Let's go straight into Metasploit and see how to use it.
I'll show you a real exploit on a vulnerable server.
The hackers machine will be Kali Linux and the victim's machine.
The Metasploit double VM, the one we've installed is set up in a previous lecture.
These two machines are connected to the same NAP network and we can check the network connection.
Using ping, I'm logging into Metasploit double.
And by morning I have config on both VMs to see their IP addresses.
This is then but 0.2.7 and the this is a ten .20. 2.15 so being Bambaataa 0.2.7 and he's asking and
I'm pinging a Carly as well.
Great.
Ina this lecture, I'll show you how heck he's performed from the beginning.
The first step of an attack is called reconnaissance, which means collecting and discovering information
about the system.
So let's scan the target for vulnerabilities using an amp, which is probably the most well known a
network scanner uncle.
I'm running through it.
And an amp minus capital A and the target's IP address.
And thus Ken is done.
Metasploit dabble his some intentional vulnerabilities.
In a real case scenario, hackers will do the same.
They will scan for vulnerabilities, and if there are any, they will try to exploit those vulnerabilities.
The End Map report shows important information about the services that are running their version and
the vulnerabilities.
And they see there are lots of vulnerabilities.
Let's take the stage server and the search on Google for exploits.
For that, the version.
And you notice there are some exploits available.
Those exploits can be executed using Metasploit.
Let's focus on v s ftb d version 2.3.4, which seems vulnerable.
This vulnerability will provide us with a route shell using a backdoor command execution.
This means we'll have full root access to the vulnerable system.
We can see information about the exploit.
Now back to Metasploit.
I'm starting the console by running MSF console.
He's starting.
Once started, we can search for a vulnerability or for a service by name.
I'm running a search voice.
FTD.
And it has found an available exploit for voice ftb d and the IT we have to select the exploit I'm running
use and the path to that exploit so exploit Unix, FTB and the vs if the PD 234 backdoor.
I'm hitting enter the exploit was selected and the next step is to check the options required to run
it.
I'm running show options.
We notice there are two options available.
Our hosts and our port.
Our hosts is the target or the victim's IP address.
In this example, it will be the IP address of the Metasploit table VM.
So said our hosts and the victim's IP address then.
But 0.2.7.
The other option our port is the remote port on which fsd pedi listens.
The final step is to run.
The exploit run.
It found Herschel opened a station in.
The Target was hacked.
We have gained access to Metasploit double VM remotely.
A shell has opened and allows us to fully control the machine.
We own that machine and we are connected to it, as would.
I'm running some comics on the Metasploit double, the Hecht Machine.
You see here.
This is IP address.
These comics are run on Metasploit double.
I'm creating a file on the Hecht machine.
Okay.
I've shown you how a system gets compromised.
We've intentionally used a vulnerable machine in a lab environment, but the same could happen in a
real world scenario.
We are taking a short break and in the next lecture will go over how to use MSF console.