Welcome back.
Let's continue with exploiting government's political machine, so we already found three vulnerabilities
regarding Telnet, FTP and the shell with no authentication.
Let us see what else can we find and what they got in mind for now is this Sambor open port right here.
Matter of fact, these two open ports, one three nine and four, four, five.
Why then?
Well, because it seems that we do not have the exact version of Sambor right here, it tells us that
Sambor is between three point something to four point something.
So let's see how we will figure out what to use and how to find it.
Here's a small hint we don't need to Google it to be able to find it.
We have everything we need right here in clinics, so don't use Google to find it since it is cheating
and you will most likely find it on the first link.
Let's see whether we can figure it out by ourselves.
So right here in our can we have this Sambor version right here?
Not the exact version, but it does give us some information about in between which range does the version
belong to.
And that is something we all see that supports hosting.
These are one three nine and four four five.
So we do get some information what now?
Well, let's just search Semba inside of search flight and see what comes up.
So I got this right here.
I got my MSF counsel right here.
And I will open a third terminal and type Searsport Semba.
Well, it seems that we get a lot of results and these are exploits for a bunch of different Senba versions,
as we can see right here.
Now, if we could just try all of them out to see whether they will work or we can try to figure out
the December version first and then narrow down our expert search and see whether we find something
for that specific version.
So how are we going to find out the samba version of and Mexican didn't manage to do it?
Well, luckily, and map is not the only scanner that we can use for these types of things.
Remember that in metal framework, besides having all of these experts and payloads, we also get those
auxiliary modules and those auxiliary modules can sometimes be scanner's.
Let's search and see whether we can find a scanner for this, if we just type in demetris search sambar
and press enter, we get some of the results right here.
Matter of fact, we don't get a lot of the results.
Once again.
Some are experts, some are auxiliary modules, and down here, I believe there is one post exploitation
module and if we go to the auxiliary modules, it'll only give us two auxiliary scanner modules.
These aren't the scanners that we need.
Let's try to find it ourselves.
If I go down here, clear the screen and type use auxillary and then we search for a scanner and then
SMB because that is the port that we are enumerating and then type device.
These are all of the available exhilarate scanners that we have for Sambi.
The one that we are particularly interested in is this assembly version, so let's scope it if I copy
the entire comment right here, paste it.
Let me just delete this, we type the comment twice, so use auxiliary scanner assembly and then some
version and if we type show info right here.
It will tell me in the description, this version information about each system.
This looks like something that we need, let's type all of the needed information for this to run,
so we are going to type show options first and we require our hosts.
We got some other things as well.
But these three things are not required, as it says right here.
The threats will go live on one and the other hosts will be the IP address of our anticipatable.
In my case, when I do that 168 that one that night, I will set this straight here.
And if we run it.
Well, it worked, even though it says right here he could not be identified in the brackets, we get
the exact Semba version on the anticipatable, which is three point zero point twenty.
Cool.
Let's see what we can find from experts now that we know what version it runs.
So we'll copy this three point zero point twenty and go back to my search point, clear the screen and
type it once again.
Just this time outpaced the entire version.
Press enter and we managed to narrow it down to only five results.
And it seems that these two are the same results.
So it's actually four results in total.
The first one seems to be some type of a security bypass, and it affects our version since it's between
three point zero point ten and three point three point five.
But it also seems to be a text file, which we really don't want to bother with right now.
We want something that we can execute right away.
The most interesting thing we have right here is this Sambor username map script or the command execution.
Why?
Well, it's a ruby exploit and it also belongs to metal plate framework.
Plus, it also affects our version of Sambor, as we can see right here.
These two down here are also text files not really interested in.
And they also don't seem to actually affect our version.
They only affect the versions below our version.
And the last one, which is denial of service or DOS attack, seems to be affecting our version.
But we are once again not interested in the denial of service attacks.
But in a real penetration test, you would 100 percent write this on the report with the references
to the possible attack.
For now, let's just go with the math module that we found.
Let's remember the name, username, map, script, command, execution.
And if I search once again.
In my mad despite search Semba.
Let us try to find the expert that we found using search split, if I go up here, go through all of
these results.
And here it is under the 13 exploit multi user map script command execution.
This is the same script that we saw right here.
If I copy the script name, so exploit multimember user map, script and type right here, use then
page the script name.
It will set the default ballot to be command Eunuch's, reverse Nethercutt, and by the way, this Malti
right here means that it can be targeted on multiple operating systems while as if you had only Windows
or Linux specified right here.
It would mean that only that specific operating system is vulnerable to this attack.
So let's show information about this, exploit Allfirst, clear the screen and type show info and it
will tell us this module exploits a command execution vulnerability in Sambor versions three point zero
point twenty through three point zero point twenty five when using the non default username map script
configuration operation.
And if I also setup all of the things that we need to show options, it seems that we need one thing
which is the our hosts.
So let's set it up right away.
This is the IP address on Anticipatable the port right here.
We do not want to change since it is already set correctly.
As we can see right here, Port one three nine is running sambar and down here is our payload, which
is the reverse kit.
We said the IP address of our clinics machine here and any port that we want, once all of this is ready,
we can run our exploit.
And here it is, we once again got Shell opened on target system using Sanba vulnerability, and we
can, as usual, execute commence if I type, who am I?
It will tell me we are rude.
So we are already has privilege on that machine.
Great.
This is the fourth vulnerability we found to close the connection.
We can just control c this.
And click on Y and you would write this down as another successful exploit, if this was a real penetration
test in the next video, we're going to cover a different type of the attack that we haven't performed
yet, which is brute force attack on Port S.H..