Instructor: So far, in the server side attacks, 2 2
we've seen how we can use a default password 3 3
or use a misconfigured service 4 4
to gain access to the target computer. 5 5
Today, we're gonna have an example 6 6
on a very simple thing, which is a backdoor. 7 7
So some programs or services were shipped 8 8
or come in with backdoors embedded in them, 9 9
so we're gonna exploit that today, 10 10
and I chose this very simple exploit 11 11
because I wanna introduce you 12 12
to a framework called Metasploit. 13 13
We're gonna be using that framework a lot, 14 14
so I wanted something simple to start with 15 15
and then, we're gonna go deeper into that framework. 16 16
Now first, let me show you how we find that exploit. 17 17
So again, using the same method 18 18
that we've always been using, I have my Nmap scan, 19 19
and as I said, we're gonna go on each port 20 20
and Google them, looking for exploits. 21 21
So I'm gonna Google the service name here 22 22
and I'm gonna go to my browser, go to Google, 23 23
and I'm gonna type in exploit, 24 24
so the service name and followed by exploit. 25 25
As you can see, the first result 26 26
comes in from a website called Rapid7. 27 27
Now, Rapid7 is a company that makes Metasploit framework, 28 28
so that's why I chose this particular exploit 29 29
to show you today. 30 30
So let me go back 31 31
and let's talk about Metasploit for a second. 32 32
So we're gonna exploit this service, 33 33
or this problem, using Metasploit. 34 34
And as you can see here, Rapid7 is telling us 35 35
that this version of FTP has a backdoor command execution, 36 36
so it allowed us, we can basically execute commands 37 37
on the target computer if it has this program installed. 38 38
And from Nmap, we know that this program is installed, 39 39
which means that we can execute 40 40
commands on the target machine. 41 41
So I'm coming back here 42 42
and I'm gonna go to the next slide, 43 43
which talks about Metasploit. 44 44
Now Metasploit, as I said, is made by Rapid7. 45 45
It is a huge framework that contains a large number 46 46
of exploits, so it allows you to exploit 47 47
vulnerabilities or create your own exploits. 48 48
If you are an expert and you know how to discover 49 49
and make exploits, then Metasploit will help you do that. 50 50
Now, for today, we're doing a very simple use 51 51
of an existing vulnerability. 52 52
So, the commands on Metasploit are very easy. 53 53
They might seem a bit complicated now, 54 54
but once you get use to it, it is very easy to use, 55 55
and a lot of them are generic commands. 56 56
So here, I'm showing you the basic generic commands 57 57
and then, there are other commands 58 58
that you get use to them in time. 59 59
So, the first command is msfconsole 60 60
and this basically just launches Metasploit program. 61 61
You can always type in help at any stage, 62 62
and you'll get help of the commands 63 63
and the description on how you can use them. 64 64
You can use the show command to show something, 65 65
so you can show the available exploits, 66 66
you can show the available auxiliaries, 67 67
the available payloads, 68 68
and we'll talk about what each of these mean in the future. 69 69
You can use the use command 70 70
to use something that you're shown. 71 71
So for example, you showed the exploits 72 72
and you picked a certain exploit that you want to use. 73 73
Then, you use the use command 74 74
and then, you type in the exploit name to run it. 75 75
Then, you can use the set option, or the set command, 76 76
to set specific options for the exploit. 77 77
For example, if you wanted to set the IP address 78 78
of your target, so you set the IP 79 79
and then, you put the value of the IP 80 80
that you wanna set it to. 81 81
And then, at the end, once you finish configuring 82 82
your exploit, you can type in exploit 83 83
to execute that exploit. 84 84
Now, I know this might look a bit vague, 85 85
but once I use it, it's gonna become very clear to you 86 86
and we're gonna be using these programs a lot 87 87
and these commands a lot, so they're gonna become 88 88
very easy and simple to use. 89 89
So we're coming back here, so we went on Nmap, 90 90
we Googled the name of the service, 91 91
and the first thing that came up is that 92 92
this service has a backdoor command execution. 93 93
Because this is on Rapid7, the vulnerability 94 94
is exploitable using Metasploit, 95 95
and the module name we're gonna be using is this. 96 96
So it made our life much easier with this, 97 97
so I'm gonna copy the name. 98 98
This is the name that I want to use 99 99
to exploit this vulnerability. 100 100
So, I'm gonna go to my console 101 101
and I'm gonna launch Metasploit 102 102
and we're going to do a use, 103 103
And we're going to do a use 104 104
and then, put the name of the exploit 105 105
that we just copied from Google or from Rapid7. 106 106
So we're gonna use that certain exploit 107 107
and as you can see, now the name here changed to exploit 108 108
and then, the name of the exploit that we're using. 109 109
Then, we're gonna use the show command 110 110
As I said, show is a generic command 111 111
that you can use in a number of cases. 112 112
that you can use it in a number of cases. 113 113
So in this case, we're doing a show options 114 114
for this particular exploit. 115 115
As you can see now the second option is the port 116 116
And as you can see now, the second option is the port 117 117
that the service is running on 118 118
and it's already set to port 21, and this is correct. 119 119
If we go back to Nmap, you will see 120 120
that our target FTP client or server is running on port 21, 121 121
so this is good. 122 122
We don't need to change any of that. 123 123
What we need to change is the RHOST, 124 124
so the RHOST is the target IP address, as you can see here. 125 125
And to change the value of this, as I explained before, 126 126
we're gonna use the set option or the set command. 127 127
So our command is gonna be set and we're gonna the RHOST. 128 128
And that's the IP address 129 129
of my target Metasploitable machine. 130 130
So, we use set and after set, you put the option name. 131 131
So for example, if you wanted 132 132
to change the port, you set RPORT. 133 133
We are changing the host, 134 134
so we set RHOST to 10.20.14.204, and I'm gonna hit Enter. 135 135
And as you can see now, this is the RHOST. 136 136
It's set to this. 137 137
Now, what I want I wanna do is show the options again, 138 138
And as you can see now, the RHOST has been changed 139 139
And as you can see now, 140 140
the RHOST has been changed to 10.20.14.204. 141 141
So everything is ready now 142 142
and to execute the exploit, we just type in exploit. 143 143
So it seems like the exploit ran, but nothing has happened. 144 144
We didn't gain anything, 145 145
so what I'm gonna do is just run it again, 146 146
and this happens sometimes. 147 147
And as you can see now, the exploit was run successfully. 148 148
And now, I have access to the target computer. 149 149
If I do an ID, you'll see that my ID is root. 150 150
Now, basically, I'm running Linux commands here, 151 151
so if you do a uname -a, you'll see that 152 152
this is my Metasploitable machine, 153 153
and if I do ls, then it'll list the files for me. 154 154
If I do pwd, it'll show me where I am. 155 155
And I can use Linux commands to do anything 156 156
I want on the target machine. 157 157
Now, this was very simple to use of Metasploit. 158 158
In the future, we gonna be using it for more advanced stuff.