#!/bin/bash # # deface_demo.sh # Teaching-lab script for Metasploitable 2 (local VM only). # Produces a theatrical "defaced" index.php — Matrix-style rain background, # glitch text, a fake auto-typed "exploit log", and a real phpinfo() # dump to illustrate genuine information-disclosure risk. # # USAGE: # sudo ./deface_demo.sh /var/www/index.php # # It will: # 1. Back up the original file (index.php.bak_) # 2. Write the "defaced" page in its place # 3. Restore original ownership/permissions where possible # # To restore: cp index.php.bak_ index.php set -euo pipefail TARGET="${1:-/var/www/index.php}" if [[ ! -f "$TARGET" ]]; then echo "Error: target file not found: $TARGET" echo "Usage: $0 /path/to/index.php" exit 1 fi TIMESTAMP=$(date +%Y%m%d_%H%M%S) BACKUP="${TARGET}.bak_${TIMESTAMP}" ORIG_OWNER=$(stat -c '%U:%G' "$TARGET" 2>/dev/null || echo "www-data:www-data") ORIG_PERMS=$(stat -c '%a' "$TARGET" 2>/dev/null || echo "644") echo "[*] Backing up $TARGET -> $BACKUP" cp -p "$TARGET" "$BACKUP" echo "[*] Writing defacement page to $TARGET" cat > "$TARGET" <<'EOF' 0wn3d

SYSTEM COMPROMISED

// simulated defacement — Metasploitable 2 classroom lab //

local time: --:--:--

Lesson notes

  • This page is a staged defacement, not the result of an actual exploit chain.
  • The "exploit log" above is scripted text for atmosphere — discuss with students what a real compromise timeline/log would actually look like (auth logs, web server access logs, file integrity monitoring alerts).
  • The section below runs a genuine phpinfo() call to demonstrate real information disclosure: PHP version, loaded modules, exposed paths, and configuration values an attacker could use for recon.
  • Ask students: how would you detect this defacement happened? (file integrity monitoring, git diff against known-good source, checksums, IDS alerts on outbound changes, etc.)
  • Ask students: how would you have prevented the underlying access that allowed this file to be overwritten in the first place?

⚠ Live information disclosure demo (phpinfo)

In a real misconfigured server, an exposed phpinfo() endpoint leaks PHP version/build, loaded extensions, server document root and file paths, and sometimes environment variables — all useful recon for an attacker choosing exploits. This is exactly the kind of low-effort finding a vulnerability scan should catch.

rendered for training purposes only — restore original file when the lab is done
EOF echo "[*] Restoring ownership/permissions ($ORIG_OWNER, $ORIG_PERMS)" chown "$ORIG_OWNER" "$TARGET" 2>/dev/null || echo " (skipped chown — insufficient privileges)" chmod "$ORIG_PERMS" "$TARGET" 2>/dev/null || true echo "[+] Done. Original file saved as: $BACKUP" echo "[+] To restore: cp \"$BACKUP\" \"$TARGET\""