I am a graduate student working on a pen testing lab that I am having the hardest time understanding. I am given a link to a Kali VM and told the following as a preamble to the lab.

You were recently hired for a Penetration Tester position. You are responsible for penetration testing information systems located in the Local Area Network (LAN) and the Demilitarized Zone (DMZ). A new web server was recently installed in the DMZ and you are tasked with attempting to compromise this server as a simulated external (WAN/Internet) threat. For the purposes of this exercise you have access to a Kali Linux virtual machine. The IP address of the external router is The IP address of the corporate web server resides somewhere on the network.

There are 8 steps

  1. Use the Kali Linux virtual machine to enumerate the network and discover any potential misconfigurations and/or vulnerable information systems.

  2. Based on your vulnerability discovery(ies), exploit the system(s) using the Kali Linux virtual machine.

  3. Use a method available to you on the Kali Linux virtual machine to recover any credentials from the compromised system.

  4. Use your newly acquired network access to create a pass-through capability (PIVOT) onto other networks of opportunity.

  5. Use the built-in functions of Metasploit on the Kali Linux virtual machine to conduct a portscan on the LAN network. Discover any potential misconfigurations and/or vulnerable information systems.

  6. Use the previously stolen credentials to access the domain controller.

  7. Leverage xfreerdp on the Kali Linux virtual machine to RDP onto the Windows 8 VM.

  8. Deface the webpage hosted on the web server by modifying the webpage index.html file.

I understand nmap is used for the first step but I have no idea what the second step entails. NMAP shows TCP 80, 443, and 445 open on the external router. TCP 22, 53, 80, 443, and 3000 are open on the web server. Does anyone have any idea what tools would work best for the second and third steps?

I tried using OWASP Zap on the IPs I found. I also tried to use exploit/unix/ftp/vsftpd_234_backdoor found under msf with no success. I tried the heartbleed vulnerability and also could not get anything.

I don't necessarily need exact answers but anything in the ballpark would be amazing.

  • have you poked around at all of the services? Tried a list of common passwords for ssh on 22 (use hydra), can you do a directory traversal on 80 or 443, what's running on 3000? Nessus vulnerability scan?
    – MikeSchem
    Commented Nov 10, 2022 at 0:53
  • Kali has many, many tools that can do vulnerability testing. Why limit yourself to just nmap?
    – schroeder
    Commented Nov 10, 2022 at 1:06
  • The problem with the question is that we're guessing based solely on the instructions and not your environment or feedback. So, there is limited help we can provide. Your class should have provided the required knowledge to get you through the steps.
    – schroeder
    Commented Nov 10, 2022 at 1:08
  • You can import the nmap scan results to metasploit and go from there
    – user284677
    Commented Nov 10, 2022 at 5:53


Browse other questions tagged .