Lab 01: Identifying and Exploiting Vulnerabilities

Lab Overview

This lab walked through the vulnerability management lifecycle in an isolated training environment: identifying a target system’s OS version, researching a known CVE, using an exploitation framework against a deliberately vulnerable lab machine, and reviewing the security lapses that made the exploit possible.

What Was Covered

Guided Exercises

• Identified the OS version and build of the TargetWindows01 lab system via the About Windows dialog.

• Researched CVE-2017-0143 (SMBv1 remote code execution) on the NVD, including its CVSS Base Score.

• Located the corresponding MS17-010 EternalRomance/EternalSynergy/EternalChampion module in the Rapid7 Vulnerability and Exploit Database.

• Used the Metasploit Framework in the Kali lab VM to exploit the vulnerability and obtain a SYSTEM-level session.

• Created a proof-of-access artifact (yourname_was_here folder) on the target desktop.

• Retrieved sensitive files left in cleartext on the target, including a password list and a stored payment-card note.

Challenge Exercises

• Used anonymous FTP access to pull an additional sensitive file from the internal network.

• Answered reflection questions on root causes.

Root Cause Analysis

Storing personal information in clear text files

Plain-text files are fast and require no password or special setup, making them a convenient — but insecure — place to jot down sensitive information.

Using an FTP service on the internal network

Legacy services often persist under an “if it ain’t broke, don’t fix it” mentality; resistance to change makes organizations slow to retire outdated protocols.

Anonymous login enabled on the FTP service

Often a leftover default configuration or a convenience trade-off. Security and convenience are frequently in tension, and gaps like this can go unnoticed — especially when the person responsible for security lacks a strong security background.

Key Takeaway

The exercise illustrates how an unpatched, decade-old SMB vulnerability combined with poor data-handling practices (cleartext credentials, legacy FTP, anonymous login) can lead to a full compromise of a system — reinforcing why patch management and basic data-hygiene controls matter.

Original Lab Report

The full, unedited lab report is attached below for reference.

Download the original lab report (PDF)

Page 1 — Guided Exercises, Parts 1 & 2

Page 2 — Guided Exercises, Parts 3 & 4

Page 3 — Guided Exercises, Part 4 & Challenge Exercises, Part 1

Page 4 — Challenge Exercises, Parts 1 & 2