In this video, we'll take a look at exploiting vulnerable
machines such as Windows and Linux
space operating systems. So let's iPhone in
firstly let's get started with compromising our
Linux virtual machine.
To get started with this exercise, please. Enjoy your Carly
Linux virtual machine is already powered on and ensure
that your metasploitable to
virtual machine is Portal as well.
So currently you can see my metasploitable 2 VM
is running in the background
now let's open the terminal on Kali Linux
like so
let's perform a ping scan to determine the
IP address of our Target system, which is
metasploitable too type and map Dash
SN like so this I
will scan our entire network again and we'll exclude
ourselves during the scan.
We can see that our Target system, which is metasolito 2
is online.
So let's copy this IP address and next.
Let's perform an nmap
scan to determine what services and ports
open on our Target.
As you can see we perform a port scan on
our Target system and there are many open ports.
We can even proof file the operating system.
So let's type clear, press up a
few times and let's use a dash e
syntax. This will perform operating system
and even solution enumeration Force.
Great softly a few seconds. The scan
was completed.
Let's scroll back up.
And here we can see while they are
open ports on the service will also able to get a
service version.
We will also able to get a bali information
for various Network Services data running
on the target system.
For instance. If you look at CPE it
says it is running illusion of Lennox
or a flavor of Lennox. So great.
Let's scroll back up.
And let's use this service version.
So let's copy this.
Let's head over to Google.
Let's paste it and let's type vulnerability
like so so great.
Currently we can see rapid 7 has this
close a vulnerability for V sftpd
version 2.3.4
with specifies some type
of back door command execution. Let's open
this.
We can see when the information was closed.
When it was created I can get
a full description on exactly what this
vulnerability does fuss. Screw. No
you want further we can even see how to
use the metasloid module to
compromise the target system. So now that we
Harvest information let's head over back to Kali Linux attempt
to exploit our Target system.
Firstly let's type. Msf console like
so
press enter and this will start up the Metasploit
exploitation development 3mucrose.
Great.
Since Maris Floyd has hundreds and even thousands of
different modules.
It's kind of hard to go through each one individually. The
cool thing is Metasploit contains
a search feature. We can specify the
Search Command followed by the keyword.
Let's use v sftpd as
our keyword and press enter.
Currently we can see it already found a
match. This is an exploited module for you. Next
V systems that are running the FTP Service, but
specifically vs. Ftpd.
We can see the disclosure date. The rank is
excellent and in a description.
To use this module. Let's copy the
entire module name.
Let's type use specified by the
module name like so
now we can see our proper change a
little bit.
If I type options we can see all
the required options that are needed to
ensure that this exploit.
Is delivered successfully to the Target?
Currently we can see the ruse is missing. There
isn't any settings here. So let's type set
are whose like so and specify
the IP address of our Target system?
Great, let's type options one more
time.
I can see now the target IP address is set.
When you're ready simply type exploit.
This will simply tile Metasploit to
push this exploit code to the
Target system, but specifically on the remote Port
21 and if successful we will
gain a bind shell.
Let's see what happens.
Are great.
So it says it has found a shell.
But we don't see anything up here
on the screen. However, we know is shallows created.
But this type of Shadows are buying shell.
So what can we do? Let's type. Who am I and see
what happens?
Okay, we type. Who am I the result is
root?
But we don't see the Linux command prompt.
or the Linux terminal
to get the Lennox
terminal or let's see the command line
interface we can use the following python
code.
Let's hit enter.
And greet now. We have a sort of terminal like interface.
But any commander to enter here, it
will execute on the target system. So now
that we have compromised the metasploitable 2
Target system. We are going to take a look at
exploit and common security weaknesses found in
windows-based operating systems. So, let's Dive
In
To get started. Please ensure your Kali Linux
virtual machine's powered on and ensure metasploitable
tree Windows Virtual Machine
is up and running.
As you can see on my virtualbox manager metasploitable
tree Windows VM is
running in the background. Excellent.
So now let's open the terminal on Kali
Linux like so
and let's perform a pink scan to
the two men the IP address of our Target system.
Which in a few seconds the scan will complete and provide
us with the IP address of our Target.
Currently we can see our metasploitable tree windows-based
Target system. It has the
IP address of 172 tt1 TT. Simply
copy this IP address.
Next let's actually perform some
end map vulnerability scanning
to determine if there's any sort of particular security weaknesses
found on this target.
Let's perform a port scan using and map to
determine what a silver message block is running on
this target system.
To perform the port scan simply use nma -
B and let's specify the various ports
for SMB which is Port 1 36 we
specify comma actually let's do
- 1 to 89
comma and Port 445 so
and maple simply scan Port 136
137. Wanted to eat
one 39. I got four four five on our
Target system.
Specified IP address of the target system
like so and hit enter currently we can
see a few ports are close, but we have a couple of
ports that are open which is ports 1:39 and
Port 445. So
excellent. Now, let's use Metasploit to
perform a vulnerability scan
on the target system.
So on your terminal simply type msf
console like so and press
enter to launch, Metasploit.
Great once when exploit is running let's use
a switch command and let's search for
any modules that is related to ms-17 -
0 1 0 this is commonly known as a very
popular Eternal blue vulnerability that is
found within many Microsoft Windows base operating
systems, simply it enter and we
can see it found five modules a few
of these modules. I exploit modules and one
or two seems to be auxiliary scanners. Let's
firstly use an auxiliary scanner
to determine whether our Target system
is vulnerable or not to eat.
Tuna blue simply copy.
auxiliary scanner SMB SMB
ms-17010 like
so
Next let's type use followed by
the name of the entire module.
Great, let's type options to see what options and
settings that we need.
Currently we need to set our remote host
or our targets IP address.
Since that in this portion of the video will be performing multiple
exploits on the same Target. Let's set
the target IP address using the
global command. Let's type set G and this
will allow my display to keep the
IP address that we set so we don't need to reconfigure it
for each module that we are going to use.
Let's specify our host like so
let's specify the IP address.
Great.
When you're ready simply type run and hit
enter.
And just like that within a few seconds metasploy tells
us. Hey, the who's is likely vulnerable
to ms-17010. Most importantly
the remote hosts is a Windows Server 2008
R2 standard and the bill
number is 7601 that is
running. So spark one and the architecture is
a 64-bit operating system. So great. We
have already found a security weakness within
the target system.
Let's dive back.
And now let's use day2inal blue
exploit module.
Let's type use followed by
exploit Windows SMB. Ms-17010 Eternal
blue like so and press enter.
Create let's type options one more
time.
I'm currently
if I scroll up just a bit.
We can see the target is already set. The
remote Port is automatically set.
And most importantly it automatically set
a p load.
So why do we need to copy peel with an exploit? They exploit
is simply the thing that we use to take
advantage of a security weakness. The peel load
is delivered after a system is
exploited. For instance. The exploit is
going to break into the Target and a p load is going to provide us
with a reverse shell connection from the target system
back onto our Kali Linux. Which one machine.
Sounds great.
And sure that your local whose IP
set correctly and this IP is IP address
of your Kali Linux virtual machine. If the
IP address is incorrect, you will not obtain
a review shell.
Once everything seems accurate when
you're ready, simply type exploit like so
and hit enter.
Currently we can see the exploit has been pushed to
the Target system and in just a few seconds. We'll see
the p-load is being pushed onto the target as
well and will obtain a review shell.
And great guys. We have obtain a
meter session. In other
words. We have a review shell on a Target system.
So what can we do? Well, we can do many
things. Let's type help to see what syntax
or what command so what we can actually
do while we have this review shell.
Let's screw up just a little bit.
Here, we
have a lot of core commands that you can execute and there's
a description.
There are files to some commands that will allow
you to navigate the file system on the victim system. There's
some networking commands system commands.
There is some user interface commands.
You can even tune on awe calm and even
tune on the microphone on the target system. You can
even play all your files from Kali Linux and later
audio be output on the victim system. You
can escalate privileges you can retrieve the
sound file you can do so many things but let's
keep it simple. Let's type system full on
this very phies the information from the
target system.
So this command was remotely executed in
the memory of the victim system and
it provides us telling us. Hey, the
target computer name is vagrant 2008 R2
the operating system. It's a Windows
2008 r2r operating system and a
lot more other details.
So now that we have a first review Shell, let's
attempt to compromise on another
security flow within the same operating system.
So do we close this shell? Well,
we don't have to we could run it in
a background. Let's type background to send this
shell in the background.
I'm currently we can see it is Mark
growing Session 1 let's say back.
So, how could we interact with our
sessions? So how do we know if you have additional sessions running?
We could simply type sessions like so and it
tells us a session ID.
It tells us a type of session.
It tells us information and the
connection.
So for instance, we could type session like so -
I for interactive and type
1.
And just light up we are now interacting with
our Session 1. Let's say background one more
time. So we will leave it in a background.
Great. So now let's open another terminal.
click on Terminal icon like so
and let's perform another and map scan but
on the same Target.
Let's determine if the windows Remote Management
Service is running on a Target
system. So that's the end map Dash p.
and let's actually do Dash capital e
Dash p dash pure specify ports Let's scan
for Port 5 9 8 5.
This is a default port
for the windows Remote Management Service on
Windows operating systems.
Let's specify our Target IP address like so
and press enter.
This gun should take a few seconds to Pops
a minute to two to complete.
Currently the scholars finish we can see the port is
open.
We can see the service type is each
TDP and his running on Microsoft services.
So great. Let's attempt to
exploit.
Or let's attempt to identify what it is a security weakness on
the service unexploited.
So now let's head over back to Metasploit.
And let's switch.
For win RM or any
modules are contains when RM?
And grid currently we have an auxiliary scanner, which
is auxiliary scanner when RM when
RM command. Let's copy that module.
Let's type use.
Now, let's specify the module like so and hit
enter.
Let's type options to see what options are
needed.
and currently
this module will simply allow us to execute commands
or Windows vs commands on a
Target.
For instance we could change this.
Current setting here CMD and currently the
default is surrender ip config slash all command.
However, we need a specify the domain
if it is connected to our domain or not. We need
to specify a password on a username
to log into this system.
Let's type set.
Username like so let's specify the
username as administrator.
Next let's specify the password.
as vagrant
like so
Next let's specify the Target. And actually
the target is already set.
When you're ready, let's type on and see what happens.
And we got an error.
Let's type options to determine if all our settings are
configured correctly.
We have the command set the password the remote
targets IP address the port
number.
And the username is already set.
Let's type around one more time.
And we seem to be getting some type of error.
So the thing about break it into systems sometime
an exploit more you'll be me work
or it may not be so let's try another exploit
module for compromising the
win RM service.
This time we are going to use an exploit module rather
than an auxiliary scanner.
Let's type use.
And let's use this particular module, which is exploit Windows
when RM service by running script
exec. Let's hit enter.
to use this module
Let's type options to see what options are
needed for this exploit module.
Currently we need to set.
The username on the password. However, the remote
host IP addresses are already set
and our local IP set
on the p-loot portion of the exploit
module.
So let's set the username. Let's reset G.
administrator like so
and let's do such G.
password
and a password is vagrant.
like so
next let's do set.
boss
underscore
VBS
and set to true
great.
Let's type options one more time to determine or
if all of our settings are configured correctly.
Or if we are missing anything.
And everything seems to be in order.
So excellent.
When you're ready simply type exploit.
and hit enter
and it's seeing the username.
Seems to have a validation problem.
Ah, the username is not set.
So let's do set.
G username
administrator
like so
Let's type options one more time to determine it
is set correctly and as you
can see.
The username and password is set.
Great.
Let's type exploit once more.
And now you can see it is pushing the P load
in various stages. And once this is complete we should
be able to get a second review shell from
the target system back to our machine.
Currently we can see the stage is being set. The
p-load is being push. We have a methylpredo session
2 that is opened.
from the target system back on to
our Kali Linux social machine
and we have the metropital Shell. Let's type
this info.
And we can see we are now connected to the
Target system. Excellent. Let's dive background.
Let's type back once more.
And now if you type sessions like so we have two
interactive session between our Kali
Linux solution machine on the target
system.
In the previous section Section 3 exploring scannon on
enumeration. We took a look at performing monogramming
and finding security weaknesses in
Target systems using Boot and map are necess.
The thing is before you can perform any sort of
exploitation. There's a lot of research that needs to go
into Finance security weaknesses and finding
we can exploits as you can see during this
video. Some of the exploits did not work
simply because perhaps a Target system is patch
and contains security fixes to prevent
those type of security attacks while exploits
me work on one system. It may not work on
another system. This is the thing about paying SRI
chantastic and ethical hacken. It takes a lot of dedication and
thinking outside the box to find
working exploits or you want to develop your own exploits
to break into Target systems.
During the course of this video you have little
to use my display to exploit various security
weaknesses found in both Lennox and windows
B systems.
In the next video, we'll take a dive into performing password base
attacks. I hope this video has been informative
for you and I will see you in the next one.