Get acquainted with the former Met a split module that is not included in backtrack and must be installed
manually D.B. autopen was included only in the third version of modestly.
Now it's an independent module.
It is in fact a perl script
such a script can easily be adjusted to the newest Maeder split version and quickly implemented.
Let's see what options it gives Madis point is a framework often used for security testing.
It includes a database of known software vulnerabilities which is updated on a regular basis.
The parameter option which the script offers allows you to select well-known exploits stored in the
database the selection is based on the information about the victims computer we've managed to collect
that display it will try to execute those exploits on a designated remote host the parameter option
will additionally force the remote host to make a callback connection.
If the whole operation is successful
this will establish a connection session
the parameter option initiates the scanning of all hosts saved on the database we know you can see with
the full command should look like
having executed this command.
You can watch individual exploits being sent to open ports of the target computer with the IP number
ending in 1 1 5 skinning the victim's computer.
We've learn which ports are open and what services are listening on them.
If the services are not updated which in turn make it vulnerable to any of the 108 exploits on the remote
host we'll make a callback connection.
This will give us full control over.
Now we're waiting for all the exploits that were sent to have been executed.
The following piece of information is particularly important.
The remote computer has made a callback connection.
This means it was vulnerable to at least one of the security loopholes.
The situation exemplifies a principle we mentioned in previous modules.
It's much easier to attack a computer system than to defend
the attacker wins if she finds only one weak point in the system the defender must make sure that his
system is protected against all kinds of attacks.
In our demonstration one vulnerability has been detected.
After the last exploit is executed we'll get through the split and be able to list all the active sessions
the list will include the session with the loophole we mentioned we'll be able to switch to that session
and execute a program on the victim's computer.
We'll also be able to find out what privileges the program has access to if the program is running with
administrator or system privileges it will give the attack full control over the remote system.
The complete attack procedure consisted of only typing three instructions provided the metal split has
been configured to use the database
we have already learned that a session is established therefore we will terminate the last module of
the procedure and check active sessions.
We see that a session with the remote computer is established later on we will have the opportunity
to break into remote computers and harvest information from them.
Now we will connect to the active session.
Next we will try to connect to the remote system as you can see its Windows XP we've recognize the system.
Now let's try to run something on it.
After connecting with the system we're able to see the processes running on the victim's computer.
One of the names signifies the calculator application which we've remotely started.
So it's not that it's running with system privileges.
This means we have full control over the remote host.
There's nothing that we could not do.
Regardless of the user logged in at the moment of attack we have acquired maximum privileges.
We've seen that from the transport layer.
It's very easy to gather information about computer configuration and running services even system services.