So the scan is completed in 17 minutes.
Now, another pause here, because I disable the windows plug ins, it seems as if the Windows systems
don't have critical vulnerabilities.
It's not right, especially my Windows XP has several critical vulnerabilities.
If you didn't disable windows plug ins, you're supposed to see some more vulnerabilities for Windows
systems.
Now to see the results of the voidable scan in detail, let's click the Métis Voidable results to 06.
The Nessa's home found 10 critical vulnerabilities with their scan configuration, but please note that
the configuration affects the results so the target systems may have more vulnerabilities than reported.
If there is a vulnerability and it's not found in a scan, we call it a false negative.
I'm sure you know that the critical vulnerabilities are the most dangerous ones, but that's where it
gets good.
They are the most exploitable ones in general.
So let's click on one of these critical vulnerabilities, for example, being shown back door detection.
Well, look at the description, it says a shell is listening on the port without any authentication
being required.
This is obviously a back door.
Your support number of 15 24.
Now let's check of the finding is a true positive go to terminal screen.
I used Ngarkat tool to connect simply type ency and the target IP and the target bought 15 24 and we're
in.
We have the shell for Métis voidable.
Type, who am I to learn the credential we have, we are the user.
Now, it was too simple, it's just not fun.
And, you know, I don't like it.
I like a good challenge.
Right.
I mean, we are the route user and we can access anything we want.
For example, shadow file, which contains the hashes of the user's passwords.
OK, back to the browser and click on the back to vulnerability's link to turn back to the vulnerabilities
of Métis voidable.
Now, I'd like to show you some more.
Scroll on down the vulnerability, it shows 50 vulnerabilities per page by default, but let's make
it 200 to see all the findings in a single page.
Now, the findings are ordered by SAVARY levels, so information is at the bottom.
Findings with the severity level of information identify non vulnerability information, which is,
you know, nice to know, and it keeps it separate from the vulnerability detail.
So here there's an info RMI registry detection, let's click it.
It says that the remote host is running an RMI registry, retrieving remote objects in the Java runtime
method invocation system.
So let's look for the exploits of the Métis Floyd framework if there is any exploit for Java RMI.
Opening terminal screen and run MSF console.
So here we have MSF console, let's search the exploits of RMI.
Too many results.
To keep it more specific, I want to search Java RMI.
So we have to auxiliaries and to exploits at this time, so look at the exploit in the last line, this
module takes advantage of the default configuration of the RMI registry and RMI activation services,
which allow loading classes from any remote.
You, Earl.
Let's try to use it on our RMI poor.
Please don't worry, I am going to explain what these all mean.
I just want to show you an example at the beginning.
So bear with me.
I use the module name with the full path.
You can simply select the module name and click the middle button of the mouse to copy and paste it.
Type show payloads to see the payloads can be used with this module.
So I want to use this payload to have an interpreter session.
Again, don't worry, I'll explain what the interpreter is soon, but just copy and paste the payload
name type show options to see the parameters of the exploit and the payload as well.
Set the remote host as Métis voidable two zero six default remote port is the same with our port one
zero nine nine.
Servoz is the local host to listen on, set this to be our colleague to to to.
By default, support remain.
So the other options are not required.
I'll just leave it blank.
Now, are the payload options set the listen host to be our colleague to to to default?
Listen, port is good for four, four, four and finally type exploit to run the exploit.
So there it looks like we have a better picture session.
Type sessions dash l to list the active sessions, be patient, we'll see them in detail type session
dashi session ID to interact with a session and here we are, we're in now.
I'm going to show you what we can do with an interpreter session in the following chapter.
But here's a couple of Mettenberger commands disinfo info to see the system information.
Hash dump the gather password hashes.
Now, no such command for this system, thankfully, we have an alternative for this type run post Linux
gathers hash, dump and hit, enter and collect the fruits of your labor.
So as you see here, we found another way to exploit the system, even though the finding was just information.
So I hope you understand not to underestimate any finding.