PWNing A System via (MSF) Metasploit Framework
Lab Requirements : Both OS running under my Virtual Machine.
1, Back Track 5 R3 Machine
2, Windows XP Machine
Vulnerability : This is the know Vulnerability In Windows XP and Server 2003, MS08-067 vulnerability that uses the netapi module in the Windows SMB Protocol that may be used for arbitrary code execution. The Link's for more Information regarding this Vulnerability is -
http://blogs.technet.com/b/srd/archive/2008/10/23/more-detail-about-ms08-067.aspx
http://www.symantec.com/security_response/attacksignatures/detail.jsp?asid=21702
http://www.rapid7.com/db/modules/exploit/windows/smb/ms08_067_netapi
Lab Requirements : Both OS running under my Virtual Machine.
1, Back Track 5 R3 Machine
2, Windows XP Machine
Vulnerability : This is the know Vulnerability In Windows XP and Server 2003, MS08-067 vulnerability that uses the netapi module in the Windows SMB Protocol that may be used for arbitrary code execution. The Link's for more Information regarding this Vulnerability is -
http://blogs.technet.com/b/srd/archive/2008/10/23/more-detail-about-ms08-067.aspx
http://www.symantec.com/security_response/attacksignatures/detail.jsp?asid=21702
http://www.rapid7.com/db/modules/exploit/windows/smb/ms08_067_netapi
Effect Of MS08-067 NetAPI Vulnerability :
This module exploits a parsing flaw in the path canonicalization code of NetAPI32.dll through the Server Service. This module is capable of bypassing NX on some operating systems and service packs. The correct target must be used to prevent the Server Service (along with a dozen others in the same process) from crashing. Windows XP targets seem to handle multiple successful exploitation events, but 2003 targets will often crash or hang on subsequent attempts. This is just the first version of this module, full support for NX bypass on 2003, along with other platforms, is still in development.
Here, I have mentioned below the basic steps to perform the MSF via Modules, Payloads and Exploits -
1, Workspaces (Information stored here in form of database) :
Logical Section of the Metasploit database so that we can Logically divide the discovered Hosts. It means that each discovered hosts is separated and stored here in Workspaces.
2, Scanning For Hosts and Services :
It means that we will discover here the services and the ports open on the Target Host.
3, Loading a Module with "use" :
Here using the module we will use the specific vulnerability for PWNing a System
4, Specify a Payload with "set" :
Now in this we will set a Payload against a Victim Machine to gain access over it.
5, Identify Targets with "RHOST" and "LHOST" :
Over here we will be using our Source IP as LHOST which is Local Host and Victim IP will be RHOST which means Remote Host.
6, Launching the Exploits :
Once all set and done then we are ready to Exploit the Victim Machine.
Introduction :
When I say "Penetration Testing Tool" the first thing that comes to your mind is the world's largest Ruby project, with over 700,000 lines of code 'Metasploit' . No wonder it had become the de-facto standard for penetration testing and vulnerability development with more than one million unique downloads per year and the world's largest, public database of quality assured exploits.
The Metasploit Framework is a program and sub-project developed by Metasploit LLC. It was initially created in 2003 in the Perl programming language, but was later completely re-written in the Ruby Programming Language. With the most recent release Metasploit has taken exploit testing and simulation to a complete new level which has muscled out its high priced commercial counterparts by increasing the speed and legality of code of exploit in shortest possible time.
In this article, I will walk your through detailed step by step sequence of commands along with graphical illustrations to perform effective penetration testing using Metasploit framework.
Working with Metasploit :
Metasploit is simple to use and is designed with ease-of-use in mind to aid Penetration Testers. Metasploit Framework follows these common steps while exploiting a any target system
Select and configure the exploit to be targeted. This is the code that will be targeted toward a system with the intention of taking advantage of a defect in the software.Validate whether the chosen system is susceptible to the chosen exploit.
Select and configure a payload that will be used. This payload represents the code that will be run on a system after a loop-hole has been found in the system and an entry point is set.
Select and configure the encoding schema to be used to make sure that the payload can evade Intrusion Detection Systems with ease.
Execute the Exploit :
Metasploit framework has three work environments, the msfconsole, the msfcli interface and the msfweb interface. However, the primary and the most preferred work area is the 'msfconsole'. It is an efficient command-line interface that has its own command set and environment system.
Before executing your exploit, it is useful to understand what some Metasploit commands do. Below are some of the commands that you will use most. Graphical explanation of their outputs would be given as and when we use them while exploiting some boxes in later part of the article.
MSF Commands and Usage :
1, search <keyword>: Typing in the command 'search' along with the keyword lists out the various possible exploits that have that keyword pattern.
2, show exploits: Typing in the command 'show exploits' lists out the currently available exploits. There are remote exploits for various platforms and applications including Windows, Linux, IIS, Apache, and so on, which help to test the flexibility and understand the working of Metasploit.
3, show payloads: With the same 'show' command, we can also list the payloads available. We can use a 'show payloads' to list the payloads.
4, show options: Typing in the command 'show options' will show you options that you have set and possibly ones that you might have forgotten to set. Each exploit and payload comes with its own options that you can set.
5, info <type> <name>: If you want specific information on an exploit or payload, you are able to use the 'info' command. Let's say we want to get complete info of the payload 'winbind'. We can use 'info payload winbind'.
6, use <exploit_name>: This command tells Metasploit to use the exploit with the specified name.
7, set RHOST <hostname_or_ip>: This command will instruct Metasploit to target the specified remote host.
8, set RPORT <host_port>: This command sets the port that Metasploit will connect to on the remote host.
9, set PAYLOAD <generic/shell_bind_tcp>: This command sets the payload that is used to a generic payload that will give you a shell when a service is exploited.
10, set LPORT <local_port>: This command sets the port number that the payload will open on the server when an exploit is exploited. It is important that this port number be a port that can be opened on the server (i.e.it is not in use by another service and not reserved for administrative use), so set it to a random 4 digitnumber greater than 1024, and you should be fine. You'll have to change the number each time you successfully exploit a service as well.
11, exploit: Actually exploits the service. Another version of exploit, rexploit reloads your exploit code and then executes the exploit. This allows you to try minor changes to your exploit code without restarting the console
12, help: The 'help' command will give you basic information of all the commands that are not listed out here.
Now that you are ready with all the basic commands you need to launch your exploit, lets get in action with live target system using Metasploit.
Step 1, On Backtrack 5 machine follow the steps mentioned via GUI Interface -
Application > BackTrack > Exploitation Tools > Network Exploit Tools > Metasploit Framework > msfconsole.
