‫Now, I promise to get your hands dirty, and I don't want to bore you with too much theory, so let's
‫compromise some systems.
‫We performed a vulnerability scanning, and you'll certainly remember that there was an exploitable
‫vulnerability in the Java Army service of the Metasploit system.
‫So let's exploit the Metasploit about.
‫Here we are in the MSFT console, so you can use the search command to find the exploits for Java Army
‫server insecure default config vulnerability.
‫Here we find two salaries and to exploit.
‫To use the exploit, we use the use command of MSF console.
‫Give the full name of the exploit, you see.
‫And you see the command prompt shows us which exploit or auxiliary that we are using.
‫Now we can select a payload.
‫Type show payload, the C, the payloads available with this exploit.
‫You're going to see different payload lists for different exploits.
‫But we have to choose one of these payload.
‫But you know, something I'd like to pause here for a bit, for a little bit of definition.
‫Sorry for that.
‫I know your job and the bit, but I'd like you to understand what it is that you're actually doing.
‫So there are three different types of payload modules in the Metasploit Framework.
‫Singles stages and stages.
‫These different types allow for a great deal of versatility and can be useful across numerous types
‫of scenario, whether or not a payload is staged is represented by slash in the payload name.
‫For example, windows slash shell bind TCP is a single payload with no stage, whereas Windows Shell
‫Reverse TCP rc four consists of.
‫A stager reverse TCP rc four and a stage shell.
‫So singles are payloads that are self-contained and completely standalone, a single payload can be
‫something as simple as adding a user to the target system or running Colcord XY.
‫These kinds of payloads are self-contained so they can be caught with non Metasploit handlers such as
‫Net Cat.
‫Stagers set up a network connection between the attacker and victim and are designed to be small and
‫reliable.
‫It is difficult to always do both of these well, so the result is multiple similar stages.
‫Metasploit will use the best one when a can and fall back to a less preferred one.
‫If it's necessary.
‫Stages are payload components that are downloaded by stagers modules, the various payload stages provide
‫advanced features with no size limits such as mature operator BNC injection and the iPhone, iPod and
‫Shell.
‫OK, so where were we right?
‫We were about to set the payload for our exploit.
‫Do use the payload we want.
‫We use the set payload, Metasploit command.
‫And look at that, you'll see that there are two popular types of shells bind.
‫And reverse a mine shell is the kind that opens up a new service on the target machine and requires
‫the attacker to connect to it in order to get a session.
‫A reverse shell.
‫It's also known as a connect back is the exact opposite.
‫It requires the attacker to set up a listener first on his box.
‫The target machine acts as a client connecting to that listener.
‫And then finally, the attacker receives the shell.
‫So here I want to use the Java slash shell slash reverse TCP payload for this example.
‫Type show options to see the parameters we have to configure.
‫Now these are the parameters of the module, and these are the parameters of the selected payload required
‫field shows if you have to fill in the parameter or not, if the option is required, it cannot be empty.
‫So let's set the options for this exploit module options first.
‫The first option is HTP delay, which indicates the time that the FTP server will wait for the payload
‫request.
‫It has a default value.
‫10.
‫Just leave it as it is.
‫Our host is the remote host, which means the target machine and this example, Metasploit will set
‫our host with the IP address of Metasploit of our port is the target port.
‫As we've seen before, Java Army Service Port of Metasploit is 10 999, which is the default value of
‫the option.
‫Sir Host is another required field, which stands for the local host to listen on call for us.
‫So set serve host with the IP address of Collie.
‫Serve post is another required field.
‫The local port to listen on, and that has a default value of 88.
‫No need to change the default here.
‫So the last three options are not required, so I'll just let him be with the default values.
‫Now let's hit the payload options because it's a reverse shell payload.
‫It asks the listener host IP address and the port.
‫Both of them are, of course, required.
‫So said the El host, the listener dress as your colleague.
‫And if you like, change the default value of the Lisson port for 444 is fine for me.
‫Now we are ready to run the export.
‫And here you can use either run or the export command to run the export.
‫OK, so what the heck happened here?
‫Let's look at the messages given by Metasploit.
‫This module takes advantage of the default configuration of the Army Registry and RMI activation services,
‫which allow loading classes from any remote http URL.
‫Here it tries to exploit the vulnerability, which is on the service running on the port and 99 of Metasploit
‫using the application running on the Port 880 of our colleague.
‫And finally, it says a command shall session open, which means exploitation is successful now because
‫we don't need the FTP server opened in Cali anymore.
‫It's stopped at the end of the exploitation.
‫Sessions command is used to see the session running in the background.
‫We'll see the session command and details type session L to see the active sessions and Sessions I one
‫to interact with the session, which has the ID number one.
‫I think the interaction has started.
‫So let's try it.
‫I'll send the L.
‫S Command, and yes, we now have the shell for Metasploit about.
‫Print working directory.
‫We are at the root.
‫Who am I?
‫We are the root user ifconfig to learn the IP address, etc..