This advanced, challenge-only project reviews an internal compromise workflow from exploit planning through post-exploitation and Linux privilege escalation. You will prepare a Metasploit resource script from scan evidence, investigate a simulated SSH foothold, build a local pivot, and prove root access on an isolated training account.
The course rewards disciplined evidence handling rather than disconnected commands. Each challenge produces focused artifacts—module choices, recovered credentials, route intelligence, tunnel details, and root proof—that support the next operator decision.
What You Will Learn
- Scan a local service to Nmap XML and import the evidence into Metasploit
- Match an Apache 2.4.49 fingerprint to a Metasploit module and compatible reverse-shell payload
- Build a reusable Metasploit resource script without launching the exploit
- Use an SSH foothold to inspect a stable process and recover a simulated service credential
- Enumerate an internal route and prepare a concise next-hop handoff
- Establish an SSH local port forward through an edge account to an internal service
- Inspect tunneled sudo rights and identify
sudo findas the escalation vector - Execute the lab-only sudo misconfiguration and document a root compromise chain
Who This Course Is For
This course is for experienced learners who have already practiced Metasploit, SSH, post-exploitation enumeration, pivoting, and Linux privilege escalation. It suits aspiring penetration testers and red-team operators who want to integrate those skills under challenge conditions.
Prerequisites: Strong Linux shell skills; familiarity with Nmap XML, Metasploit modules and payloads, SSH keys and local forwarding, remote enumeration, sudo -l, and Linux privilege-escalation concepts.
Learning environment: An Ubuntu 22.04 LabEx VM with Metasploit and PostgreSQL, local simulated HTTP and SSH targets, provided training SSH keys, an artificial internal route, and deliberately vulnerable sudo permissions.
Frequently Asked Questions
Is this a guided course for beginners?
No. It is an advanced project made of three challenge-based assessments. The required artifacts are specified, but command construction, evidence extraction, tunneling, and troubleshooting are left to you.
Do I actually run the Metasploit exploit?
No. In the initial-access challenge you import Nmap evidence, select apache_normalize_path_rce and a compatible payload, then build an initial_access.rc resource script. You do not launch the exploit or receive a Metasploit session.
Will I access real internal networks or credentials?
No. The HTTP and SSH services run on loopback addresses, the 10.42.0.0/24 route is simulated locally, and the SSH keys and service credentials are training data.
Do I obtain root access anywhere?
Yes, but only inside the disposable lab. You tunnel to a local analyst account, identify its passwordless sudo find permission, execute a root-level identity check, and record the result in a short compromise-chain report.
