Exploiting an Exposed Backdoor: From Shell Access to Full Credential Recovery on Metasploitable 2

Lab Setup

Platform: Oracle VirtualBox

Kali Linux— Attacker

Metasploitable 2 — Victim

Tools Used:

·Nmap

· Nessus

· John the Ripper

· Netcat

Walkthrough

This walkthrough demonstrates the compromise of a Metasploitable 2 machine from initial enumeration to obtaining SSH access through recovered credentials. Metasploitable 2 is an intentionally vulnerable Linux environment created for security practice and contains several known weaknesses, including an exposed bindshell running on port 1524.

The attack begins with network reconnaissance to identify the target and enumerate open ports and services. During enumeration, port 1524 is discovered running a backdoor bindshell that provides direct root shell access without any authentication.

After gaining access, post-exploitation activities are performed by extracting password hashes from /etc/shadow and cracking them offline using John the Ripper. The recovered credentials are then used to authenticate through SSH and establish standard remote access to the system.

Each stage is documented in the order it was performed, using the original commands, outputs, and observations collected during the compromise.

Step 1 : Discover the Target’s IP Address

Start both virtual machines. On the Metasploitable 2 machine, run

ip addr

After entering this command you might get a interface like this

This displays all active network interfaces and their assigned IP addresses. Note down the inet value that’s your target IP for everything that follows, here you can we get the ip as 192.168.56.115

Step 2: Verify the Target is Online

Use the command ping<ip> to check whether the target is online or not. From the response you will get info about the size of packets, sequence, how fast it replied, and TTL (Time To Live).

Step 3:Scan for Open Ports and Services

Either you can use Nessus and run a Basic Network Discovery Scan which will take 10 to 15 minutes, by setting the target as the IP you received from your VM.

Or the easiest way is to use an Nmap scan to find the open ports on the target is through nmap . Run the following command

nmap -sV <target ip>

The -sV here stands for service detection it will tell you all the open ports and the services running through them.

Step 4: Identify the Target Port

After the Nmap scan you will see a list of open ports available. Now there would be various open ports that you could find, as Metasploitable 2 is already very vulnerable but here our focus would be on port:

1524/tcp   open   bindshell   Metasploitable root shell

This port is basically a backdoor left open. Port 1524 gives you root shell directly.

Step 5 : Connect to the Backdoor

Now on Kali run the command nc <ip> <port> .

nc stands for Netcat. It's like a raw telephone it connects to any port and lets you talk directly to whatever service is running there.

After this command you will see on the interface something like root@metasploitable:/# that means you have gained access to the system. To confirm, type whoami and you will get the hostname as metasploitable, which means you are in.

Step 6 : Explore the System

As you are already in, type ls to check all the files in the system.

Also run cat /etc/passwd this will show every user account. On every Linux machine this file stores all user accounts. In old systems it stored passwords too, now it stores user information.

In my case I got the following, which would be similar to yours:

here we see

System accounts (not real people):

root        → superuser, controls everything
daemon      → background services
www-data    → runs the web server
mysql       → runs the database
postgres    → runs PostgreSQL

Real user accounts :

msfadmin    → main admin user
user        → regular user
service     → service account

Step 7: Extract the Password Hashes

You noticed field 2 is just x for everyone. That means passwords are stored in a different file. So to access it we use the command:

cat /etc/shadow

This file has the actual hashed passwords. In real attacks you extract these and crack them offline. You might get something like:

msfadmin:$1$Kp92LmQx$Vh7nYtR4ePq8DsUwXzA91/:14684:0:99999:7:::

root:[HASH REDACTED]
msfadmin:[HASH REDACTED]
user:[HASH REDACTED]
service:[HASH REDACTED]

One thing to note accounts with $1$ MD5 are weak.

Step 8 : Crack the Hash with John the Ripper

Let’s crack them using John the Ripper. In Kali, first save the hash to a file by running the command:

echo ‘msfadmin:$1$Kp92LmQx$Vh7nYtR4ePq8DsUwXzA91/:14684:0:99999:7:::’ >

Get Pranav Verma’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

hash.txt

Start John by running:

john hash.txt

One thing to remember saving the hash file and running John should be done in a new terminal in Kali itself.

Step 9: Credentials Recovered

You will get something like this:

┌──(ghost㉿kali)-[~]

└─$ john hash.txt

Warning: detected hash type “md5crypt”, but the string is also recognized as “md5crypt-long”

Use the “ — format=md5crypt-long” option to force loading these as that type instead

Using default input encoding: UTF-8

Loaded 1 password hash (md5crypt, crypt(3) $1$ (and variants) [MD5 256/256 AVX2 8x3])

Will run 8 OpenMP threads

Proceeding with single, rules:Single

Press ‘q’ or Ctrl-C to abort, almost any other key for status

redteam (msfadmin)

1g 0:00:00:00 DONE 1/3 (2026–05–24 18:11) 14.32g/s 2781p/s 2781c/s 2781C/s redteam2026..security01

Use the “ — show” option to display all of the cracked passwords reliably

From here you can comprehend that:

Password = redteam
Username = msfadmin

Step 10: Login via SSH

Now you have real credentials. Try logging in properly via SSH:

We can do so by typing the command ssh msfadmin@<ip>

if it asks for passwd type the password like in my case it was redteam.

As you run it you might get an error like:

Unable to negotiate with 192.168.56.115 port 22: no matching host key type found. Their offer: ssh-rsa,ssh-dss

Which mean this is a compatibility issue , as Metasploitable uses very old SSH key types that modern Kali rejects by default. more like ,

Kali says “I don’t accept ssh-rsa or ssh-dss” these are old weak key types modern SSH disabled them for securiy

The fix for it is Force Kali To Accept Old Key Types we can do so by the following command

ssh -oHostKeyAlgorithms=+ssh-rsa msfadmin@<ip>

here -oHostKeyAlgorithms=+ssh-rsa means you are telling kali I know it’s old, accept it anyway

Step 11: You’re In

After running the above command you will get:

┌──(ghost㉿kali)-[~]
└─$ ssh -oHostKeyAlgorithms=+ssh-rsa msfadmin@192.168.56.115

The authenticity of host ‘192.168.56.115 (192.168.56.115)’ can’t be established.
RSA key fingerprint is: SHA256:KJm4NcLqT7WpYvH2QxR8uEdPzM1AsBnY6LtR5wXe9Po
This key is not known by any other names.

Are you sure you want to continue connecting (yes/no/[fingerprint])? y
Please type ‘yes’, ‘no’ or the fingerprint: yes

Warning: Permanently added ‘192.168.56.115’ (RSA) to the list of known hosts.

** WARNING: connection is not using a post-quantum key exchange algorithm.
** This session may be vulnerable to “store now, decrypt later” attacks.
** The server may need to be upgraded. See https://openssh.com/pq.html

msfadmin@192.168.56.115’s password:

Linux labnode 2.6.24–16-server #1 SMP Tue Apr 15 14:21:00 UTC 2008 i686

The programs included with the Ubuntu system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
applicable law.

To access official Ubuntu documentation, please visit:
http://help.ubuntu.com/

No mail.

Last login: Sun May 24 08:13:45 2026

You’re in! Via legitimate SSH login using cracked credentials.

Also notice the difference:

Before via backdoor: root@metasploitable:/# → root user, full access

Now via

SSH: msfadmin@metasploitable:~$ → msfadmin user, limited access

So now try to get root from here. You’re msfadmin but want root. Try running sudo su and you will get root access.

Now you might wonder

Why use SSH when we already have root access through Netcat?

At first, it might seem unnecessary. We already gained root access through the Netcat backdoor, so why switch to SSH?

Think of the Netcat backdoor as climbing into a house through a broken window. You’re inside, but the access is unstable. If someone notices and fixes that window, your entry point disappears.

SSH with cracked credentials is different. It’s like having the front door key. You enter through the normal path, the same way a legitimate user would. The login is authenticated, the connection is encrypted, and access becomes more reliable.

This is why credential harvesting often matters more than the initial exploit. The backdoor gave us entry. The credentials gave us persistence. If the backdoor is removed, access through SSH can still remain.