We have discussed a lot of what we need to know about
launching attacks and the commands needed.
It's time to jump into the demonstration and walk
through the launch and review the attack.
For this demonstration,
we will launch the two attacks we configured previously and then review the
output of the attack and determine whether we were successful.
Let's go.
Here we are again in the Metasploit framework console.
You should recall that we last left off with those two exploits
that we configured for two different targets.
The first one is the back door that was placed in the Unreal IRC server.
Let's review our configuration.
Here's the info on the exploit module and some of our configuration.
Here are the configured options. We have our RHOSTS set for
the target host and our LHOST for the reverse network
connection for the command shell.
So let's run the exploit now and see what happens.
You can see the messages from the framework as the
listener is started in the first line.
Then there's a connection may to the IRC service to start
interacting to enable the back door.
We can see there are two connections made for this, socket A
and socket B. Notice that all of the messages are status
messages with the blue prefix.
In the end, you can see by the last message, we have a command shell.
However, we don't see a prompt. Just type a command.
As you can see,
we are seeing the results from that command. And this vulnerability for the
IRC server leaves us with root privileges on the box,
so there's a lot of fun to be had with this one.
Now let's turn to the other exploit.
The second vulnerability is the bluekeep vulnerability that affects RDP servers.
Let's review the information on this one.
Here we can see our configuration, and everything seems ready to go.
This exploit module implements of the check function.
Let's use it to check that our target system is vulnerable.
Notice that this check function actually calls an
auxiliary module to test the target.
We can see in the third message that our target has the vulnerability,
so let's exploit it.
Notice that the check function is run again when we
attempt to exploit the service.
Now we have to wait for the exploit to work its magic.
Unfortunately, we encountered a problem.
The target system just had a blue screen of death and rebooted.
If you review the documentation on this exploit,
you'll find that this is a possibility. This can happen while testing. First,
we highlighted a significant problem with the target.
While we may not have access to the system,
we were able to cause it to reboot from the attack.
That's a serious problem,
especially if it's a production server, for example.
Since this is an older target, it has other problems.
Let's try one more.
The other problem that this one has is the eternal blue vulnerability.
Let's set that one up.
First, we select the exploit module. Notice it sets the payload for us.
Let's set our target.
Let's double check our options again.
I can see that are LHOST is wrong, so let's fix that.
This module also has a check function so we can verify the target is vulnerable.
Well, we can see that it's likely vulnerable.
Let's try. This exploit provides lots of status
messages to let us know what it's doing.
This time we were successful.
The exploit module triggered the vulnerability,
and we ended up with a Metasploit session, just as we hoped.