Scanner: Nessus Essentials (Tenable) | Target: Metasploitable 2 | Network: VirtualBox Host-Only (LAB_INTERNAL)
This project demonstrates a complete vulnerability assessment workflow performed in an isolated home lab environment. Using Nessus Essentials, I scanned a Metasploitable 2 VM, identified vulnerabilities classified by CVSS severity, applied targeted remediations, and re-scanned to verify fixes, simulating a real-world security operations cycle.
| Component | Details |
|---|---|
| Hypervisor | Oracle VirtualBox |
| Network | Internal Network (LAB_INTERNAL) - isolated from internet |
| Scanner VM | Kali Linux - 192.168.56.10 |
| Target VM | Metasploitable 2 - 192.168.56.101 |
| Scanner Tool | Nessus Essentials v10.x (Tenable) |
| Scan Policy | Basic Network Scan - CVSS v3.0 |
Three scans were performed: an initial baseline scan, a post-remediation scan, and a final verification scan.
| Severity | Scan 1 (Baseline) | Scan 2 (Post-Fix) | Scan 3 (Final) | Change |
|---|---|---|---|---|
| Critical | 9 | 4 | 3 | -6 |
| High | 6 | 4 | 1 | -5 |
| Medium | 23 | 22 | 22 | -1 |
| Low | 9 | 9 | 9 | 0 |
| Total | 69 | 62 | 61 | -8 |
| Severity | Plugin | Finding | CVSS |
|---|---|---|---|
| Critical | 61708 | VNC Server default password - Nessus logged in with "password" | 10.0 |
| Critical | 201352 | Ubuntu 8.04 End of Life - no security patches available | 10.0 |
| Critical | 134862 | Apache Tomcat AJP Ghostcat - remote file inclusion via port 8009 | 9.8 |
| Critical | 20007 | SSL v2 and v3 enabled - protocol-level vulnerability | 9.8 |
| Critical | 51988 | Bind Shell Backdoor - unauthenticated shell on port 1524 | 9.8 |
| Critical | 32314 | Debian OpenSSH/OpenSSL weak RNG - predictable keys | 9.8 |
| High | 90509 | Samba Badlock - MITM authentication downgrade | 7.5 |
| High | 10205 | rlogin service - trust-based auth bypass | 7.5 |
| High | 42256 | NFS shares world readable - full filesystem exposed | 7.5 |
| Medium | 42263 | Unencrypted Telnet - cleartext credential transmission | 6.5 |
- Bind Shell Backdoor (port 1524): Killed process via
sudo kill $(sudo lsof -t -i:1524); disabled ingreslock in/etc/inetd.conf - VNC default password: Changed via
vncpasswd; restarted VNC service - Apache Tomcat Ghostcat: Commented out AJP connector in
/etc/tomcat5.5/server.xml; restarted Tomcat - SSL v2/v3: Uncommented
SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1in Apache ssl.conf
- Telnet: Commented out telnet line in
/etc/inetd.conf; restarted openbsd-inetd - rlogin / rexec / rsh: Commented out shell, login, exec lines in
/etc/inetd.conf - NFS world readable: Restricted
/etc/exportsto127.0.0.1withroot_squash; restarted NFS - SMB signing: Added
server signing = mandatoryto/etc/samba/smb.conf
- Ubuntu 8.04 EOL: Requires full OS migration to Ubuntu 22.04 LTS - escalated
- SSL Multiple Issues: Requires valid CA-signed certificate - escalated
- Samba Badlock: Requires Samba version upgrade - flagged for change management
- Vulnerability scanning using Nessus Essentials in an isolated VirtualBox lab
- CVSS v3 severity classification and risk-based remediation prioritization
- CVE identification across web servers, network services, cryptography, and OS
- Applied remediations using Bash on Linux (inetd, Apache, Tomcat, NFS, Samba)
- Re-scanning to verify fixes - reduced total findings from 69 to 61 across 3 scans
- API-based data extraction from Nessus using curl and Python for CSV generation
- Network lab setup: VirtualBox internal networking, static IP assignment, multi-VM topology
- Documentation of findings that require escalation vs those remediable at analyst level
| Tool | Purpose |
|---|---|
| Nessus Essentials (Tenable) | Vulnerability scanning and CVE identification |
| Oracle VirtualBox | Hypervisor for isolated lab environment |
| Kali Linux | Scanner host |
| Metasploitable 2 | Intentionally vulnerable target VM |
| Python 3 | Nessus API data extraction and CSV generation |
| curl | Nessus REST API interaction |