OK, it is time for a small challenge, we can see we are getting more and more familiar with MSF console
and exploitation, and by now you should be familiar with the entire process of searching for a vulnerability
and trying to exploit it.
Let's put all of that to the test.
So for now, recovered about four to five vulnerabilities on them at this point, the virtual machine.
And what they want you to do in this video is find three different vulnerabilities that will give you
a shell back on the target machine.
You can use any tools that you want besides searching for links that will give you the exact steps to
exploiting the vulnerability and feel free to use Google if you want to, to see if a software is vulnerable.
You can also use search light to see whether you have it in your database.
You can use Unmap to scan and metal framework to exploit.
After we do this challenge, we are ready to move on to some harder Windows experts, and after that,
we're going to see how to exploit the target without using a console and without having an expert available
inside of our Caledonius machine.
OK, great.
So this video right now, give yourself 10 to 20 minutes and try to find three different vulnerabilities
on them anticipatable, that will give you a shout back.
I myself will do it right now.
So if you don't want me to spoil it for you, then try to find them first and then watch this video.
The harder part is to find them.
However, once you find them, it is easy to exploit them.
Let's get straight into it.
Let's start by scanning the target for all the open ports and its services.
So what I'm going to do is I will perform the usual and map version scan on my anticipatable and dash
dash, which stands for scan all sixty five thousand ports.
If I press your enter, enter my password.
And by the way, of course, the vulnerabilities that we covered don't count at the moment.
We will not pay attention to them at all.
Right now we want to find new vulnerabilities.
So while this can is working, I will go to a second terminal and I will start the NSF and I will also
open a third terminal in case we need something like a third exploit or some other tool to run right
here.
So the goal is to find three vulnerabilities.
Let's see after our scan finishes whether we manage to do so.
And here are the results of the scan, so we got a bunch of ports open as usual, and let's go and pick
any one of them.
For example, I know for a fact that this this sea open port, which is three six, three two, is vulnerable.
It is running this sea version one.
And if I go to my mental framework and I just type search this sea, I will only get one expert available.
This to execute or daymon command execution.
It is ranked excellent.
So since this is the only exploit, let's give it a try I cupitt our type used and then paste the expert
name cleared the screen.
We can show info just to know what this expert does.
And it says that this module uses a documented security weakness to execute arbitrary commands on any
system running this C CD and our system is indeed running this CD.
So what we're going to do is we're going to type show options and set the art hosts to be the IP address
of our anticipatable let's see payloads.
So we got quite a few payloads right here.
Let us use this one cmd unix reverse.
So this is reverse DCB or Telnet.
Let's set it right here, since at the moment if I show options, we don't have any payload setup.
Let's set payload CMD Unix and then reverse show options once again.
Now we need to set the host so I will type pseudo, I have config enter my password, my IP addresses
one add to that 168, that one that eight.
Let's go it and let's set Alto's to be equal to that IP address.
Now if we triple check all of our available options, we should be good to go.
Let us run our expert.
And here it is, first one is over, we got the command session, one opened on the target machine.
If I type who am I where Damon if I type Eltis.
Or print working directory, we are in this directory, Hostname Command will tell us that we are at
dislikable and your name A will tell us that we are Linux anticipatable two point six point twenty four.
And here we also get some other information, such as bait and switch version of Linux.
It is great.
So first one is done.
Let us control see this iReport session one selects and let's go back to our scan to find another vulnerability.
So if you remember during our scans, once you perform the vulnerability scan, we notice that this
unveil our see what's vulnerable we got from some of our scans result that this specific service is
vulnerable to some type of the attack.
So let's give it a try.
Let's go to our search and type search flight or see.
And this gives us a bunch of different information, so this isn't really useful for us.
Let's try it like this.
Let's go to our scan and copy on our CD, which is the version.
And now if we type search it and then the name of the version.
Well, we narrow it down to four results and one of them doesn't count since it is remote denial-of-service.
Out of all of this, we got funding will be explained, which means it belongs to matters paid framework.
It is forty three point two point eight and it is backdoor command execution.
Let's search it inside our Tramer, so search and then unreal RC.
And we do get indeed only one exploit for this.
It is ranked excellent and it is from 2010.
Let's go it.
Right here, Copi selection and as usual, use this explained show info will tell us that this module
exploits a malicious backdoor that was added to the Unveil ArchCity three point two point eight download
archive.
So as it says, this module will exploit some malicious backdoor that was added in the specific version.
And if we show options, we need to set the hosts as in the previous exploit, and we also need to set
the payload.
But before we set it, let's show our available payload first.
Shopaholics, pardon me, not show options, and we get the same result as previously, so we are just
going to go with the reverse DCP over Telnet.
And if I typeset payload and then paste the payload name, now we need to set the outpost to be the
IP address of our clinics machine and if we triple check our options, everything is set to run.
And here it is, menschel session to open, we got the second exploit down.
Let's check out if it works.
Who am I?
We are different account host named Will tell us we're about to split up.
So this is the second one down.
We got one more left to go.
Let let's control see this go back to our skin.
And we are doing this really fast tempo because we already are familiar with all of these tools and
techniques that we use to exploit these vulnerable softwares.
If you didn't manage to find three different experts, don't worry, this comes with the practice.
So after some time practicing, you will be able to find even more than three exploits.
Let's continue on the third one.
So if we go down here and check out what different services we got running this one, which is running
over Port eight, seven, eight, seven running service Diyab, I know for a fact that it is vulnerable,
so let's give it a try.
The service theme is DRP.
See if I type in my search fluid DRP.
Well, we only get the results right here, and it doesn't seem that any one of them belongs to them
at this point framework, as we can see right here, since these are Python files.
So let's just double check what's not here.
Let's just double check right here.
If we can find something regarding DRP and we do manage to find it.
So we got these two exploits which are for the multi and we got this DRP remote code execution and it
says Distributed Ruby Remote Code Execution.
And DeFago right here under the version, we can see that it is running Ruby.
So let's just give it a try.
You never know if we copy this exploit.
Which says Derby remote code execution, and we use it right here.
Show our options.
We can see by default it has set the payload to be CMD Unix reverse net kit and we got two different
things to set up.
Matter of fact, one of them is you are right, which is not really needed.
So we can only set our hosts.
And for some reason, it does say that our host is not required, but I'm not really sure how it is
not required, so we will just specified anyway that our hosts want to do that 168 at one dot seven
since the payload is already being set.
Let us just run the exploit.
And here it is, we got commensal session three open.
Let's type who am I?
We are route account, and once again, Hostname will tell us where matters political machine.
And with this we completed our challenge.
We found three different vulnerabilities that gave us a shellback.
But these are not the only ones.
Matter of fact, let me just show you one or two more that you could have found if you perform this
challenge.
The one that is a little bit different to exploit is this VMC service running on Port five nine zero
zero.
It is running Protocol three point three.
And if we just search in the search deployed search and C search deployed, Vincey, we will get a bunch
of the results right here.
So let's add the version three point three.
And we do get some of the responses right here.
But it does say that these are four windows.
Now, we are not going to give up just because we cannot find the exploit using search plate.
Matter of fact, it probably is somewhere right here, just there is a bunch of result and we don't
really want to read through all of this to find the expert that we need.
So let's just go straight to the point and type search and see.
And if we scroll all the way up, since these are just paillard.
I come to exploit we can see there about five or six experts, and these four are four windows, so
we can forget about them straight away.
We got this one and we got this one.
This one seems interesting.
It is an expert for multiple operating systems for Vincey and it says Vincey, keyboard execution.
So let's just copy the name and see whether it works.
Now, this is just a part of penetration test.
If you don't know an exact exploit, you simply just try a few different ones and see if they work,
just get used to it that some exploits will sometimes not work and you will have no idea why they don't
work.
So they just type set or pardon me, just type use and then the expert name.
And this seems that it isn't an exploit for us, since it is also setting the windows paillard.
Hmm, we cannot find, have we and seek exploit.
So what are we going to do?
Well, if I go right here and instead of searching for an exploit, I simply just try to connect to
the V.A. using a tool called vascular.
And all I need to specify to connect to is the IP address to that target machine.
Press enter.
Hmm.
It seems to be asking for a password.
Well, let's try MSF admin, which is the usual password for everything in Anticipatable and it tells
us authentication, failure.
But if we try it once again and as a password, I simply just type password.
Well, it worked, the Vincey viewer password was just password, and now I got through Chele opened
on Demetris potable, I can execute commands right here such as?
I have config such as hostname kallus and I can see anything that is on the target machine.
So this was a little bit different because it was due to a weak password.
I just connected to the B and C and I typed password and it granted the access to the shell of the anticipatable.
Great to Exeter's.
I can type exit and I can exit this desktop right here.
And let me show you just one more and then we are going to end the video.
And that one is over port one zero nine nine.
It is running Java RMI and if I go in my Mattapoisett framework and search for Java, underscore RMI.
Well, we get to exploit right here.
Let's try with this one first, so exploit multi Misk Java, RMI server Copi, the exploit name go right
here and type use.
It set the default payload to be Java Mehtar, better reverse DCP.
Now this is the first time that we are encountering amateur Peter payload.
You will see that it is a little bit different than all the other shells that we got in the previous
exploits.
So if it type show options.
There are a bunch of things that I need to set our payload options has already been set to correct one
to the correct IP address and to the correct port.
All we need to set right here is the our hosts.
You can just leave the server hosted in Server Port to be zero point zero point zero point zero and
eighty eight.
If it go right here and typeset our hosts one, add to that 168 that funded seven and I run this.
Well, here it is, we got the interpreter session for Open, and if you want to execute the commands,
you can just wait for this expert to finish.
And even though it says right here it failed, if I type sessions, I will have the matter session for
and I can enter that session by typing sessions.
And then I and then the idea of that session, which in my case is four and I've entered the interpreter
shall.
Right here, the comments are different to check out all of the comments that we can run with an interpreter,
we can type the help comment, and you can see it is split into different sections, such as filesystem
commands, such as core commands.
And all of these commands work with Metropia there shall we can download and upload files.
We can execute a command, we can screen share.
We can perform a screenshot of the target machine.
We can record the microphone and many other things that we're going to check out later.
But for now, we can use a comment called Shell to enter the command shell with the target machine.
So if I type who am I once again?
Right now, I'm a remote account for the IP address of the Anticipatable.
Great, now I let this matter potential for the end, just so we can slowly start getting into using
interpreters on our target machine, as we can see, there is a lot of the commands that we can run.
Now, in the next video, we're going to start with those exploitation and invidious exploitation.
We are most likely always going to want to open.
I'm a therapist, Rachelle.
So that would be about it for this challenge, once again, if you managed to find three different vulnerabilities,
congratulations.
If not, don't worry, this comes with practice.
Now that the government has political vulnerabilities which are rather easy, it is time to move on
to the windows vulnerabilities.
See you in the next video.