, e.g. 2026-06-21"]]
Tester: [[TESTER="your name"]]
Target: 192.168.56.101 (Metasploitable 2)

TOOLS USED
----------
- Nmap (network scanning and service enumeration)
- Metasploit Framework (exploitation)

FINDING #1: vsftpd 2.3.4 Backdoor Command Execution
----------------------------------------------------
Port: 21/tcp
Service: vsftpd 2.3.4
CVE: CVE-2011-2523
Severity: Critical

Access Gained: Root shell (uid=0(root) gid=0(root))
Metasploit Module: exploit/unix/ftp/vsftpd_234_backdoor

Description:
The target is running vsftpd 2.3.4, which contains a backdoor
that was inserted into the source code distribution. A username
ending in :) triggers a command shell listening on port 6200,
granting full root access without authentication.

Remediation:
Upgrade vsftpd immediately to a current release that does not
contain the backdoor. Remove the compromised version from the
system entirely.

ADDITIONAL VULNERABLE SERVICES OBSERVED
---------------------------------------
(Full scan output saved in: scan_results.txt)

The following additional services were identified during
reconnaissance and represent potential attack vectors:

- Port 22/tcp: SSH
- Port 23/tcp: Telnet (unencrypted remote access)
- Port 25/tcp: SMTP
- Port 80/tcp: HTTP
- Port 139/tcp: NetBIOS/Samba
- Port 445/tcp: Samba
- Port 3306/tcp: MySQL
- Port 5432/tcp: PostgreSQL
- Port 6667/tcp: UnrealIRCd

Each service should be investigated in follow-up testing
for known vulnerabilities and misconfigurations.

END OF REPORT
Take VM snapshots to preserve your lab

Snapshots capture the exact state of a VM at a point in time. If you break something during future practice, you can revert to this clean state instantly. This is the same workflow professional pentesters use to maintain their lab environments.

  • Switch to the VirtualBox Manager window on your Windows desktop.
  • Right-click on your Kali Linux VM in the left sidebar.
  • Select Snapshots.
  • Click Take to create a snapshot.
  • Give it a descriptive name like Clean lab - post first exploit and click OK.
  • Repeat the same process for the Metasploitable2 VM: right-click, select Snapshots, click Take, name it, and click OK.

You should now see a snapshot listed under each VM in the Snapshots view. Both VMs show their snapshot entry with the name you provided.

Why take snapshots now?

Metasploitable 2 is designed to be broken into repeatedly. After you exploit additional services, the system state may change. Having a snapshot lets you revert both machines to this known-good baseline and practice the same exploits again, or try new ones on a fresh target.

Don't see the Snapshots option?

  • Make sure you are right-clicking the VM name in the left panel of VirtualBox Manager, not inside the running VM window.
  • If the context menu does not show Snapshots, try clicking the list icon (three horizontal lines) next to the VM name and selecting Snapshots from the dropdown. Then click the Take button in the toolbar above.

How do I take a snapshot in VirtualBox 7?

Secret mission

Exploit the UnrealIRCd Backdoor

You have exploited one service. Can you repeat the methodology independently on a second vulnerable service? Use what you learned to find, exploit, and document the UnrealIRCd backdoor running on port 6667.

Clean Up Your Resources

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely. This project runs entirely locally, so there are no ongoing costs.

Resources you used:

  • Oracle VirtualBox 7.2.10 (installed on Windows).
  • Kali Linux 2026.1 VM (running in VirtualBox).
  • Metasploitable 2 VM (running in VirtualBox).
  • VirtualBox Host-Only Network (VirtualBox Host-Only Ethernet Adapter).
  • 7-Zip (installed on Windows).

Keep everything running

No action needed. Choose this if you are still actively practising in your lab or plan to explore more Metasploitable 2 services.

  • Your VMs will remain in VirtualBox and you can start them any time.
  • Your snapshots preserve a clean lab state you can revert to.
  • VirtualBox, 7-Zip, and the host-only network stay configured on your machine.

Pause - I'll come back to this later

Shut down both VMs to free up system memory while keeping all files intact for later.

  • In the Metasploitable 2 VM terminal, run:
sudo shutdown -h now
  • In your Kali Linux VM, click the power icon in the top-right corner and select Shut Down.
  • Confirm both VMs show as Powered Off in VirtualBox Manager.
  • Your snapshots, files, and network configuration remain intact for next time.

Delete - I don't want to use this again

Remove all project resources from your machine. This frees up disk space but cannot be undone.

Delete the VMs
  • In VirtualBox Manager, right-click Kali Linux.
  • Select Remove, then click Delete all files.
  • Right-click Metasploitable2 and repeat the same process: Remove > Delete all files.
Remove the host-only network
  • In VirtualBox, click File > Tools > Network Manager.
  • Select VirtualBox Host-Only Ethernet Adapter and click the Remove button (the red X icon).
Uninstall VirtualBox
  • Press the Windows key and type Add or remove programs. Press Enter.
  • Search for Oracle VirtualBox in the list.
  • Click it, then click Uninstall and follow the prompts.
Uninstall 7-Zip
  • In the same Add or remove programs window, search for 7-Zip.
  • Click it, then click Uninstall and follow the prompts.
Delete downloaded archives
  • Delete the following files from your Downloads folder (or wherever you saved them):
  • kali-linux-2026.1-virtualbox-amd64.7z and its extracted folder.
  • metasploitable-linux-2.0.0.zip and its extracted folder.
  • VirtualBox-7.2.10-174163-Win.exe.

Nice Work!

Nice Work!

You just built a fully isolated penetration testing lab and exploited real vulnerabilities using the same tools and methodology that professional pentesters use on actual engagements.

Here's what you accomplished:

  • Built a fully isolated penetration testing lab with Kali Linux and Metasploitable 2 on a host-only network that cannot reach the internet.
  • Performed network reconnaissance using Nmap to discover live hosts and enumerate services and their versions.
  • Exploited the vsftpd 2.3.4 backdoor (CVE-2011-2523) using Metasploit Framework to gain root access on the target system.
  • Secret Mission: Independently exploited the UnrealIRCd backdoor on port 6667 to demonstrate repeatable methodology and documented both findings in a structured penetration test report.

Ready to quiz yourself?