Instructor: So far, in the server side attacks,
we've seen how we can use a default password
or use a misconfigured service
to gain access to the target computer.
Today, we're gonna have an example
on a very simple thing, which is a backdoor.
So some programs or services were shipped
or come in with backdoors embedded in them,
so we're gonna exploit that today,
and I chose this very simple exploit
because I wanna introduce you
to a framework called Metasploit.
We're gonna be using that framework a lot,
so I wanted something simple to start with
and then, we're gonna go deeper into that framework.
Now first, let me show you how we find that exploit.
So again, using the same method
that we've always been using, I have my Nmap scan,
and as I said, we're gonna go on each port
and Google them, looking for exploits.
So I'm gonna Google the service name here
and I'm gonna go to my browser, go to Google,
and I'm gonna type in exploit,
so the service name and followed by exploit.
As you can see, the first result
comes in from a website called Rapid7.
Now, Rapid7 is a company that makes Metasploit framework,
so that's why I chose this particular exploit
to show you today.
So let me go back
and let's talk about Metasploit for a second.
So we're gonna exploit this service,
or this problem, using Metasploit.
And as you can see here, Rapid7 is telling us
that this version of FTP has a backdoor command execution,
so it allowed us, we can basically execute commands
on the target computer if it has this program installed.
And from Nmap, we know that this program is installed,
which means that we can execute
commands on the target machine.
So I'm coming back here
and I'm gonna go to the next slide,
which talks about Metasploit.
Now Metasploit, as I said, is made by Rapid7.
It is a huge framework that contains a large number
of exploits, so it allows you to exploit
vulnerabilities or create your own exploits.
If you are an expert and you know how to discover
and make exploits, then Metasploit will help you do that.
Now, for today, we're doing a very simple use
of an existing vulnerability.
So, the commands on Metasploit are very easy.
They might seem a bit complicated now,
but once you get use to it, it is very easy to use,
and a lot of them are generic commands.
So here, I'm showing you the basic generic commands
and then, there are other commands
that you get use to them in time.
So, the first command is msfconsole
and this basically just launches Metasploit program.
You can always type in help at any stage,
and you'll get help of the commands
and the description on how you can use them.
You can use the show command to show something,
so you can show the available exploits,
you can show the available auxiliaries,
the available payloads,
and we'll talk about what each of these mean in the future.
You can use the use command
to use something that you're shown.
So for example, you showed the exploits
and you picked a certain exploit that you want to use.
Then, you use the use command
and then, you type in the exploit name to run it.
Then, you can use the set option, or the set command,
to set specific options for the exploit.
For example, if you wanted to set the IP address
of your target, so you set the IP
and then, you put the value of the IP
that you wanna set it to.
And then, at the end, once you finish configuring
your exploit, you can type in exploit
to execute that exploit.
Now, I know this might look a bit vague,
but once I use it, it's gonna become very clear to you
and we're gonna be using these programs a lot
and these commands a lot, so they're gonna become
very easy and simple to use.
So we're coming back here, so we went on Nmap,
we Googled the name of the service,
and the first thing that came up is that
this service has a backdoor command execution.
Because this is on Rapid7, the vulnerability
is exploitable using Metasploit,
and the module name we're gonna be using is this.
So it made our life much easier with this,
so I'm gonna copy the name.
This is the name that I want to use
to exploit this vulnerability.
So, I'm gonna go to my console
and I'm gonna launch Metasploit
and we're going to do a use,
And we're going to do a use
and then, put the name of the exploit
that we just copied from Google or from Rapid7.
So we're gonna use that certain exploit
and as you can see, now the name here changed to exploit
and then, the name of the exploit that we're using.
Then, we're gonna use the show command
As I said, show is a generic command
that you can use in a number of cases.
that you can use it in a number of cases.
So in this case, we're doing a show options
for this particular exploit.
As you can see now the second option is the port
And as you can see now, the second option is the port
that the service is running on
and it's already set to port 21, and this is correct.
If we go back to Nmap, you will see
that our target FTP client or server is running on port 21,
so this is good.
We don't need to change any of that.
What we need to change is the RHOST,
so the RHOST is the target IP address, as you can see here.
And to change the value of this, as I explained before,
we're gonna use the set option or the set command.
So our command is gonna be set and we're gonna the RHOST.
And that's the IP address
of my target Metasploitable machine.
So, we use set and after set, you put the option name.
So for example, if you wanted
to change the port, you set RPORT.
We are changing the host,
so we set RHOST to 10.20.14.204, and I'm gonna hit Enter.
And as you can see now, this is the RHOST.
It's set to this.
Now, what I want I wanna do is show the options again,
And as you can see now, the RHOST has been changed
And as you can see now,
the RHOST has been changed to 10.20.14.204.
So everything is ready now
and to execute the exploit, we just type in exploit.
So it seems like the exploit ran, but nothing has happened.
We didn't gain anything,
so what I'm gonna do is just run it again,
and this happens sometimes.
And as you can see now, the exploit was run successfully.
And now, I have access to the target computer.
If I do an ID, you'll see that my ID is root.
Now, basically, I'm running Linux commands here,
so if you do a uname -a, you'll see that
this is my Metasploitable machine,
and if I do ls, then it'll list the files for me.
If I do pwd, it'll show me where I am.
And I can use Linux commands to do anything
I want on the target machine.
Now, this was very simple to use of Metasploit.
In the future, we gonna be using it for more advanced stuff.