-: So far we have seen how we can use a service
with a default password
or a service that has not been configured correctly
or a service that came with a back door
to gain full access to the target computer.
We also seen how the basic use Metasploit
using the, to connect to a backdoor that was
installed on the FTP service.
Today we are going to have a more advanced look
on Metasploit and we will see how we use it to run
vulnerability that exists in a certain service.
It's a code execution vulnerability which will give us
full access to the target computer as well.
So back to our results here with Nmap and we're gonna do
the same thing that we have been doing for a while,
we copy the service name and see
if it has any vulnerabilities.
So for today we are having a look on this particular port,
139, which has a Samba server version 3.X.
So 3. anything really.
So we're going to go through Google just like
we did in the previous videos
and we're going to look for
Samba 3.X exploit.
Now as you can see there is a number of results.
The one that we are interested in, the ones that come in
from Rapid 7 because as I said these are the people
that make Metasploit, so the exploits that you see
there can be used through Metasploit.
So we have two examples here,
now I have actually tried both.
The first one doesn't work, so there is a bit
of trial and error in this and the second one
is the user Maps Script.
It's a command execution vulnerability, as you can see here.
So the name of the vulnerability is this.
So it's the same thing that we used before
with the evil backdoor in the FTP service.
This is just the different name that we are going to use.
So I'm going to Metasploit
and I have already run MSF console,
so you can see that the console is running here for me.
So I'm going to do a use, like we did before,
yesterday and then I'm gonna put the name of the exploit
that I want to use.
Then the next thing that we usually do is show options
like we did yesterday.
So I'm going to do show options.
So using these exploits is always pretty much the same
the only difference is the options that you can set
for each exploit.
So you always do use and then you put the exploit name
and then you do a show options to see what you can change
to work with this exploit.
So in the future, you probably will get different exploits
than what I have.
So every time you want to run an exploit,
you do a use exploit name and then you do show options
to see the options that you want to configure
but using the exploits and setting the options
and running them is always the same.
So I'm showing you a few examples that should cover
pretty much everything that you wanna do in the future.
So again, we need to set up the R-Host which is the IP
of the target computer and we're gonna do it the same way
that we did before.
As I said, it's setting the options is always the same.
So we're gonna do set
R-HOST and then we're gonna put the IP of the target
computer which is 10.20.14.204.
So exactly like we did before, we're using the set
to set an option which is the R-HOST.
So we're gonna do our show options.
And as you can see now the R-HOST has been set correctly.
What we need to do now is, here is where things differ
from the previous lecture.
In the previous lecture we used a backdoor that was already
installed on the target computer so all we had to do
is connect to the backdoor and then we could run
any commands, any Linux commands on the target computer.
In today's video, the target computer does not have
a backdoor, it has a normal program that has a buffer
overflow or a code execution vulnerability.
So the program doesn't have any code that allow us to run
Linux commands, it has certain flaw that will let us run
a small of piece of code.
These small pieces of code are called payloads.
So what we need to do, we need to create a payload
and then run it on the target computer using
the vulnerability that we found.
That piece of code will allow us to do different things.
So the payload is what allow us to do things
that are useful to us.
Now the payload might let us do Linux commands
and there is other type of payloads we'll look at
in the future.
So, to see that payloads that you can use
with this particular exploit, all you have to do
is run show payloads.
And these are he different type os payload that you can use.
Now I'm gonna talk about this again, so payloads are small
pieces of code that will be executed on the target computer
once the vulnerability has been exploited.
So, when we exploit the vulnerability, the code that we're
gonna pick here will be executed and depending on the type
of payload we choose, that payload will do something
that is useful to us.
So, right now you can see that all the payloads are cmd
so that's short for command, so they let you run commands
on the target computer, just like Linux commands.
And all of them only run on Unix and that's okay
because our target is Linux.
And there is two main types, there is bind payloads
and there is reverse payloads.
The bind payloads, all they do is they open a port
on the target computer and then we connect to that port.
The reverse, they do the opposite.
So they open a port in my machine and then they connect
from the target computer to my machine.
This is useful because the reverse allow us to bypass
firewalls, so the firewall will filter any connections
going to the target machine but if the target machine
connects to me and I don't have a firewall,
then I'll be able to bypass the firewall.
So I'm going to use the cmd Unix reverse
or actually I'll use the cmd Unix reverse netcat.
The last part of these payloads are the program and language
order tool that's going to be used
to facilitate the connection.
So for example we can see there is payloads written in perl
in ruby or in python, php or use a netcat
which is a tool that allows connections between computers.
So this is the one that I'm going to use
and I'm gonna use it the same way you use an exploit.
So I'm just gonna say, actually sorry, I'm gonna use it
using the set command.
So the same way you use set and option,
we're gonna set payload, so just like an option,
to the payload name that we just picked.
Now I'm gonna do a show options to see if there is any
other options that I need to set.
And yes, because we picked a payload now
there is more options.
So there is an option called L-HOST
and it's the listening address which is my own address.
So I'm gonna get my own IP address using if config.
And my own address is 10.20.14.203.
So I'm gonna close this
and I'm gonna set the L-HOST.
So it's like the same way that we set the R-Host before,
we set the L-HOST.
Do 10.
20.
So, before we used to do set R-HOST to set this option,
now we're setting the L-HOST to set this particular option.
So set is really simple, set, you put the option name
and then the value that you wanna set it to.
Then I'm gonna do show options
and now everything seems fine.
So we're using this exploit, the R-HOST is set to this,
which is okay.
And then the L-HOST is set to this which is perfect.
And then you can also set the port
that you're gonna be listening on, on your current computer.
You can actually set it to 80 if you wanted to,
that's the port that is used by web browsers.
So if you set the L-PORT to 80, the target computer will try
to connect to you using port 80 which is never filtered on
firewalls because that's the port that web browsers
or web servers use.
So whenever you access a website you actually access port 80
on that website.
So if you open port 80 on your machine and the target
connects to you on 80, then the firewall will think
that the target is only browsing the internet.
I'm not gonna do that now because I have a web server
running on port 80 and that will conflict.
So I'm just gonna set the L-PORT
to 555 just for example of you, just to see that you can
change any option using the same way which is set,
the option name and then the value.
So I'm gonna do show options again.
And as you can see, this has been changed to 5555
and I'm gonna do exploit to run the exploit.
Now as you can see,
it's telling me that session one has been opened.
And the connection is between this device and this device.
Which is the target and my device.
So I'm gonna do a pwd
and, or I do an id.
You'll see that I'm root therefore I do a uname -a.
You'll see I'm in the Metasploitable machine
and if I do an ls, I'll be able to list the files and so on.
I can use any Linux command, just like we did before
in the other videos.