Network Services - KittySploit Docs

Usage context

Context. Fictional client ``Client Infrastructure''. Authorized scope: 127.0.0.1 (Metasploitable2 container mapped locally). Engagement: map exposed services, non-destructive enumeration, identification of potential attack vectors. Forbidden in this test environment: denial of service, data modification, mass bruteforce outside documented

Why network services change the game

Unlike web application testing, network recon queries protocols --- SSH, FTP, SMB, MySQL --- each with its own enumeration surface, default credentials and dedicated KittySploit modules. Metasploitable2 is intentionally overconfigured: multiple services listen, old versions are present, anonymous SMB shares or weak accounts may exist.

This page documents how to:

discover hosts and ports (network_discover, portscan);
qualify each service with the right module (search → use → run);
document without over-collecting;
prepare post-exploitation if a session is obtained.

Lab Profile Preparation

Startup and verification

lab start metasploitable-recon
lab walkthrough metasploitable-recon
lab score metasploitable-recon

The metasploitable-recon lab profile starts the Metasploitable2 Docker image. Ports are remapped on the host machine to avoid conflicts:

Service	Host port	Note
HTTP	`80`	Vulnerable pages (integrated Damn Vulnerable Web App)
FTP	`21`	Anonymous access possible depending on configuration
MySQL	`3306`	Enumeration without authentication sometimes possible
SMB	`445`, `139`	Windows/Samba shares

Wait until lab score validates at least the TCP objectives (SSH, HTTP, FTP, portscan). If a port refuses connection, rerun lab reset metasploitable-recon then lab start metasploitable-recon.

Workspace and scope

workspace create metasploitable-recon-workspace
workspace use metasploitable-recon-workspace
scope add 127.0.0.1
host add 127.0.0.1 --note "Metasploitable2 Docker" --os linux

Golden rule: every scan command must target 127.0.0.1 with the mapped port (host), not the container's internal IP (172.x.x.x) unless you pivot from a session.

Network discovery with `network_discover`

network_discover is a console command (not a module) that combines several discovery techniques: ARP, ICMP, TCP, UDP, NetBIOS, mDNS. It is useful before a fine portscan to confirm that a host responds.

Interpreting results

Output displays IP, MAC address (if ARP), YES vendor, hostname, detected services and method. In Docker test environment, ARP is often empty; ping and TCP on common ports suffice.

Method PING --- host responds to ICMP; good availability indicator.
Method TCP --- common open ports detected (21, 22, 80, 445…).
Method NetBIOS --- Windows/Samba name; valuable before SMB enumeration.

After discovery, consolidate in the workspace:

host services 127.0.0.1

Note: the `tor` command

KittySploit exposes tor to route framework traffic through a Tor SOCKS proxy (local, port 9050 by default). It is not required for local Metasploitable, but it is a useful building block for OSINT or testing from an isolated environment:

tor check
tor status
tor enable --host 127.0.0.1 --socks-port 9050
tor disable

Warning: enabling Tor modifies the framework's global network behavior. In the metasploitable-recon isolated test environment, keep Tor disabled to avoid timeouts on 127.0.0.1. In a real engagement, its use must appear in the scope and be legally validated (anonymization requires explicit authorization).

TCP portscan --- `auxiliary/scanner/portscan/tcp`

The auxiliary/scanner/portscan/tcp module is the reference parallel TCP scanner. The metasploitable-recon lab profile uses it to validate the portscan objective.

Configuration and execution

search portscan tcp
use auxiliary/scanner/portscan/tcp
show options
set rhosts 127.0.0.1
set ports 21,22,23,25,80,139,445,3306,2222,8080
set threads 20
set timeout 1.0
run

Important options:

rhosts --- IP, CIDR or comma-separated list;
ports --- range (1-1024), list (22,80,443) or mixed;
threads --- parallelism (max 256);
show_closed --- also display filtered/closed ports (noisy).

MITRE ATT&CK mapping

This module is mapped to technique T1046 (Network Service Discovery):

attack show auxiliary/scanner/portscan/tcp
attack catalog --tactic TA0007

Note prerequisites and artifacts in __info__: horizontal portscanning often triggers IDS alerts and leaves traces in firewall logs.

From raw scan to service table

After run, build a summary table (notes or report):

Port	State	Probable service	Next module
80	open	HTTP	`scanner -u http://127.0.0.1`
139/445	open	SMB	`scanner/smb/null_session`
2222	open	SSH (remapped)	manual validation + `search ssh`
3306	open	MySQL	`scanner/mysql/mysql_info_detect`

SSH --- port `2222`

Metasploitable exposes OpenSSH on port 2222 on the host side (22 internal). KittySploit does not yet offer a dedicated SSH scanner in scanner/ssh/; SSH recon combines portscan, banner and access validation.

Module search

search ssh --type exploits --platform linux
search ssh --type post --platform linux
search --tag ssh --limit 20

Modules in exploits/linux/ssh/ mainly target known private keys or product backdoors --- rarely relevant on generic Metasploitable, but useful when auditing network equipment.

Workspace documentation

vuln add --host 127.0.0.1 --title "SSH exposed port 2222" \
  --severity info --note "OpenSSH, msfadmin account known in isolated test environment"

Do not classify ``HIGH'' solely because SSH is open --- document the impact (weak keys, password auth, EOL version).

FTP --- `auxiliary/scanner/ftp/ftp_enum`

The auxiliary/scanner/ftp/ftp_enum module operates in direct mode: it connects via rhost/rport without a prior session.

Execution

search ftp enum
use auxiliary/scanner/ftp/ftp_enum
show options
set rhost 127.0.0.1
set rport 21
set ftp_user anonymous
set ftp_password anonymous@example.com
set max_depth 2
set show_hidden true
run

The module enumerates:

FTP server banner and version;
root directory and subdirectories (depth max_depth);
visible and hidden files (if show_hidden);
write permissions (upload test if supported).

Professional interpretation

Anonymous access --- information surface; config files or backups?
Anonymous write --- high severity (malware drop, defacement).
Old version --- cross-reference with CVE (no automatic exploit outside engagement scope).

vuln add --host 127.0.0.1 --title "FTP enumeration" --severity medium \
  --note "Module auxiliary/scanner/ftp/ftp_enum, root listing"

SMB --- `scanner/smb/` scanners

Samba on Metasploitable may accept null sessions, enable SMBv1 or not require signing --- all signals for a report.

Search and modules

search smb --type scanner
use scanner/smb/null_session
set rhost 127.0.0.1
run

use scanner/smb/smbv1_detect
set rhost 127.0.0.1
run

use scanner/smb/signing_not_required
set rhost 127.0.0.1
run

MySQL --- `scanner/mysql/mysql_info_detect`

Enumeration without credentials

search mysql info
use scanner/mysql/mysql_info_detect
show options
set rhost 127.0.0.1
set port 3306
run

The module performs a MySQL handshake and extracts:

server version;
protocol version;
TLS support;
transport (TCP).

This is passive/light active enumeration --- one connection, no bruteforce.

Complementary HTTP

Metasploitable also serves as a web target on port 80:

scanner -u http://127.0.0.1 --threads 8
use auxiliary/scanner/http/login_page_detector
set rhost 127.0.0.1
set rport 80
run

This aspect is covered in depth in the web chapters; here, the goal is to link network mapping (port 80 open) to application scanning without duplicating all of the relevant documentation.

Integrated workflow --- from discovery to plan

# 1. Discovery
network_discover -r 127.0.0.1

# 2. Structured portscan
use auxiliary/scanner/portscan/tcp
set rhosts 127.0.0.1
set ports 21,80,139,445,2222,3306
set threads 20
run

# 3. Protocol scans (excerpts)
use auxiliary/scanner/ftp/ftp_enum
set rhost 127.0.0.1
run

use scanner/smb/null_session
set rhost 127.0.0.1
run

use scanner/mysql/mysql_info_detect
set rhost 127.0.0.1
run

# 4. Consolidation
host services 127.0.0.1
vuln list
campaign --preview

Common mistakes

Scanning port 22 instead of 2222 on the Docker host.
Forgetting workspace use --- findings lost or in wrong context.
Running all SMB modules without reading info --- unnecessary IDS noise.
Confusing scanner/ (Scanner class) and auxiliary/scanner/ (Auxiliary class) --- both work with use, but options may differ.
Enabling tor locally and wondering about failures on 127.0.0.1.
Maximum severity on every banner --- without demonstrated impact.

`search` strategy by protocol

Protocol	`search` query	Starting module
FTP	`search ftp --type auxiliary`	`auxiliary/scanner/ftp/ftp_enum`
SMB	`search smb --type scanner`	`scanner/smb/null_session`
MySQL	`search mysql --type scanner`	`scanner/mysql/mysql_info_detect`
SSH	`search ssh --type exploits`	portscan + manual validation
HTTP	`search --protocol http --type scanner`	`scanner -u ...`