Instructor: Welcome to another attack
that we will perform on our metasploitable machine
and this one is aimed on telnet.
Keep in mind that this vulnerability is only possible
due to information disclosure and you will see
by the end of this video why.
So I got my scan right here
and we can see that the telnet is running on port 23.
If we check out the version, it says Linux telnetd.
That doesn't seem to give us that much
of information about the actual version.
If we just copy this version right here,
open another terminal,
we could just do the same thing that we did
with the FTP version.
So we could type searchsploit
and then paste the version name.
And it seems that we got two different results
and from looking at them,
they don't seem to be useful for us.
The first one says netkit-telnet 0.17
and it says in brackets that it's for Fedora 31.
And the second one doesn't seem to be something
we are looking for either.
We can't get the exact version of telnet.
So what are we going to do?
Well, we know that telnet requires username and password
in order to log in.
So let's maybe try the default credentials.
To try them and to connect to the telnet port
on some machine
we can type in our terminal.
Let's first clear the screen,
telnet and then the IP address of the machine
that we want to connect to.
In my case, 192.168.1.5.
And I press here enter.
Do you see it?
Not only do we get the banner for the telnet,
but we also get some additional information
that shouldn't be here.
We get this statement that says
log in with msfadmin/msfadmin.
And if you remember this banner
and these things are exactly the same as the banner
that we get once we log in to the metasploitable,
as you can see right here.
These two are exactly the same.
They just hosted the same banner
on the telnet open port as well.
So if they already gave us username and password,
let's use it.
Let's see whether it will work on telnet.
If I type msfadmin and msfadmin as the password.
Here we are.
Once again, we are on the metasploitable machine.
Just this time you will notice
that we are not root account, so if you type, who am I?
We are the msfadmin.
We are not the root account
and this is something that we can easily bypass.
If I type the command sudo su
it'll ask me for the password for the msfadmin.
And we already know it from the banner.
It is also msfadmin.
I type it in, press enter.
And now we are root account, as we can see right here.
And also if I type, who am I?
It'll tell me we are root account.
Now I know what you're thinking.
This is too easy.
Something like this will never happen in real life
and you are correct.
These types of vulnerabilities will rarely happen.
However, we are slowly processing to higher
and higher vulnerabilities.
The last two were just misconfigurations
and information disclosure,
while the first FTP vulnerability
had a vulnerable software running.
After we finish showing a few more vulnerabilities
for the metasploitable machine,
we're going to go on to the Windows machines
and you will see that we will manage to exploit them
without them having any additional softwares
like metasploitable does.
So things are soon about to get even more interesting.
See you in the next video.