Welcome back.
In this video, we're going to cover and talk about misconfiguration and also in this very video, we
will cover the easiest possible vulnerability that you could ever find.
You might have already noticed it while we can.
Anticipatable.
And if you didn't, I will give you a chance to find it right now.
So what I did right here is I performed operations can on the anticipatable virtual machine.
You can do the same or you can just take a look at the results right here.
And do you by any chance see something that sticks out right here, something that shouldn't be here?
Now, you should be able to figure it out based on what we learned for now, so I will just give you
a few seconds.
And time has come.
Have you managed to find it?
It is this find shell right here.
And under the version it says matters, potable water shall I mean, just by its name, we can see that
something doesn't seem right.
We know what Biechele is right.
So if this service doesn't have any type of authentication, we can just try to connect to this port
that hosts this potential in case Port one five to four over Tsipi and we will be given a road shell
on that machine.
Can't be that easy, right?
Well, it is, and I wouldn't even consider this an expert.
This is just an example of what a misconfiguration could look like.
Now, this would be a critical misconfiguration that would almost never happen.
But sometimes even stuff like this can happen.
Maybe an administrator set up something like this so he can access that machine from his home or from
somewhere else.
But he forgot to put the location on it.
You never know.
OK, so how can we establish connection to this port?
Well, we won't be using metal framework for this particular thing.
Instead, we're going to use a tool called Net Cat and Net Cat is a program that allows us to establish
network connections with other machines using both Tsipi and UDP to run the Net Cat Help menu.
We can type and see Desh H, which stands for help.
And here we can see menu isn't that big at all.
It only has a few options right here.
And at the beginning of the menu, we also got these two main options we can either connect to somewhere
or we can listen for the import or incoming connections since our anticipatable target machine has a
bandshell, that means we must connect to somewhere.
And the Syntex is just and see then the hostname or the IP address and then the port.
Let's try it out if I go down here and type and see and then the IP address on them anticipatable,
I go and check out.
Over which port is the Biden show being hosted?
It is over port fifteen, twenty four and I will type space and then the port or let me just clear the
screen first and type and see pointed to the 168 ad funded five and that space one five to four.
Press enter.
And it worked.
We are again, havruta count on the political machine, and as in the previous video, we can do anything
we want.
See, for type two, am I look and see if we are different.
Account Less tells us what directorate's we have.
And remember the test directory from the previous video.
Here it is.
I have config will give us the IP address of the matter.
Split the machine.
So everything works as in the previous video.
We are route count and we can execute the comments on the target system.
Now, don't get used to this type of exploitation.
Matter of fact, I won't even consider this an exploitation because the vulnerability wasn't in software,
but in a person who said something like this up without ever authenticating stuff like this rarely happens.
But I wanted to show you this just to see whether you will notice it in our scan.
In the next video, we're going to check out another quick vulnerability that is based on information
disclosure.
After that, we're getting slowly into harder and harder experts see in the next video.