‫Before going deep on exploitation frameworks, let's see how we can find and run and exploit manually.
‫Because it's not the subject of the course, I'll not show you how to develop an exploit.
‫But we are going to use the exploit from exploit databases.
‫So in this demo, let's say that we think that the target system has a massive three underscore 026
‫vulnerability to exploit the vulnerability will follow these steps.
‫First will search for the exploit MS 03 underscore 026.
‫Then compile the code if there are errors in the code.
‫We have to find and fix the errors or find another exploit.
‫And finally will run the exploit.
‫Now, if we're lucky enough, we can successfully exploit the target system and have a command show
‫on it.
‫So go to Carly and open a Web browser type exploit DB to search for the exploit database, I click the
‫first link, which is Exploit Divide.
‫Com.
‫Now click search at the upper right hand corner.
‫Right.
‫MS 03 underscores 026 in the search bar and prove that you are not a robot and like search.
‫We found three exploits in the database, so let's try the oldest one, which is developed by H.D. Moore,
‫who is the developer of Metasploit Framework, by the way.
‫So click the link.
‫And here's a source code of the exploit.
‫So let's download the code and save the code to Carly.
‫Now open a terminal screen and go to the folder where the exploit code is downloaded.
‫And here's a source code six six, not see.
‫It's a source code of C programming language, and we can compile it using the CC compiler.
‫The Ganiyu Compiler Collection GCSE is a compiler system produced by the new project supporting various
‫programming languages.
‫GCSE is a key component of the Canute tool chain and the standard compiler for most Unix like operating
‫systems.
‫Originally named the Ganiyu C compiler when it only handled the C programming language in the first
‫release.
‫Then it was extended to compile C++, Objective-C, Objective, C++, Fortran, Java, Ada and Go,
‫among others.
‫So anyway, type GCSE give the source file name and then output file name with dash o parameter and
‫hit enter.
‫Use the last command to see the file produced.
‫Here it is.
‫JCC compiled and produced an executable binary file.
‫Typekit slash and file name to run the executable.
‫And it shows that helped by default.
‫Right?
‫Good for us.
‫So because here we learn how to use the executable.
‫The first parameter is Target ID.
‫So we have to learn the target operating system.
‫And we can use and map the network map or tool to interrogate the operating system of the target.
‫Now, I'm not going to tell you more about end map here, because it's the subject of the network scanning
‫course.
‫Well, let's create the map query.
‫Dash as v for version detection.
‫Dash, oh, for the operating system detection now is a target IP.
‫And top 10 ports to scan.
‫Here the results are in map query, he says that the target operating system is either Windows 2000
‫with a service back zero to four or Windows XP with Service Pack zero or one.
‫We can try the result set one by one, but to give it quick.
‫Let's look at the target system.
‫So here's the target system, right click my computer select properties.
‫The system is Windows XP with Service Pack one.
‫OK, so back to Cali, let's remember the usage of our exploit again.
‫Now, first parameter is Target I.D., and it's a six second parameter is a target IP, which is one
‫seven two one six nine nine two zero seven for me.
‫And yes, we got the shell from the target system.
‫So let's look at the IP address.
‫It says two, zero seven.
‫So I'll go to the target system to check if it's true.
‫So I'll open a command line type ipconfig, and yes, the IP of the target is two zero seven.
‫So turn back to college now and type exit to close the show.
‫Now, look at the target system as you see the system crashed.
‫All the exploits may have had some side effects, so you better test it before using on the live systems.