Skip to content
All work

Penetration Testing & Vulnerability Assessment

Windows Security Lab

Conducted an authorised penetration test against an isolated Windows environment, progressing from reconnaissance and enumeration through vulnerability validation, controlled exploitation and post-exploitation analysis.

Kali LinuxNmapMetasploitMeterpreterVirtualBox

Overview

Objective
Assess the security posture of a deliberately vulnerable Windows machine in an authorised, isolated lab.
Environment
Kali Linux · Windows 7 · VirtualBox internal network
My role
Security tester
Scope
Single target host, fully isolated from the internet and production networks

Methodology

  1. 01

    Reconnaissance

    Mapped the isolated lab network to identify live hosts and confirm the target was in scope before touching it.

  2. 02

    Service enumeration

    Used Nmap to fingerprint open ports, running services and operating-system details on the Windows target.

  3. 03

    Vulnerability assessment

    Matched discovered services against known vulnerabilities and validated candidates with Metasploit auxiliary scanners before attempting anything intrusive.

  4. 04

    Controlled exploitation

    Exploited a validated vulnerability in a controlled way to gain access, keeping all activity inside the isolated network.

  5. 05

    Post-exploitation

    Used a Meterpreter session to understand the level of access gained and what an attacker could reach from that foothold.

  6. 06

    Remediation

    Documented each finding and mapped it to practical fixes a system owner could act on.

Evidence

Reconnaissance — confirming the target's IP on the isolated lab network (ipconfig on the Windows host, ip a on Kali).
Reconnaissance — confirming the target's IP on the isolated lab network (ipconfig on the Windows host, ip a on Kali).
Service enumeration — an Nmap version scan revealing open SMB and RPC ports on the Windows target.
Service enumeration — an Nmap version scan revealing open SMB and RPC ports on the Windows target.
OS fingerprinting — Nmap OS detection and SMB scripts identifying Windows 7 SP1 and its SMB security configuration.
OS fingerprinting — Nmap OS detection and SMB scripts identifying Windows 7 SP1 and its SMB security configuration.
Vulnerability validation — Metasploit's MS17-010 module confirming the host is likely vulnerable.
Vulnerability validation — Metasploit's MS17-010 module confirming the host is likely vulnerable.
Post-exploitation — a Meterpreter session running with NT AUTHORITY\SYSTEM privileges.
Post-exploitation — a Meterpreter session running with NT AUTHORITY\SYSTEM privileges.
Post-exploitation — extracting local account password hashes from the compromised host.
Post-exploitation — extracting local account password hashes from the compromised host.

What I learned

  • Enumeration drives everything — the quality of the scan decides the quality of the test.
  • Validating a vulnerability before exploiting it keeps a test safe, quiet and defensible.
  • The report and the remediation are the real deliverable, not the shell.

Security implications

  • Unpatched, end-of-life systems remain one of the easiest ways into a network.
  • A single exposed service can be enough to give an attacker a foothold.

Recommended remediation

  • Patch or retire end-of-life operating systems.
  • Disable or restrict network services that are not needed.
  • Segment legacy hosts away from critical systems.
  • Monitor endpoints for exploitation and post-exploitation activity.

Next project

Segmented Enterprise Network