Exploit a weak service you built, and watch the wire and logs

short · 60 min · Objective 4.1

Task

Exploit a deliberately weak service on a lab VM you built, but do the two things people skip: capture the traffic while it runs, and read the target's logs afterwards — because anyone can follow an exploit to a shell, and knowing what it looked like on the wire and in the logs is what makes you able to write the defender's half of the report.

Steps

  1. On the lab you own, stand up a service with a known vulnerability on a disposable VM you can revert, and snapshot it before you touch it.
  2. Scan it from the attacker VM as though you did not already know it, and identify the service and version.
  3. Read the exploit first: what it connects to, the exact payload, what it changes, whether it is reversible. Record this in /tmp/exploit-review.md.
  4. Capture traffic to /tmp/exploit.pcap while you run it against your lab target.
  5. Observe what you got and note what broke — services often crash.
  6. Read the target's logs and record what a defender would have seen, then revert to the snapshot.

Verify

grep -cE "^(connects|payload|changes|reversible):" /tmp/exploit-review.md
tshark -r /tmp/exploit.pcap -T fields -e ip.dst 2>/dev/null | sort -u | grep -c "^10\."
grep -ciE "log|event|defender would|observed" /tmp/defender-view.md

The first count must be at least 3: you reviewed the exploit before running it, which is the professional habit that matters most here. The second confirms the captured traffic went to your lab host (an RFC1918 address), not anywhere real. The third must be non-zero: you wrote what the defender saw, which is what makes the attack narrative and remediation possible later.

Notes

Running exploit code means running a stranger's program with your privileges on someone else's system — read the whole file including the part after the interesting bit, decode the blobs, and if you cannot read it, it does not run on a client's system. Record the exact invocation for reproduction and add every change to the cleanup list as you cause it. This whole exercise ran on a disposable VM you built.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.