23.7 Red vs Blue, Project and Real Incidents

By Ravindra Bagale Last updated: 27 September 2026

Chala mitrano, msfconsole, sessions, Meterpreter, msfvenom concept – aata Purple Team loop. Red lab madhe Metasploitable var one known module (e.g. vsftpd) ne session dakhavto; Blue patch/vuln management, unused services band, egress filter, host IDS/EDR aani SIEM signatures lavto. Tumhi Sahyadri Traders style OWN lab madhe build → hack → fix karun Purple report liha. Exploit awareness; fix + restore = career. Samjla ka?

Red Team vs Blue Team – Metasploit-style exploitation

Red team (attacker) does	Blue team (defender) detects / stops
`msfconsole` search/use/exploit against Metasploitable known services	Patch / vuln management; remove or firewall unused services (vsftpd-era junk off production)
Opens a shell / Meterpreter session; `hashdump`, file download	Host IDS/EDR; least privilege; protect `/etc/shadow`; alert on unusual process / memory tools
msfvenom reverse payload concept + multi/handler	Egress filtering: block unexpected outbound reverse-shell ports; app allow-lists
Leaves noisy exploit attempts on internet-facing hosts	Written scope; host-only `.20` only; snapshot before; never public targets
Relies on unpatched SMB / web frameworks years after advisory	Continuous scanning + forced patch SLAs; CISA KEV-style priority list
Trusts one shell without documenting detection gaps	SIEM alerts on exploit signatures / odd FTP→shell patterns; IR runbook + restore from snapshot

Defender chi simple checklist: snapshot → patch/disable service → egress filter → EDR/SIEM → restore + re-verify exploit fails. Attack framework Kali var; bachav patch aani network Blue var. Interview madhe "I got a Meterpreter" peksha "I restored the snapshot and documented which patch/egress rule would have stopped the session" jast strong.

# OWN host-only only – Kali 192.168.56.10 → Metasploitable 192.168.56.20
mkdir -p ~/labs/sahyadri-msf
# BEFORE any exploit: take / confirm VirtualBox snapshot of Metasploitable
# In msfconsole (lab only – module already taught in 23.4):
#   use exploit/unix/ftp/vsftpd_234_backdoor
#   set RHOSTS 192.168.56.20
#   exploit
#   id; hostname; background; sessions -K
# Defender mindset (document – production would patch/disable):
#   - disable unused FTP/IRC/Samba on hardened images
#   - egress: firewalld/ufw deny unexpected outbound from servers
#   - sudo yum update on Amazon Linux helpers you own (Metasploitable itself is an old training image – restore snapshot)
# After practice:
#   restore Metasploitable snapshot "clean"

Ravindra Bagale's Tip

Once they get a session, students download whole folders and forget to restore the snapshot – the lab becomes a big mess. The second mistake: sending an msfvenom file to a phone or over WhatsApp. Rule: one taught module → evidence (id/hostname) → sessions -K → restore snapshot → write which patch/disable/egress would stop it. CEH exam modules include exploitation – always pair it with detection and patching. Don't worry, it comes with practice.

Ravindra Bagale's Tip – मराठी

Session मिळाला की students सगळे folders download करतात आणि snapshot restore करायला विसरतात – lab मध्ये मोठा गोंधळ होतो. दुसरी चूक: msfvenom file phone/WhatsApp वर पाठवणे. Rule: one taught module → evidence (id/hostname) → sessions -K → restore snapshot → write which patch/disable/egress would stop it. CEH exam modules मध्ये exploitation येते – त्यासोबत detection आणि patch नेहमी जोडा. घाबरू नका, practice ने जमते.

Ravindra Bagale's Tip – हिंदी

Session मिलते ही students पूरे folders download कर लेते हैं और snapshot restore करना भूल जाते हैं – lab में बड़ी गड़बड़ हो जाती है. दूसरी गलती: msfvenom file phone/WhatsApp पर भेजना. Rule: one taught module → evidence (id/hostname) → sessions -K → restore snapshot → write which patch/disable/egress would stop it. CEH exam modules में exploitation आता है – उसके साथ detection और patch हमेशा जोड़ो. घबराओ मत, practice से आ जाता है.

Lab

Metasploitable snapshot confirm kara. Kali var msfconsole madhe vsftpd_234_backdoor (23.4 madhe shiklo) ekda chalava – id aani hostname evidence save kara (~/labs/sahyadri-msf/). Session sessions -K ne band kara. Snapshot restore kara. 5 lines liha: konta service disable / patch / egress rule he session thambavel. Public IP var nahi.

Project: Build it, hack it, fix it

Build: For fictional Sahyadri Traders (Pune) exploitation lab, use Metasploitable 192.168.56.20 on host-only. Confirm:

Clean VirtualBox snapshot named pre-msf-vsftpd
vsftpd (or one other module already listed in 23.4) still present for training
Ethics card + no bridged adapter

Optional helper .50 stays out of exploit path unless you only document egress ideas there.

Hack (lab only – ONE known module): From Kali 192.168.56.10:

search / use the vsftpd backdoor module (or samba/usermap / unreal_ircd as already named in this chapter – pick one)
set RHOSTS 192.168.56.20, exploit, capture id / hostname (and optional hashdump only if Meterpreter path already taught)
sessions -K when evidence is enough

Do not invent new exploit chains, do not pivot to classmate machines, do not keep the shell for "extra fun".

Fix path (training image reality):

Restore snapshot pre-msf-vsftpd immediately (Metasploitable is intentionally vulnerable – you do not "yum update" it into a fake patched OS)
Document what a real Blue team would do on a production twin: disable unused FTP/IRC/Samba, apply vendor patches, place behind firewall allow-lists
Egress concept: block reverse connections to random high ports from servers; EDR/host IDS on critical hosts
SIEM note: alert on exploit kit signatures / sudden FTP service spawning shells
On any Amazon Linux helper you own: sudo yum update and sudo service <svc> stop for unused daemons

Re-verify: After restore, service behaviour matches clean snapshot; written proof that the chosen module would fail if that service were disabled/firewalled. 1-page Purple report for owner Shraddha: finding → risk → fix/restore → evidence. Peer-review with Amir / Ravina. No internet targets, no msfvenom files leaving the lab.

Real incident: WannaCry ransomware (2017)

In May 2017, the WannaCry ransomware outbreak spread worldwide by exploiting a vulnerability in Windows SMB (EternalBlue), widely reported as impacting hospitals, manufacturers and other networks that had not applied available Microsoft patches. Public reporting linked the worm-like spread to unpatched internet-reachable or poorly segmented SMB. Weakness: missing critical patches + exposed SMB + weak segmentation. What would have reduced it: rapid patching (MS17-010-class updates), disable SMBv1 where appropriate, block SMB at the edge, network segmentation, and tested backups/IR. Lab lesson: Metasploit modules against old Metasploitable services are the classroom cousin of "unpatched remote exploit" – Blue answer is patch + disable + segment, not memorizing more modules. Source: Microsoft / NHS and major news coverage of WannaCry (2017); CISA historical summaries (verify current summaries).

Real incident: Microsoft Exchange ProxyLogon / Hafnium (2021)

In 2021, Microsoft and CISA reported active exploitation of critical on-premises Microsoft Exchange vulnerabilities (commonly discussed as ProxyLogon and related CVEs) by threat actors including the group Microsoft tracked as Hafnium, followed by wider exploitation. Public guidance stressed immediate patching, checking for webshells, and assuming compromise where patches lagged. Weakness: unpatched internet-facing mail servers + rapid mass exploitation after disclosure. What would have reduced it: emergency patch SLAs for internet-facing apps, attack-surface reduction, WAF/IDS signatures, webshell hunting, and MFA/least privilege on admin paths. Lab lesson: when a remote exploit module exists in frameworks, Blue time starts at disclosure – inventory, patch, verify. Source: Microsoft Security Response Center posts on Exchange / Hafnium (2021); CISA alerts (verify current summaries).

Interview model (clean English): "I use Metasploit only against my host-only Metasploitable lab, one taught module at a time. I capture minimal evidence, kill sessions, restore the snapshot, and write which patch, service disable, egress filter or SIEM alert would have stopped that path."

Thodkyaat: Metasploit shika, pan snapshot + patch story + egress shika. Aata pudhe sniffing – Wireshark. Chala pudhe, mitrano!

Thodkyaat sangaycha tar

Metasploit is a framework: exploit (the way in) + payload (what runs) + session (your connection).
Reverse payloads beat bind payloads because outbound traffic is usually allowed.
Workflow: search, use, info, set RHOSTS/LHOST, show options, exploit, then manage sessions.
Meterpreter gives rich post-exploitation commands (sysinfo, hashdump, download); those hashes feed John/Hashcat.
msfvenom builds standalone payloads with a matching handler – study it to recognise and block real malware.
Snapshot before, restore after, and always think about how a defender would detect each step.

Samjla ka? Aata exploitation cha framework kalala. Pudhchya chapter madhe traffic sniffing – Wireshark ani tcpdump. Chala pudhe, mitrano!