-: Okay, it is time for a small challenge.
We can say we are getting more
and more familiar with MSF Console and Exploitation and
by now you should be familiar with the entire process
of searching for a vulnerability and trying to exploit it.
Let's put all of that to the test.
So for now, we covered about four to five vulnerabilities
on the Meta Exploitable virtual machine.
And what they want you to do
in this video is find three different vulnerabilities
that will give you a shell back on the target machine.
You can use any tools that you want besides searching
for links that will give you the exact steps
to exploiting the vulnerability.
And feel free to use Google
if you want to to see if a software is vulnerable.
You can also use Search Exploit to see
whether you have exploit in your database.
You can use Nmap to scan
and metasploit framework to exploit.
After we do this challenge, we are ready to move
on to some harder Windows exploits.
And after that we're going to see how to exploit the target
without using MSF console and
without having an exploit available
inside of our Calix machine.
Okay, great.
So pause this video right now.
Give yourself 10 to 20 minutes
and try to find three different vulnerabilities
on the Meta Exploitable that will give you a shell back.
I myself will do it right now.
So if you don't want me to spoil it for you
then try to find them first and then watch this video.
The harder part is to find them, however
once you find them it is easy to exploit them.
Let's get straight into it.
Let's start by scanning the target
for all the open ports and its services.
So what I'm going to do is I will perform the usual
Nmap version scan on my Meta Exploitable
and WS dash P dash which stands for scan all 65,000 ports.
If I press here enter, enter my password.
And by the way, of course the vulnerabilities
that we covered don't count at the moment.
We will not pay attention to them at all right now.
We want to find new vulnerabilities.
So while this scan is working, I will go
to a second terminal and I will start the MSF console
and I will also open a third terminal
in case we need something like a search exploit
or some other tool to run right here.
So the goal is to find three vulnerabilities.
Let's see after our scan finishes
whether we manage to do so
and here are the results of the scan.
So we got bunch reports open as usual
and let's go and pick any one of them.
For example, I know for a fact
that this this C open port which is 3632 is vulnerable.
It is running this C version one.
And if I go to my meta split framework
and I just type search this c
I will only get one exploit available.
This C execute or Daemon command execution.
It is ranked excellent.
So since this is the only exploit
let's give it a try, I will copy it, I will type use
and then paste the exploit name, clear the screen.
We can show info just to know what this exploit does.
And it says that this module uses a documented
security weakness to execute arbitrary commands
on any system running this c cd.
And our system is indeed running this ccd.
So what we are going to do is we are going to
type show options and set the R host to be the IP address
of our Meta Exploitable.
Let's see, show payloads.
So we got quite a few payloads right here.
Let us use this one.
Cmd Unix reverse.
So this is reverse DCP or telnet.
Let's set it right here.
Since at the moment if I show options,
we don't have any payload set up.
Let's set payload, cmd, unix
and then reverse, show options once again.
Now we need to set the L host.
So I will type sudo if config enter my password,
my IP address is 192.168.1.8
Let's copy it and let's set
our host to be equal to that IP address.
Now if we triple check all of our available options,
we should be good to go.
Let us run our exploit, and here it is.
First one is over.
We got the command shell session one opened
on the target machine.
If I type who am I?
We're Damon, If I type LS or print working directory
we are in the slash TMP directory.
Host name command will tell us that we are metasploitable
and your name dash A will tell us
that we're Linux metasploitable 2.6 point 24.
And here we also get some other information such as date
and which version of Linux it is.
Great. So first one is done.
Let us control C this, abort session one, select yes
and let's go back to our scan to find another vulnerability.
So if you remember during our scans, once you
perform the vulnerability scan, we noticed
that this Unreal IRC was vulnerable.
We got from some of our scans result that this
specific service is vulnerable to some type of the attack.
So let's give it a try.
Let's go to our search exploit and type searchsploit irc.
And this gives us a bunch of different information.
So this isn't really useful for us.
Let's try it like this.
Let's go to our scan and copy Unreal RCD
which is the version.
And now if I type searchsploit and the name
of the version, well we narrow it down to four results
and one of them doesn't count since it is remote denial
of service.
Out of all of this we got one Ruby Exploit
which means it belongs to Metasploit framework.
It is for version 3.2.8 and it is backdoor command
execution. Let's search it inside of our Metasploit
framework. So search and then Unreal rc.
And we do get indeed only one exploit for this.
It is ranked excellent and it is from 2010.
Let's copy it
right here.
Copy selection and as usual, use this exploit
Show info will tell us
that this module exploits a malicious backdoor
that was added to the Unreal RCD 3.2.8 download archive.
So as it says
this module will exploit some malicious backdoor
that was added in this specific version.
And if we show options, we need to set the R hosts as
in the previous exploit and we also need to set the payload.
But before we set it
let's show our available payloads first.
Show payloads
pardon may not show options
and we get the same result as previously.
So we are just going to go with the reverse DCP over Telnet
and if I type set payload and then paste the payload name.
Now we need to set the L host to be the IP address
of our Cal Linux machine.
And if we triple check our options, everything is set
type run and here it is, command shell session two open.
We got the second exploit down, let's check out if it works.
Who am I?
We are the root account.
Host name will tell us we are Metasploitable.
So this is the second one down.
We got one more left to go.
Let's control c this.
Go back to our scan.
And we are doing this really fast tempo
because we already are familiar with all
of these tools and techniques that we use
to exploit these vulnerable softwares.
If you didn't manage to find three different exploits,
don't worry.
This comes with the practice.
So after some time practicing you'll be able to
find even more than three exploits.
Let's continue on the third one.
So if we go down here and check
out what different services we got running this one
which is running over port 8787 running service drb.
I know for a fact that it is vulnerable,
so let's give it a try.
The service name is drb.
So if I type in my searchsploit drb.
Well we only get a few results right here
and it doesn't seem that any one
of them belongs to the Metasploit framework.
As we can see right here, since these are Python files.
So let's just double check.
Whoops, not here.
Let's just double check right here
if we can find something regarding DRP
and we do manage to find it.
So we got these two exploits which are
for the multi and we got this DRB remote code execution
and it says distributed Ruby remote code execution.
And if I go right here under diversion
we can see that it is running Ruby.
So let's just give it a try.
You never know if we copy
this exploit which says drb remote code execution.
And we use it right here;
Show our options.
We can see by default it has set the payload to be cmd Unix
reverse netcat and we got two different things to set up.
Matter of fact, one of them is uri
which is not really needed.
So we can only set our hosts
and for some reason it does say that our host
is not required
but I'm not really sure how it is not required.
So we will just specify it anyway.
Set our hosts 192.168.1.7
Since the payload is already been set
let us just run the exploit and here it is.
We got command shell session three open.
Let's type who am I?
We are root account.
And once again
host name will tell us we're Metasploitable machine.
And with this we completed our challenge.
We found three different vulnerabilities
that gave us a shell back, but these are not the only ones.
So matter of fact, let me just show you one or two more
that you could have found if you performed this challenge.
The one that is a little bit different to
exploit is this VNC service running on port 5900.
It is running Protocol 3.3.
And if we just search
in the searchsploit search bnc, oops, search exploit vnc
we will get bunch of the results right here.
So let's add the version 3.3
and we do get some of the responses right here
but it does say that these are for Windows.
Now we are not going to give up just
because we cannot find the exploit using searchsploit.
Matter of fact it probably is somewhere right here
just there is a bunch of result and we don't really want
to read through all this to find the exploit that we need.
So let's just go straight to the metasploit and
type search vnc.
And if I scroll all the way up
since these are just payloads I come to exploits.
We can see there about five
or six exploits and these four are for Windows.
So we can forget about them straight away.
We got this one and we got this one.
This one seems interesting.
It is an exploit
for multiple operating systems for vnc,
And it says vnc keyboard execution.
So let's just copy the name and see whether it works.
Now this is just a part of penetration test.
If you don't know an exact exploit, you simply
just try a few different ones and see if they work.
Just get used to it
that some exploits will sometimes not work
and you will have no idea why they don't work.
So let's just type set, or pardon me, let's just type use.
And then the exploit name.
And this seems that it isn't an exploit for us
since it is also setting the windows payload.
Hmm, we cannot find a VNC exploit.
So what are we going to do?
Well if I go right here and instead of searching
for an exploit, I simply just try to connect to D V and C
using a tool called vncviewer
And all I need to specify to connect to is the
IP address to that target machine.
Press enter.
Hmm, it seems to be asking for a password.
Well let's try MSF admin
which is the usual password for everything
in Metasploitable and it tells us authentication failure.
But if we try it once again and as a password
I simply just type password.
Well it worked.
The vnc viewer password was just password
and now I got root shell open on DME exploitable
I can execute commands right here such
as iconfig such as host name LS
and I can see anything that is on the target machine.
So this exploit was a little bit different because
it was due to a weak password.
I just connected to D V and C and I typed password
and it granted the access to the road shell
of the Metasploitable.
Great, to exit this I can type exit and I can
exit this desktop right here.
And let me show you just one more and then we
are going to end the video and that one is over port 1099
It is running Java rmi.
And if I go in my Metasploit framework and
search for Java underscore rmi,
well we get two exploits right here.
Let's try with this one first.
So exploit multi misc java rmi server.
copy the exploit name
go right here and type use
it will set the default payload to
be Java meterpreter reverse tcp.
Now this is the first time that we are
encountering a meterpreter payload.
You will see that it is a little bit different
than all the other shells that we got
in the previous exploits.
So if you type show options
there are a bunch of things that I need to set.
Our payload options has already been set to correct one,
to the correct IP address and to the correct port.
All we need to set right here is the r hosts.
You can just leave the server host
in server port to be 0.0.0.0 and 8080.
If I go right here
and type set r hosts 192.168.1.7
and I run this, well, here it is,
we got the meterpreter session for open.
And if you want to execute the commands
you can just wait for this exploit to finish.
And even though it says right here, exploit failed
if I type sessions, I will have the meterpreter session four
and I can enter that session
by typing sessions and then dash I
and then the ID of that session, which in my case is four.
And I've entered the meterpreter shell.
Right here the commands are different.
To check out all
of the commands that we can run with the meterpreter
we can type the help command.
And you can see it is split into different sections such
as file system commands such as core commands.
And all of these commands work with meterpreter shell.
We can download and upload files, we can execute a command
we can screenshare, we can perform a screenshot
of the target machine, we can record the microphone
and many other things that we're going to check out later.
But for now we can use a command called Shell to
enter the command shell with the target machine.
So if you type, who am I?
Once again,
right now I am a root account
with the IP address of the meta exploitable.
Great. Now I left this meterpreter shell
for the end just so we can slowly start getting
into using meterpreter shell on our target machine.
As we can see there is a lot
of the commands that we can run.
Now in the next video we're going to start
with Windows exploitation and in Windows exploitation
we are most likely always going to want to
open a meterpreter shell.
So that would be about it for this challenge.
Once again
if you manage to find three different vulnerabilities,
congratulations.
If not, don't worry. This comes with practice.
Now that we covered meta exploitable vulnerabilities
which were rather easy
it is time to move on to the windows vulnerabilities.
See you in the next video.