NOW LET'S START THIS meter's private and see how it works.
Let's have a small scenario first assume that my Target has a Windows Server 2003 and I start searching
on the Internet on Google and CVA and Microsoft and I end up with this piece of information that Microsoft
has released a security bulletin about a specific threat and ability.
And this is the number of days of vulnerability as 0 3 hyphen 0 26.
And this is a critical on.
So I went through the application but I was not able to understand exactly how it worked.
And you know you can go through it you may find you know explaining how it works and so on.
But since you don't have any programming skills so it will be hard for you to customize a program or
a payload or something like that.
So let's see how can I use me to exploit to simplify the usage of this vulnerability.
So let's see.
I will open a terminal in 30 million and just so mean
and we need to run the meet exploit.
How can we run the meters.
You just type MSF console so typing and as if.
And if this was the first time it would take like five minutes until it built the database and everything
but if you are using that frequently it will not take that much of time.
So let to it until it starts the framework.
Now if you're not comfortable using the command line don't worry because you know after a few lecture
I'm going to show you how to use the graphical version of meta sprite which is quite easy to use but
you should have the option.
I mean some people prefer to use the common line and some people prefer the graphics.
But both of them would give you a similar.
So it open the meet exploit and as you can see the amount of exploit he got an amount of payload so
he got a very good database that you can use.
Now I need to start by searching for the vulnerability.
So before using this tool you know we I'm assuming that you did some work you search you first gathered
information about your victim you knew that he's using a specific operating system and there's this
operating system has specific but an ability maybe he have another program like a crowbar three there
or a flash player and you're aware of the vulnerability so now we need to search for this one.
So I'm going to type search
for an S 0 3 5 and 20 6
6 2 0 26
and he finds the exploit here.
So this weakness this is a program that you can use to try to compromise the system.
Okay.
Now how can I use it in a simplified way.
I'm going to start by taking the pass since you are an copy and we're gonna go here and type use and
see specific parts.
So that's mean I need to use this exploit try to actresses and you'll notice that the prompt has been
change.
Okay.
Any exploit.
Need some input.
I mean.
I mean how you know which computer you are trying.
What is the IP of your computer or your victim.
And that has this vulnerability.
So let me show you my victim here.
This is my Windows XP my Windows 2003.
And let's see the IP of this computer.
So I'm going to go here and I'm going to go to the
an IP is 160 suite 250.
Okay.
Excellent.
So going back to our Kelly machine.
So how can I know what option we need to have or what input I need from my side to be able to use this
exploit you type.
Sure option and sure option would show you the exploit that you are trying to use.
Show Options and Saudi options.
And as you can see you know there is some information.
I mean here is our host which is the target address.
It's empty and it's meant and authority.
While the port that is the full port is if you're going to try to use you can change it.
But meanwhile he only needs a target at this excellence how can I assign the target that you type just
comment set and you put our hosts somewhere I mean it's Linux is case sensitive in general so are host
and then you put the IP which is 1 9 2 1 6 8 163 to 250.
And to make sure that it has been updated just type show option one more time and as you can see.
So now nothing else is needed some exploit.
Need more information like in another port and maybe your own IP.
We're going to try different kinds of exploit but we are taking a simple one.
Just to let you get familiar with the meetings play now since all the computers are I am inside the
exploit I added all the information needed from my side.
I need to use it as well.
How can I use it just type exploit
and that's it.
You compromised the system and now you are on the meter operator
prompt and this is a very very powerful payload the payload by Zoe is a program that has been sent to
the victim through this exploit and allow you to access this victim.
This one will give you full option to the victim machine so I hope this path is OK.
And on next lecture I'm going to start explaining the method birth decision and what is the benefit
of using it and how can I use it to whom I already compromised the system.
But what different feature I have inside.
Can I protect files.
Can I download file.
Can I format his drive.
What option do I have.
So next lecture I'm going explains explain the method operator and then we're going to continue working
with the exploit and the vulnerability.