20.8 Red vs Blue, Project and Real Incidents

# OWN host-only only – Kali 192.168.56.10 → Metasploitable 192.168.56.20
mkdir -p ~/labs/sahyadri-vuln
# Pre-fix snapshot of findings (lab only)
sudo nmap -sV --script vuln -T2 192.168.56.20 -oA ~/labs/sahyadri-vuln/pre
searchsploit vsftpd 2.3.4
searchsploit samba 3.0.20
# Optional if Greenbone/GVM is installed on Kali:
# sudo gvm-start   # then Full-and-fast task against 192.168.56.20; export PDF
# On a Linux helper YOU own (optional .50) – defender moves after triage:
# sudo service vsftpd stop
# sudo yum remove vsftpd          # Amazon Linux / CentOS style helper
# sudo service iptables status    # or firewalld – allow only from 192.168.56.10
# Re-scan same commands → Critical/High should drop

Lab

Metasploitable (192.168.56.20) var sudo nmap -sV --script vuln -T2 -oA ~/labs/20-pre chalu kara. searchsploit ne vsftpd 2.3.4 aani kamit kami 3 itar services sathi CVE note kara. Mag Greenbone asel tar ek Full-and-fast task (lab only) – Critical/High count liha. False positive sathi ek finding package version ne confirm kara. Output save – pudhcha Project madhe before/after compare karaycha aahe.

Project: Build it, hack it, fix it

Build: For fictional Sahyadri Traders (Pune) / Raja-Rani Traders warehouse IT, treat Metasploitable 192.168.56.20 as the deliberately weak assessment target (host-only). Document the weak surface before you start:

1. Old services left listening (vsftpd 2.3.4 on 21, other ancient banners from Chapter 19)
2. No triage habit – raw scanner noise accepted as "truth"
3. Optional: leave an unused helper service on .50 that you installed with sudo yum on purpose

Snapshot pre-vuln-assessment. Ethics card from Chapter 18 apply kara – no bridged weak VMs.

Hack (lab assessment only – not a weapon recipe): From Kali 192.168.56.10:

• sudo nmap -sV --script vuln -T2 192.168.56.20 -oA ~/labs/sahyadri-vuln/pre
• searchsploit vsftpd 2.3.4 (and other banners); note CVE IDs from NVD / Exploit-DB
• Optional: Greenbone Full-and-fast against .20 only; export severity counts
• Nikto against http://192.168.56.20 for web-facing noise (headers, indexing)

Prove a wide Critical/High list. Never scan institute Wi-Fi, classmates, or public IPs. Do not run exploit payloads – finding + documenting is enough here.

Fix:

• Stop/remove unused daemons (sudo service vsftpd stop; on Amazon Linux helpers sudo yum remove unused servers)
• Firewall allow-list: needed ports only from Kali 192.168.56.10
• Prefer SFTP/SSH over ancient FTP where the lab OS allows; patch what you can on helpers with sudo yum update
• Banner hardening on any web helper you own (ServerTokens Prod / server_tokens off;)
• Snapshot post-vuln-fix

Re-verify: Same Nmap vuln scripts / Greenbone / Nikto – Critical/High drop; vsftpd finding gone or port closed/filtered. Write a 1-page Purple report for owner Raja: executive summary + top 5 findings (ID, severity, evidence, fix, re-scan proof). Study buddy Shraddha / Zoya peer-review false-positive calls. No real org, no internet targets.