‫So the scan is completed in 17 minutes.
‫Now, another pause here because I disabled the Windows plug ins.
‫It seems as if the Windows systems don't have critical vulnerabilities.
‫It's not right, especially my Windows XP has several critical vulnerabilities.
‫If you didn't disable Windows plug ins, you're supposed to see some more vulnerabilities for Windows
‫systems.
‫Now, to see the results of the Metasploit will scan in detail.
‫Let's click the US voidable results two zero six.
‫The home found 10 critical vulnerabilities with her skin configuration, but please note that the configuration
‫affects the results, so the target systems may have more vulnerabilities than reported.
‫If there is a vulnerability and it's not found in the scan, we call it a false negative.
‫I'm sure you know that the critical vulnerabilities are the most dangerous ones, but that's where it
‫gets good.
‫They are the most exploitable ones in general.
‫So let's click on one of these critical vulnerabilities, for example, being shown back door detection.
‫Well, look at the description, it says a shell is listening on the port without any authentication
‫being required.
‫This is obviously a back door.
‫Here's a port number of 15 24.
‫Now let's check of the finding is a true positive go to terminal screen.
‫I use net cat tool to connect.
‫Simply type and see.
‫And the target IP and the target port 15 24 and we're in.
‫We have the shell for Metis voidable.
‫Type, who am I to learn the credential we have, we are the user.
‫Now it was too simple.
‫It's just not fun and you know, I don't like it.
‫I like a good challenge, right?
‫I mean, we are the root user and we can access anything we want.
‫For example, Shadow File, which contains the hashes of the user's passwords.
‫OK, back to the browser and click on the Back to Vulnerabilities link to turn back to the vulnerabilities
‫of Metasploit.
‫Now I'd like to show you some more.
‫Scroll on down.
‫The vulnerability, it shows 50 vulnerabilities per page by default, but let's make it 200 to see all
‫the findings in a single page.
‫Now, the findings are ordered by severity levels.
‫So information is at the bottom.
‫Findings with a severity level of information identify non vulnerability information, which is, you
‫know, nice to know, and it keeps it separate from the vulnerability detail.
‫So here there's an info army registry detection.
‫Let's click it.
‫It says that the remote host is running an army registry, retrieving remote objects in the Java runtime
‫method invocation system.
‫So let's look for the exploits of the Metasploit Framework.
‫If there is any exploit for Java Army.
‫Opening terminal screen and run MSF console.
‫So here we have MSF console, let's search the exploits of our Am I.
‫Too many results.
‫To keep it more specific.
‫I want to search Java or am I?
‫So we have two auxiliaries and two exploits at this time.
‫So look at the exploit in the last line.
‫This module takes advantage of the default configuration of the Army Registry and Army Activation Services,
‫which allow loading classes from any remote URL.
‫Let's try to use it on our army report.
‫Please don't worry, I am going to explain what these all mean.
‫I just want to show you an example at the beginning.
‫So bear with me type, use the module name with the full path.
‫You can simply select the module name and click the middle button of the mouse to copy and paste it.
‫Type show payloads to see the payloads can be used with this module.
‫So I want to use this payload to have a Net-A-Porter session.
‫Again, don't worry, I'll explain what the interpreter is soon.
‫But just copy and paste the payload name type, show options to see the parameters of the exploit and
‫the payload as well.
‫Set the remote host as Metasploit able to zero six default remote port is the same with our port one
‫zero nine nine.
‫Serve Host is a local host to listen on set this to be our collie to to to.
‫But the Vault Surf Port Remain.
‫So the other options are not required.
‫I'll just leave it blank.
‫Now are the payload options set the listen host to be our colleague?
‫01:58 Default Listen Port is good for four, four four and finally type exploit to run the exploit.
‫So there it looks like we have a maturity session.
‫Type sessions dash l to list the active sessions.
‫Be patient.
‫We'll see them in detail type session Dash II Session ID to interact with the session.
‫And here we are.
‫We're in now.
‫I'm going to show you what we can do with him.
‫Interpreter session in the following chapter.
‫But here's a couple of Metro operator commands.
‫This info to see the system information.
‫Hash dump to gather password hashes.
‫Now, no such command for this system, thankfully, we have an alternative for this type run post slash,
‫Linux slash, gather slash, hash dump and hit enter and collect the fruits of your labor.
‫So as you see here, we found another way to exploit the system, even though the finding was just information.
‫So I hope you understand not to underestimate any finding.