Welcome back.
In the previous video, we talked about matters, played, framework, structure, we explained all
of the modules and what they are for, but we haven't really read the framework itself.
In this video, we're going to run it and cover some of the basic commands for it.
OK, I already mentioned in the last video that to open this framework, what we must do is open up
our terminal and type NSF console, press, enter and keep in mind that it might take some time to open,
especially if you're running it for the first time.
And here it is, it already opened for me and what we get right here is we get the banner of mental
framework, which changes every time you start this program.
And down here we get these seven modules that we talked about and we also get the exact number of modules
that we have available to us.
So here we can see two thousand forty three experts, one thousand one hundred and five auxiliary modules,
three hundred and forty four post exploitation modules, over five hundred payloads and a little bit
of encoders knobs and evasion modules, as in every other tool that we covered to see all the available
commands we can use, we can run the health command.
This will open the help menu, which will give us all the available options, as well as some of the
examples of how we can use Matus plate, but for now, this is not necessary, as I will show you a
few of these commands that you will use every time.
And by the way, before we get into those comments, what you can do inside the metal plate framework,
you can also run the normal commands such as L, such as changing directories, such as, for example,
running.
I have config.
So if I type pseudo, I have config and type in my password, it will give me the output of five config.
So you can also run regular terminal commands from this.
But as far as the plate framework goes, let's start with listing some of the modules.
For example, we can use the show command to list out any type of modules we want.
So we know that there are over 500 payload.
We saw the number once we started Šemeta split in order to list all of those five hundred payloads.
We can type, show and then payload.
If I press enter, it will tell you just a few seconds and it will list out all of the available payloads
that we have now right here.
This is not really that good of an output because I have my terminal a little bit more sumthin than
I should have.
So I will just go to the preferences and lower the font of my letters.
So I click on OK, apply.
OK, clear the screen and I will type show payloads once again.
It's still not that good.
Let me just go and lower it a little bit more, so I'll just go 30 apply and we can clear the screen
from the comment again.
And here it is.
We get a better output.
So let's explain what we see right here.
If I scroll all the way up to the beginning, we can see this is the number of the payload.
It goes from zero to over five hundred.
And this right here is the name of the payload.
So as we already know, there are braincells and reversions.
So we get different types of them.
We can see the payloads for Android, the payloads for Apple, iOS, we can see all types of payloads
command Chelse, we can see Java payloads, Linux payloads.
If I go all the way down, OSX payloads, payloads, Biton, Ruby and bunch of others as well.
Here is also Windows payloads.
So we get a lot of them under the rank.
They're all manual because they have to get executed on the target machine.
And in the description we can see for what this is.
For example, if we check out this one Apple interpreter, reverse DP, this is the Apple II interpreter
Shell or reverse HDP in line.
So this means you would use this payload if you were, for example, attacking an Apple device.
Now we can do the same thing with exploits.
If we want to list all of the 2000 exploits, we can type show exploits.
And this may take a little bit longer because there is a lot more exploits than there is payload.
And here they are here all 2041 exploits.
You can see the output is pretty much the same as with the Paillot, we get the number right here,
we get the exploit name and these exploit names are really well written.
As we can see.
The first part tells us for what is this exploit?
Currently we are inside the windows exploit.
And if we scroll all the way up, we should see some other experts as well.
Let's go and scroll all the way up.
Well, it seems that we can only go up to here because there is a lot of them, but nonetheless, we
can see for what the exploits are, for example.
This one is for Windows and for browser.
And here it specifies exactly what does it exploit.
If I go down here and for example, check out these ones here, we can see this is also in the sexpert
for the FTP.
So they're very well organized.
And this is the structure that we saw in the previous video.
Just this is how the metal plate framework outputted for us.
These exploits that belong to Windows FTP are all located inside of the FTP directory of the Windows
XP directory.
If it go all the way down.
And what we can do right here is we can choose one of these experts just to see how we can select them
and run them.
Of course, we are not going to be attacking any target.
We just want to see how we can select one of these exploits.
So let's go with this one.
For example, Windows SMB, RMS zero six zero four zero net API.
And by the way, to check out more information about the exploits, we can go on to the right.
So this exploit came out in 2006 and in the right column right here, it tells us what exactly does
this exploit do?
So for this particular one, we get that it is an expert for Microsoft server service and it overflows
this function.
Now, the good part about this is that you don't really need to know how these work in order to be able
to run.
Let me show you, if you copy this exploit name right here, so copy Windows Sambi Hemas zero six zero
four zero net API.
In order to select it, let us clear the screen.
We can type the command use.
And you type views and then the module name that you want to use in our case, we want to use and exploit
and after it, all we have to do is based the expert.
So use exploit windows, slash Sambi and then the name of the expert press enter.
And we will see that this exploit configured payload windows interpreter reverse DCP and we will talk
about this in just a second.
For now, we can see that it is currently using the module that we selected because it is printed out
in red right here.
And it also tells us that it is an expert.
So let's check out all the information that we can get for this exploit.
The first thing that I always like to do is type the command show info.
And this show in full command tells us more about this particular exploit.
If you go down here to the description, it will tell us this module exploits a stack buffer overflow.
So this is a buffer overflow exploit in the net API 32 canonical path name function using this RPG and
you can read about any exploits to select.
Another information that we get right here are some of the references so you can visit these links right
here to read more about this particular expert besides this, another command that we can do is show
options.
And this is the important part.
Let me just clear the screen and type it once again just so we can see only the options.
Part here is where you select your options for the exploit.
First thing we see is module options and it asks us for three different things.
And keep in mind, different experts will want different things.
Usually they will all have these are hosts and our port, which is just the remote host and the remote
port, or in our case, the target's IP address and the target support that we are attacking.
So we can see two of these are already automatically set.
The airport is already set to be four for five and the S&P pipe is already set to be the browser.
All we are left to specify right here is the our hosts or the IP address of the target machine.
So if we were attacking a Windows server that was vulnerable to this attack, we would specify here
the IP address of that Windows Server machine.
And in this column right here, you will notice that some of these things will be required and some
of these things will not be required in our case in this particular exploit, all of these three things
are required to specify in order for expert to work.
In the description, it tells us exactly what it wants from us, so the our host is the target host
or the target's I.P. address.
The airport is the S&P service port on the target machine.
And the S&P pipe is the type name to use.
So these are the exploit options and down here we get payload options.
What does this mean?
Well, remember, after exploiting the target, we drop our payload.
So by default, remember, once we ran the command to use this exploit, it gave us Windows method better
reverse by default.
This means that we were using a payload for windows.
It is a bitter, bitter shell which remembers it is the best shell that we can get and it is a reverse
shell over TCP connection.
You can change this if you want to.
And down here, we get the options that we need to set for Paillot.
Remember, once using reverse shell, we must listen on our clinic's machine for the incoming connection.
And that's the information that it asks us right here.
The host is our own IP address, the IP address of Linux machine, or as it says right here, the listening
address.
We specify our IP address right here.
So you just need to type pseudo.
I have config and we can see 192 of the 168, that font that nine, usually the metabolite framework
will set it by default.
So let me just clear the screen transcriptions options once again.
And the airport is the listening port or Calladine export that we want to listen for the incoming connections
and it is usually set by default to be four four, four, four.
And all of these options you can change.
For example, if you notice that metal plate framework set the incorrect IP address for a Linux machine
you can type set and then the parameter name in our case will host to be a different IP address.
For example, 192 of the 168, that one that 15.
And it will set the parameter to be a different IP address, as we can see right here.
Inside of these are hosts, as we can see, this is also required we would set the IP address of our
target machine.
So let's say we had the Windows Server and its IP address was 192.
Of the 168, that one that 20, we would type it right here.
So why don't you do that 168, that one at 20.
And if we type show options once again, now, we got this set as well.
Now, payload something that you can change usually you want to leave it.
What matters framework already gave you?
Because the default one is usually the best one, but sometimes some of the payloads will not work and
others will work.
So in order to see all of the available payloads that you can use for this particular exploit, you
can type show payloads once again.
Just this time it will not list out all the 500 possible payload.
It will only start the possible payload for this particular exploit.
And this will be all the Windows payload.
Since we are attacking a Windows machine with this exploit, the Windows payloads will be something
that we can use so we can see some fine shells, reverse shells, we can see some of them interpretor
shells.
So, for example, let us say that you don't want to use our version.
You want to use a Bindiya.
How would you change the payload?
Well, you would copy the bind shell.
Let's say we want to use them better.
Financial scope, its name.
And go all the way down and type set payload and then paste the payload name to paste selection press
enter and it will tell us the payload has been changed if we clear the screen show options.
We will see different payload.
We no longer have the reverse DCP.
We now have defined TCP interpretor and it will also ask us for different information about the payload.
We no longer get the host since.
Remember with Binti, it is not our Caledonius machine that is listening for the connection.
It is the target machine that is listening for the connection and we are the ones that connect to it.
So in this case it is asking us for our host or the remote host or as the description says, the target
IP address.
So we would select right here the same IP address that we select right here, because it is the target
that has to open the port and the local port will be the local port on the target machine that will
open for us to connect.
And you would select here whatever you want.
So what is important to get out of all of this is that we can change different options using said combat
soldiers typeset and then, for example, want to change the airport.
We type airport and then make it whatever we want.
And if we type show options, it will be changed right here.
And the last part that we see down here are the targets and these targets right here are all of the
vulnerable targets for this particular expert to list all of them out, we can type, show and then
targets.
This will give us a list of all the targets that we can exploit using this attack.
So we get Windows and Windows XP and now different versions of Windows XP and Windows two thousand and
three.
So this is an older exploit that attacks Windows XP machines.
Now, you can either if you know exactly which version of Windows is the target running, you can select
it right here by specifying set target.
And then the number, for example, let's say Target is using Windows XP, XP one English.
You could type it like this or set Target three, because the ID for that particular version is three.
Or if you didn't know exactly which version, you would just leave it on automatic, which means that
the framework will figure it out on its own.
So we don't need to specify it.
The only important thing is that it is one of these versions.
If it is, for example, of Windows seven machine, this expert will not work.
And once you set all of these options, the last thing you need to do is type explained.
In our case, this will not work because we don't really have a vulnerable Windows XP machine.
So it will give us an exploit failed error.
In this case.
It is unreachable because this IP address right here on my local network is not even online.
That's why this will not work.
And this is pretty much it now, there are other commands as well that could be useful, but these are
the main ones that we always use to choose experts and payloads and to set their options.
Finally, the time has come.
In the next video, we're going to play what we've learned for now to perform our first exploit on the
anticipatable machine.
See you in the next video.