Hello everyone. Welcome to this module. This module is
going to be the final module and willing Encompass, everything
that we've learned so far during this course. Now,
in this particular module, we're going to be taking a look at
exploiting met exploitable three, our goal is to achieve or
to get system, privileges or administrator privileges
on the Target and to obviously crack
as many passwords as easy as we can. So
we're going to start off. First of all, by by,
of course, taking a look at the nmap scan that we had.
Formed early on. So I'll just open up the nmap scan here
and we can get started by analyzing some
of the services that were running. Now. We analyzed during
the first two modules when we are
taking a look at scanning the target, we were able to
deduce that the system is vulnerable to
the Eternal blue exploit, which will take a look at in a second. And
if we take a look at some of the other options
here or the other services that are running, we can
see that on Port 80 20.
We have a service running on Port 80 20. We also have a service running
on Port 8383 which were very interesting. So
if we open that up, so 10.10 so
what 8383 we can see that we
have managed engine desktop Central Version 9, if
we perform a quick Google search here, so that
is not google.com. So google.com, and
we search for manage engine.
Nine exploit,
right? We're looking for a
Desktop Central exploit and let's see if we can find any potential
exploits. So we have a
rapid 7 link here. That looks like this will
probably be a Metasploit module. We
can just take a look at it in a second year. So
this is indeed a Metasploit module.
Let's take a look at some of the other exploits that
are currently available, and we can look for
the rapid 7 exploit so we can say rapid rapid
7 so we can
They cite rapid7. Rapid7 hit
enter rapid7.com. I
believe there we are. So let's
take a look at some of the exploits that are currently available and we can try them
out, so we can actually open up Metasploit. So,
I'll do that right now. We'll open up a
new tab here, and I'll just enlarge that. So, msf console.
Msf console. There we go. That
should start up the Metasploit service or the Metasploit console. And
we're going to search for manage desktop or manage
manage engine, right? That's the name of
the service. And yeah,
we're just going to search for that. So again, just waiting for the Metasploit console
to begin or to start. So,
Manage engine.
Trying to will get rid of the spelling mistake here.
All right, so it looks like we have
a few, a few exploits here.
We're looking for version 9. So I'm just going to
try and reduce the font size here so that we can see everything. I'll
just perform that search again. So
pretty much do the one that pops up the most. If
we take a look at the the exploit links here is
we have a connection ID vulnerability. Let's
see what other explanation.
Let's do we have this is the main link. I
believe that will take us too.
His gives us remote code execution. I'm
not sure about the version nothing much there.
So if we take a look at some of the exploits we
can see under exploits. We have author
upload that manager engine
multiple products authenticated file upload. That's really
not what we're looking for. If you take a look at the bottom
here, we have the app manager exploit and
then of course, we have connection ID, right? Which
Is again targeting manage engine desktop
central 9, right? So, this one looks like
a potential candidate for a vulnerability
of the exploit. So we say, use and
will say use this module, and it's
going to set the default Windows, but
default payload Windows meterpreter, reverse TCP,
which I guess is fine. So we can say show options and
the port is going to be 83, 83. So
we'll set the our hosts, in this case, the Metasploit about 3 IP.
These 10.0.0.0 X and
set the our Port we're going to set that to 83 83
and we also have SSL enabled.
So we'll set SSL to true. So, set SSL
to True hit enter, right? And
the L
host and L Port options, look, fine. So
that's the current Callie. I p&l Port can be 4444. So
we just did run. And let's see if we can get a, an actual session
here. So, it's going to create a JSP.
Stager and it's going to upload this
stage, execute the stage and we get the multiplet accession, right?
A vso. It's called. So going to delete the JSP Stager that
is actually created. So we can open up
the meterpreter session now. So, if we try and enumerate some
serious, some information about the system, we can see the
computer name is vagrant, 2008, R2, the
architecture 64-bit, but we have a 32-bit meterpreter
session which we want to change if
we say get user ID, we
See that we have anti-authority but we are currently
the local service. What we want is this system systems
or the the system privileges, 20 Authority system. So
we pretty much cannot do anything much because we
do not have the appropriate permissions it obviously
changes when you're dealing with Windows servers, opposed to Windows
the desktop versions of windows. So
we would probably need to try some privilege
escalation. But again, we also have the Eternal blue
exploit that we can try, but
If we try and monitor the processes, we can try and migrate. So
let's see what process we can actually migrate to.
You can see most of these services are the
32-bit processes, so
we can actually look for the explorer.exe, which
is usually a very stable way of migrating into
a 64-bit session.
And we can just use, be grab so we can see a pretty girl Explorer.
Like so and we can see it's a 4708 that is
the process ID. So 4708 and we can
try and migrate into that. So we can say my great 4708. I
doubt we'll have the relative permissions. There. We
are. We can see we don't have the appropriate permissions, but
we can look for a 64-bit session, in,
try and migrate into it all try and migrate into connection, host .exe.
So that is 3560. So
we can say my great 3560.
3560 hit, enter. Let's
see if we can get a 64-bit meterpreter
session. There. We are. So we can see this
info.
And we can see that we have a
64-bit meterpreter session now. So,
given that we have this now. Reset get user ID. We
still have the the local service permissions.
We now need to try and escalate our privileges into
a anti-authority. So,
let's see if we can use the exploits of gesture. So,
we'll put this in the background, and we can search
for the suggestor so search, so
search for the sir.
Esther.
And we can then spay use the suggester and
if we take a look at those sessions, we have Session 1. So
we will just say show options here.
And we set the session to 121 and
I'm going to hit run and we're going to let this run.
So, it looks like we only have a few exploits that
we can use. So what we can try and use on
one, that looks the most likely is Ms. Attend a
092. We can perform some research on this and let's see
what this brings up. So we can search for a Mist na0 92.
We can click on that here and we
can take a look at what this
exploit pertains to. So this is a an exploit
or variability within the Windows task scheduler, which is
find the security.
8 is rated important for all versions of Windows Vista,
Windows Server. 2008, Windows 7 and Windows Server.
2008 R2. All right, so it looks like this,
this will actually work on Windows Server, 2008 R2.
So we can actually just say use and
paste that in there. And we can then say show options,
show options, and the
default payload is set to Windows meterpreter, reverse TCP. We
can set that to a 64-bit session. Also windows.
We say windows x64
meterpreter.
And we can then say it reverse TCP.
Right? And we hit show options. Again. We
can then set the L Port because we
want to keep it different from the session. We
already have running. So we'll set the out Port 1, 2 3 4, right,
and we can then hit session. So Session One
set, the session to session one and hit run and
let's see if we can actually get or escalate
our privileges. So it looks like we were
able to
Escalate our Privileges. And the scheduled task was
successfully deleted. Let's
take a look at what actually happened. So,
error, the specified task. It
doesn't look like this but particular exploit worked. So
that doesn't look like it actually works. So we list all sessions. We
only have one session. So if I say Session One, get
user ID, we're still local service. So we can try
and display these services. And let's see if we have any new services.
And we still do not have any relevant permissions. So we
are pretty much going to have to try the Eternal blue exploit.
So, in this video, we essentially took
a look at gaining our initial foothold. And in the
next video, we'll take a look at how to exploit the Eternal blue, vulnerability.
And then, of course, we'll be taking a look at how to dump the
password hashes and then outer crack them with John, the
Ripper so that we have a total control and access to the system.