Metasploitable Service Enumeration Lab 2026 — Full Attack Surface Mapping | Hacking Lab 33

This lab guides learners through Metasploitable 2 service enumeration using Nmap NSE scripts to transform a port list into a prioritized attack surface map. Building on Lab 2's discovery of 23 open ports, Lab 3 identifies vulnerable service versions, maps them to known CVEs and Metasploit modules, enumerates web applications, and creates an attack priority matrix that organizes targets by exploitation likelihood and impact. This structured enumeration output becomes the reference document for all subsequent exploitation labs in the series.

• NSE scripts reveal service depth beyond port scanningNmap's Scripting Engine runs targeted, service-specific checks that basic version detection misses. For example, ftp-vsftpd-backdoor specifically tests whether port 6200 opens in response to the ":)" username trigger, confirming not just that vsftpd 2.3.4 is present but that the CVE-2011-2523 backdoor is actually functional. Similarly, smb-enum-shares and smb-os-discovery extract available shares and security mode from SMB services, and mysql-empty-password tests for unauthenticated database root access — data essential for building an accurate attack plan.
• CVE mapping transforms versions into exploitation pathsThe article demonstrates building a service-to-CVE mapping table where each vulnerable version links directly to a known vulnerability identifier and corresponding Metasploit module path. For instance, vsftpd 2.3.4 maps to CVE-2011-2523 and the module exploit/unix/ftp/vsftpd_234_backdoor; Samba 3.0.20 maps to CVE-2007-2447 and exploit/multi/samba/usermap_script. This mapping eliminates guesswork during exploitation and enables prioritization based on whether vulnerabilities are actively exploitable with available tools.
• Web application enumeration discovers multiple attack surfacesHTTP enumeration on port 80 reveals at least seven distinct vulnerable applications hosted on a single port: DVWA (practicing OWASP Top 10), Mutillidae (40+ vulnerabilities), phpMyAdmin (MySQL admin access with empty root password), TikiWiki (CVE-2012-0911 RCE), TWiki (CVE-2005-2877 RCE), WebDAV, and the default Apache page. The article emphasizes that phpMyAdmin with unauthenticated root access enables full database compromise plus potential remote code execution through MySQL's INTO OUTFILE file write capability, creating a complete MySQL-to-webshell-to-RCE exploitation chain.
• Attack priority matrix organizes findings by impactThe matrix ranks all discovered services by priority tier (CRITICAL, HIGH, MEDIUM), listing port, service, version, CVE, exploitation method, and corresponding Metasploit module. The four CRITICAL targets on Metasploitable (vsftpd backdoor, Samba usermap, bindshell 1524, UnrealIRCd backdoor) are distinguished by requiring no credentials, no brute force, and no social engineering — the vulnerabilities enable direct shell access in under 60 seconds each. This organization transforms raw enumeration data into an actionable exploitation sequence.
• Backdoor vulnerabilities differ from traditional exploitationThe vsftpd 2.3.4 backdoor (CVE-2011-2523) represents a specific threat model: a compromised open-source distribution containing intentionally inserted malicious code rather than a coding error. Sending a username containing ":)" triggers the backdoor to open a root command shell on port 6200. The NSE script ftp-vsftpd-backdoor verifies port 6200 responds, confirming the backdoor is present and active — a supply chain integrity failure documented as an educational example within Metasploitable.
• Enumeration phase output drives all downstream exploitationThe attack priority matrix built in Lab 3 serves as the reference document for Labs 4 through 10. Each exploitation lab targets a service identified and prioritized during enumeration. Lab 4 begins with vsftpd because it appears as CRITICAL priority, offers clean demonstration of the Metasploit module workflow, and requires only a single exploit command to achieve root shell — the enumeration phase's structured output determines the optimal teaching and testing sequence.
• Exercise structure validates enumeration completenessThe three exercises progress from running NSE scripts (Exercise 1: 20 minutes testing FTP, SMB, HTTP, MySQL, vulnerability scan), to mapping web applications (Exercise 2: 15 minutes enumerating port 80 paths and testing phpMyAdmin access), to consolidating findings into the attack matrix (Exercise 3: 10 minutes compiling and sorting by priority). A well-executed enumeration should identify at least 4 CRITICAL and 6+ HIGH priority targets; fewer results indicate incomplete scanning of services.

Bottom line: Service enumeration using targeted NSE scripts transforms a list of open ports into a prioritized attack surface map organized by exploitation feasibility and impact — this structured output becomes the operational reference for every subsequent exploitation attempt, eliminating guesswork and ensuring efficient targeting of the highest-value vulnerabilities first. Building and documenting this attack matrix (port, service, version, CVE, priority, exploit method, Metasploit module) is the core de