-: Welcome back,
In this video we are going to cover
and talk about misconfigurations.
And also in this very video we will cover the
easiest possible vulnerability that you could ever find.
You might have already noticed it
while always can as portable, and if you didn't.
I will give you a chance to find it right now.
So what I did right here is, I performed a version scan
on the Meta Displayable virtual machine.
You can do the same, or you can just take
a look at the results right here.
And do you by any chance see something that
sticks out right here, something that shouldn't
be here? Now you should be able to figure it out
based on what we learned for now.
So I will just give you a few seconds.
And time has come.
Have you managed to find it?
It is this bind shell right here.
And under diversion it says meta exploitable, root shell.
I mean just by its name.
We can see that something doesn't seem right.
We know what bind shell is, right?
So if this service doesn't have any type of authentication
we can just try to connect
to this port that hosts this bind shell in case
port 1524 over TCP, and we will be given our route shell
on that machine.
Can't be that easy, right?
Well it is, and I wouldn't even consider this an expert.
This is just an example
of what a misconfiguration could look like.
Now this would be a critical misconfiguration
that would almost never happen,
but sometimes even stuff like this can happen.
Maybe an administrator set up something
like this so he can access that machine
from his home or from somewhere else
but he forgot to put authentication on it.
You never know.
Okay, so how can we establish connection to this port?
Well, we won't be using Mattis Plate framework
for this particular thing.
Instead we are going to use a tool called Netcat.
And Netcat is a program that allows us to establish network
connections with other machines using both DCP
and UDP to run the net cat help menu, we can type
NC - H, which stands for help.
And here we can see menu is isn't that big at all.
It only has a few options right here, and at
the beginning of the menu we also got
these two main options.
We can either connect to somewhere, or we can listen
for the inbound or incoming connections.
Since our Met split able target machine has a bind shell
that means we must connect to somewhere and the syntax
is just nc, then the host name, or
the IP address, and then the port.
Let's try it out.
If I go down here and type nc
and then the IP address on my meta disposable,
I go and check
out over which port is the bind shell being hosted.
It is over port 1524 and I will type space
and then the port, or let me just clear the screen first
and type and nc 192 at 168
at 1.5 and then space 1524, press enter and it worked.
We are again our route account
on the method exploitable machine.
And as in the previous video, we can do anything we want.
See if I type who am I, we can see we are the root account.
LS tells us what directories we have.
And remember the test directory from the previous video.
Here it is.
I config will give us the IP address
of the method exploitable machine.
So everything works as in the previous video
We are root count
and we can execute the commands on the target system.
Now don't get used to this type of exploitation.
Matter of fact, I won't even consider this an exploitation
because the vulnerability wasn't in software.
But in a person who would set something like this up
without ever authenticating.
stuff like this, rarely happens.
But I wanted to show you this just to see
whether you will notice it in our scan.
In the next video we're going to check
out another quick vulnerability that is based
on information disclosure.
After that, we're getting slowly
into harder and harder exploits.
See you in the next video.