Windows Server 2008 R2 SP1
Attack Target & Pivot Host
Primary Windows target with IIS WebDAV, EternalBlue (SMBv1), BlueKeep (RDP), WinRM, Rejetto HFS 2.3, and Pass-the-Hash targets. Dual-homed for pivoting exercises.
10.10.10.10 • 172.16.1.10
HANDS-ON eJPT TRAINING LAB
Penetration testing lab
built for the eJPT exam.
Four pre-configured vulnerable virtual machines spanning Windows and Linux, across a dual-network topology with 25+ exploitable attack paths. Train on the same techniques tested in the INE eLearnSecurity Junior Penetration Tester certification.
4
Vulnerable VMs
25+
Attack Paths
2
Network Segments
7
Exploitation Topics
104
Lab Notes Covered
Lab machines
Every VM is purpose-built to expose a specific set of vulnerabilities covered in the eJPT curriculum. No pre-built images needed — build from scratch for maximum learning.
Windows 10 Enterprise
Post-Exploitation & AV Evasion
Modern Windows target for post-exploitation enumeration, privilege escalation, persistence techniques (registry/ scheduled tasks), and AV evasion with Defender enabled.
10.10.10.20Ubuntu 14.04 LTS
Linux Vulnerability Cluster
Dense Linux target running vsftpd 2.3.4 (backdoor), ProFTPD 1.3.3c, libssh 0.8.1, Postfix VRFY, MySQL root empty, Samba 3.0.20 usermap_script, Apache Shellshock CGI, and multiple SUID/SUDO privesc vectors.
10.10.10.30Ubuntu 16.04
Pivoting Target (Internal Network)
Internal-only VM on VMnet2. Runs Apache with RCE web shell and Samba vulnerable to CVE-2017-7494 (is_known_pipename). Accessible only through the pivoting host (Win 2008 R2).
172.16.1.20Network topology
Two isolated VMware host-only networks simulate a realistic multi-tier enterprise environment with a clear pivoting path.
VMnet1 — External Network • 10.10.10.0/24
Kali Linux
10.10.10.5
Attacker
Win 2008 R2
10.10.10.10
Target / Pivot
Win 10
10.10.10.20
Post-Exploit
Ubuntu 14.04
10.10.10.30
Linux Cluster
↓ PIVOT THROUGH WIN 2008 R2 (DUAL-HOMED) ↓
VMnet2 — Internal Network • 172.16.1.0/24
Ubuntu 16.04
172.16.1.20
Internal Target
Win 2008 R2
172.16.1.10
Pivot Host
Windows attack techniques
- IIS WebDAV misconfiguration & authentication bypass
- MS17-010 EternalBlue SMB exploitation
- CVE-2019-0708 BlueKeep RDP exploitation
- WinRM enumeration & remote code execution
- Rejetto HTTP File Server 2.3 (CVE-2014-6287)
- SMB relay attack with NTLM capture
- Pass-the-Hash lateral movement
- Windows privilege escalation (Unquoted Path, AlwaysInstallElevated)
- Post-exploitation enumeration & persistence
- AV evasion with obfuscated payloads
Linux attack techniques
- vsftpd 2.3.4 smiley-face backdoor exploitation
- ProFTPD 1.3.3c HELP ACIDBITCHEZ backdoor
- OpenSSH weak-password brute force
- libssh 0.8.1 authentication bypass (CVE-2018-10933)
- Postfix SMTP VRFY user enumeration
- MySQL root remote access (empty password)
- Samba 3.0.20 usermap_script RCE
- Apache CGI Shellshock exploitation (CVE-2014-6271)
- SUID/SUDO misconfiguration privilege escalation
- Linux credential dumping (/etc/shadow)
- Pivoting with autoroute & port forwarding (Metasploit)
- SambaCry CVE-2017-7494 exploitation
Vulnerability service matrix
Every exploitable service pre-configured across the lab environment, mapped to the target VM.
| Service | Version | VM Target | CVE / Vulnerability | Module |
|---|---|---|---|---|
| IIS WebDAV | 7.5 | Win 2008 R2 | Weak auth / misconfig | WebDAV Exploitation |
| SMBv1 | — | Win 2008 R2 | MS17-010 (EternalBlue) | SMB Exploitation |
| RDP | — | Win 2008 R2 | CVE-2019-0708 (BlueKeep) | RDP Exploitation |
| WinRM | — | Win 2008 R2 | Weak auth / unencrypted | WinRM Exploitation |
| Rejetto HFS | 2.3 | Win 2008 R2 | CVE-2014-6287 | HTTP Exploitation |
| BadBlue | 2.7 | Win 2008 R2 | PassThru RCE | Pivoting |
| vsftpd | 2.3.4 | Ubuntu 14.04 | Backdoor (:)) | FTP Exploitation |
| ProFTPD | 1.3.3c | Ubuntu 14.04 | HELP ACIDBITCHEZ backdoor | FTP Exploitation |
| OpenSSH | — | Ubuntu 14.04 | Weak credentials | SSH Enumeration |
| libssh | 0.8.1 | Ubuntu 14.04 | CVE-2018-10933 (auth bypass) | SSH Exploitation |
| Postfix SMTP | — | Ubuntu 14.04 | VRFY enumeration | SMTP Enumeration |
| MySQL | 5.x | Ubuntu 14.04 | Empty root password | Database Enumeration |
| Samba | 3.0.20 | Ubuntu 14.04 | usermap_script RCE | SMB Exploitation |
| Apache CGI | — | Ubuntu 14.04 | CVE-2014-6271 (Shellshock) | Web Exploitation |
| Haraka SMTP | < 2.8.9 | Ubuntu 14.04 | Command injection | SMTP Exploitation |
| Apache + PHP | — | Ubuntu 16.04 | Unrestricted RCE (cmd.php) | Pivoting |
| Samba (CVE-2017) | 3.x–4.6 | Ubuntu 16.04 | CVE-2017-7494 (is_known_pipename) | Pivoting |
Learning path
A structured 4-day build-and-exploit schedule that aligns with the eJPT exam objectives.
Day 1
Foundation
Kali + Linux Main Target
- Set up Kali Linux and Ubuntu 14.04
- Network enumeration with Nmap
- FTP anonymous access & vsftpd backdoor
- SSH weak-password attacks
- Apache Shellshock CGI exploitation
- Samba usermap_script RCE
- MySQL database enumeration
- Linux SUID/SUDO privilege escalation
Day 2
Windows Attacks
Windows Server 2008 R2
- Build Win 2008 R2 with IIS + WebDAV
- EternalBlue MS17-010 exploitation
- BlueKeep RDP exploitation
- WinRM remote code execution
- Rejetto HFS 2.3 Metasploit module
- Pass-the-Hash lateral movement
- SMB relay with responder
- Windows privilege escalation vectors
Day 3
Post-Exploit
Win 10 + Docker Web Targets
- Windows local enumeration techniques
- Windows privilege escalation (services, tokens)
- Persistence via registry & scheduled tasks
- AV evasion with custom payloads
- PowerShell Empire post-exploitation
- Docker-based web targets (SQLi, XSS, LFI)
- Command injection & file upload attacks
Day 4
Pivoting
Pivoting & Internal Network
- Set up dual-network topology
- Compromise Win 2008 R2 (pivot host)
- Metasploit autoroute add routing
- Port forwarding to internal targets
- BadBlue passthru exploitation (bind_tcp)
- SambaCry CVE-2017-7494 exploitation
- Full attack chain: external → pivot → internal
Prerequisites
Before entering the lab, ensure you have:
- VMware Workstation Pro or Player
- Kali Linux VM (attacker machine)
- 8 GB+ RAM recommended for 4 concurrent VMs
- 60 GB free disk space
- Basic familiarity with Linux command line
- Metasploit, Nmap, and basic TCP/IP knowledge
Frequently asked questions
Do I need to build the VMs from scratch?
Yes. The lab is designed as a build-from-scratch exercise (no pre-built images). This ensures you understand every component of the attack chain. Detailed setup scripts are provided for each VM.
Is this lab officially endorsed by INE?
No. This is an independently built lab environment designed to cover the techniques tested in the eJPT exam. It is not affiliated with or endorsed by INE or eLearnSecurity.
Can I access the lab online?
The lab runs locally on your own VMware hypervisor. Build scripts, configuration files, and documentation are provided. We do not host a shared online lab environment.
What is included with lab access?
Full setup scripts for all 4 VMs, network topology guide, configuration files, credential lists, and detailed build documentation. Ongoing support is available for build issues.
How much disk space and RAM do I need?
A minimum of 60 GB free disk space and 8 GB RAM is recommended. For best performance with all VMs running simultaneously, 16 GB RAM is ideal.
Ready to build your eJPT lab?
Get the complete build scripts, configuration files, and documentation for all 4 vulnerable VMs. Start training on real-world attack techniques today.