Everybody and welcome to part two of the Metis point mini module.
Now we're going to be going over exploits and payloads and actually attacking a machine in this particular
video.
So we're gonna go ahead and load up MSF console like we've done before.
Perfect.
Now we've gone ahead and open up opened up MSF console.
What I want to show you guys first is how we can look for exploits now there's a few options now we
can do a show exploits when we go ahead and run this.
It is going to dump all eighteen hundred exploits onto the onto the screen.
Now in some cases you may want this for.
Let's say you want to send this to a different file or something along those lines but you can see here
that there's there's a lot like it goes for quite a while.
We're just on the Windows side of things there's still Linux and multiple other different OS is on here.
But I want to show you guys the general format.
So we have a path here.
Now this is a path relative to Metis boy.
So when you're referring to an exploit a payload an auxiliary module which is the recon stuff local
privilege escalation auxiliary modules what what you need to understand is that everything in motorsport
uses a path as its reference.
So you'll see that pretty commonly you'll start seeing Windows Linux slash service slash exploit or
Windows slash type of payload slash name of payload so the flow is generally the same.
Just keep this in mind when you're working with this you have to reference these parts when you want
to actually use and interact with a module or exploit the next set of data is the date that it was added
so in some cases this could be the date that was added to Metis Blake.
In other cases this might be the date that was added or the exploit that was found or when it was publicized.
Next is the reliability of that exploit.
Now this is an important column because this will tell you a lot of different things about the exploit.
So for example we have good average normal.
Excellent.
We've got a manual.
So the better the rating here the more stable and the more reliability the exploit has.
Now there are some that are poor you're going to run into that.
So use those with with your own caution however you can tweak some settings that we're going to go over
later to kind of help this out when you're on when you're using exploit that's not quite as stable or
reliable as something like excellent or average or good.
But in most cases as long as you're on in the good average and excellent or good great average excellent
you should be relatively fine for the most part.
But it's still always good to just test it on your own tested on a local instance.
But what we can do here is we can actually use the search keyword and actually search for a particular
exploit.
But before we do that I just want to recap that we can use and map if I spell right
we can use a map like we talked about before to scan for this host.
Now we can see Port twenty one in twenty two are open inside of Metis boy we can actually connect into
a banner grab for Midas point so if we do connect 1 9 2 6 8 I won't go twenty on port twenty two we
can see here SS H six acts as each one point out which is what we've seen before so control C will get
us out of that and bring a straight back in MSF console so let's say we want to look for an exploit
for 6 x right.
So we do search this back and we let that run so this will take just a second to run through and then
it'll tell you every exploit that matches that keyword.
Now keep in mind this is just matching it directly so if it's and if if those letters or symbols are
in the exploit or the description it will then it will make sure it shows up regardless.
So you don't have to worry about matching the exploit name specifically you can match the stuff in the
description as well so we can see here we've got our user name buffer overflow which we've used before.
So let's go ahead and copy this and to use a module in whether it's a recon module or a exploit module
we want to do as you use the keyword use and then we paste in the path.
Now it's important we use the path not the description not the rank not the disclosure date just the
path was wise and the path are important so you can see here it lit up and read.
So now we know that the modules in use however just because the modules in use there might be some requirements
that the module one such as the target host the IP of the remote host sometimes it's a username and
password depending on the exploit.
So to see what options are currently awaiting us and what options have been set we use show options
now what we can see here is our module options for this exploit is our host for remote host the current
setting is nothing but it's required is that a yes and this is the target address that's fine.
Our report is set is twenty two and it's currently set that way.
It says it's not required because it's already been set.
However keep in mind that this port might need to be changed if this service was to happen to be running
on port twenty three for whatever reason.
If the administrator is going for security by obscurity and just changing the port to something that's
not standard Li SS h as long as we've been grab the port and we see that it's SS h we would come in
here and change our port to something else if that was what was required.
However just note that when it says required it means that it's not set by default and it's something
that needs to be set if it's already been set by default you will say required equals no but it does
not mean it doesn't need to change.
So down here we have exploit target so the important part here is that this just has an idea of zero
it's got one target and it's set for Windows XP Service Pack 3 in Windows 2 2000 service pack zero in
some exploits you're going to find multiple targets here like next but that might be good for Windows
and Linux but you need to set the target specifically so all over setting these parameters of these
variables.
So how we set them is we use the keyword set followed by the variable name our host let's say and then
the value.
So 1 2 1 6 8 1 20.
So if we do show options again we can see that now we have our host has been set so target is the same
thing.
So set target zero in this case it's already set to zero.
But if you needed to change it to one two three four or five et cetera because the target needed to
change then you would do set target.
So in this case nothing changes.
Perfect.
Now our experts ready to go.
So if we just used exploit or run depending on which one you want you can use exploit or just run.
Either we'll take it off there's a problem here we don't have a payload so there's no shell code attached
to this exploit.
So when we download things like we've done before from from the Internet exploit D.B. it came with Shell
code actually built in but with Metis boy the the exploits don't have show code built into them they
are added depending on what you want.
So a good thing to take a look at is if we want to see our our payload options we would do show payloads.
Now this is going to show a large list of payloads and I and I do suggest you looking through these
deeply and truly understand what some of these are because you never know when there's going to be some
situation where you might not need a reverse shell but you might just want to create a user or in this
case you can send pone speak and ILS and they'll send a speech API to say you got pone there's ones
that open up text boxes there's the RNC inject as an example will open up a VM C server and connect
back to you depending on which one you want so that way you can get an interactive gooey for the need
for the machine.
But if we look up here we can see windows shell.
We've got our reverse TGP which is a reverse shell as we can see right here.
Perfect.
We've got UDP.
We've got over.
We've got reverse shells over different ports.
As an example so it's important to figure out what if this basically tunnel's the reverse traffic over
top of DNS.
So it's important to keep track of this stuff and know what options you have available.
So if we keep going up keep going up we've got DSL injections we've got my turn critters which is what
we're going to actually be using in this particular video.
And then we'll have a whole video on interpreters afterwards but if we keep looking return pictures
have the same thing they've got reverse shells they've got buying shells.
So but what we're going to be using and this is pretty standard is the windows interpreter reverse DCP
which is a reverse DCP or reverse shell.
So you're telling the server to connect back to you now to set our payload.
We said it just the same as we do any other option.
So set the payload and then we provide it the path which we just copied.
So now we've set our payload.
So if we do show options again we can see here that now we have payload options in here.
Now it's important to set these.
So in this case we have let's see all of these are required and we have El host that needs to be set.
So if we do El host which is our local host machine that's actually going to be receiving the show.
Now if you're going to be launching this exploit from one machine and grabbing the shell from another
you need to put the remote or the local host as that machine.
So whatever machine is going to be actually catching the shell in this case we're going to be using
this local Kelly instance today.
Twenty three perfect show options.
So now we see it's all been set and the El port is for four four four.
In most cases that's going to be blocked by a firewall so I recommend changing that to something pretty
common.
If you know the machine is does not use port 80 as an example you might want to throw it over that or
four four three something that's commonly allowed.
Do a firewall just so you don't hit that problem later.
Now exit function.
I'm not going to go into this in detail however Metis attaches exit routine to the shell code so that
way when it runs and it runs do all of the exploit it will go ahead and do something at the end.
So this is whether it's using a thread a process or doing nothing and just letting the exploit handle
on its own.
This can be the difference between the application crashing continuing to work like normal or just spiking
some CPO usage.
So depending on how stealthy you want to be and how it also affects how reliable it is to because if
you're looking at if you do nothing for example and exploit wasn't built with that extra bit put in
to actually continue the execution flow like normal instead of just corrupting it and leaving the application
to fend for itself what's going to happen is it's just going to crash which is can be a very big problem
for a red team or when you're testing against a prod machine.
So just keep this this stuff in mind.
So all of our options are set.
We've got our our host we've got our our port for our remote host and remote port our exit function
is SDH which is fine we'll just leave it as default.
I recommend leaving whatever the default is at first until there's a need to change it.
In most cases the exploit will D or the return of Shell will default to a the most stable option it
can l host in this case it's our machine port we're gonna leave it for four for work there's no firewalls
between me and the host and there's no firewall enabled on the host as well just for simplicity's sake.
But keep in mind we can changes to whatever we want.
So if we want to go and run this big news run or exploit.
So when we run this you'll see here.
So we're starting to send it off and looks like it failed.
So what we want to do is in some cases and exploit can fail.
Other cases it can work correctly.
It just entirely depends on how the exploit was built.
So I went ahead and restarted the SSA service.
Let's run it again.
Perfect.
So it looks like the first time it failed.
Which is fine which is why the when we looked at it the stability was just good.
It was an excellent it wasn't above average it was just good.
So there might be some issues where the exploit depending on what it was doing machine was doing at
the time could cause a problem.
Another issue is if we remember when we looked at this Shell code or the actual exploit itself we saw
that it was an egg Hunter so something could have failed when it was searching through a memory with
the egg Hunter and then that caused the problem.
However I want you to notice something here.
So.
It says that starting in the handler which is fine.
That's what we expect because we're using the interpreter so that'll automatically start a handler.
We send a malicious request it sends the bytes and then now we get an interpreter session open.
However you can notice that it's just hanging there.
There's nothing going on.
This can sometimes happen depending on the exploit.
But if you do find this occurs but it says the session was open.
Go ahead and control c you'll kill the process that you were running of the exploit.
However the shell should stay still stay open so to make sure that this is actually what happened.
We can do sessions dash L to list all the sessions and we can see right here we've got a maternal fritter
x eighty six m windows and it's already a system at the host exploit me which is what the hostname is
and then we can see our connection.
Perfect.
So let's go ahead interact with it with Dash AI and then the I.D. number which in this case is 1
Oh no not session the sessions.
Perfect.
So now we're in the maternity which has its own set of unique characteristics however I just for I'm
going to go over the maternity or in a later video but I just want to show you the shell option.
So when we launch shell we go ahead and get our machine directly.
So if we do IP config we can see that this is indeed the machine that we were just targeting and we
can also exit out and it doesn't destroy anything so we can use shell again and we're back right.
So it's much more stable than that cat.
It allows you to do a lot of things.
So we're gonna go over maternity or in the next video but I wanted to get you guys a good idea of how
to run through Menace Boy and attack a system from start to finish.