-: So far we have seen how we can use a service 2 2
with a default password 3 3
or a service that has not been configured correctly 4 4
or a service that came with a back door 5 5
to gain full access to the target computer. 6 6
We also seen how the basic use Metasploit 7 7
using the, to connect to a backdoor that was 8 8
installed on the FTP service. 9 9
Today we are going to have a more advanced look 10 10
on Metasploit and we will see how we use it to run 11 11
vulnerability that exists in a certain service. 12 12
It's a code execution vulnerability which will give us 13 13
full access to the target computer as well. 14 14
So back to our results here with Nmap and we're gonna do 15 15
the same thing that we have been doing for a while, 16 16
we copy the service name and see 17 17
if it has any vulnerabilities. 18 18
So for today we are having a look on this particular port, 19 19
139, which has a Samba server version 3.X. 20 20
So 3. anything really. 21 21
So we're going to go through Google just like 22 22
we did in the previous videos 23 23
and we're going to look for 24 24
Samba 3.X exploit. 25 25
Now as you can see there is a number of results. 26 26
The one that we are interested in, the ones that come in 27 27
from Rapid 7 because as I said these are the people 28 28
that make Metasploit, so the exploits that you see 29 29
there can be used through Metasploit. 30 30
So we have two examples here, 31 31
now I have actually tried both. 32 32
The first one doesn't work, so there is a bit 33 33
of trial and error in this and the second one 34 34
is the user Maps Script. 35 35
It's a command execution vulnerability, as you can see here. 36 36
So the name of the vulnerability is this. 37 37
So it's the same thing that we used before 38 38
with the evil backdoor in the FTP service. 39 39
This is just the different name that we are going to use. 40 40
So I'm going to Metasploit 41 41
and I have already run MSF console, 42 42
so you can see that the console is running here for me. 43 43
So I'm going to do a use, like we did before, 44 44
yesterday and then I'm gonna put the name of the exploit 45 45
that I want to use. 46 46
Then the next thing that we usually do is show options 47 47
like we did yesterday. 48 48
So I'm going to do show options. 49 49
So using these exploits is always pretty much the same 50 50
the only difference is the options that you can set 51 51
for each exploit. 52 52
So you always do use and then you put the exploit name 53 53
and then you do a show options to see what you can change 54 54
to work with this exploit. 55 55
So in the future, you probably will get different exploits 56 56
than what I have. 57 57
So every time you want to run an exploit, 58 58
you do a use exploit name and then you do show options 59 59
to see the options that you want to configure 60 60
but using the exploits and setting the options 61 61
and running them is always the same. 62 62
So I'm showing you a few examples that should cover 63 63
pretty much everything that you wanna do in the future. 64 64
So again, we need to set up the R-Host which is the IP 65 65
of the target computer and we're gonna do it the same way 66 66
that we did before. 67 67
As I said, it's setting the options is always the same. 68 68
So we're gonna do set 69 69
R-HOST and then we're gonna put the IP of the target 70 70
computer which is 10.20.14.204. 71 71
So exactly like we did before, we're using the set 72 72
to set an option which is the R-HOST. 73 73
So we're gonna do our show options. 74 74
And as you can see now the R-HOST has been set correctly. 75 75
What we need to do now is, here is where things differ 76 76
from the previous lecture. 77 77
In the previous lecture we used a backdoor that was already 78 78
installed on the target computer so all we had to do 79 79
is connect to the backdoor and then we could run 80 80
any commands, any Linux commands on the target computer. 81 81
In today's video, the target computer does not have 82 82
a backdoor, it has a normal program that has a buffer 83 83
overflow or a code execution vulnerability. 84 84
So the program doesn't have any code that allow us to run 85 85
Linux commands, it has certain flaw that will let us run 86 86
a small of piece of code. 87 87
These small pieces of code are called payloads. 88 88
So what we need to do, we need to create a payload 89 89
and then run it on the target computer using 90 90
the vulnerability that we found. 91 91
That piece of code will allow us to do different things. 92 92
So the payload is what allow us to do things 93 93
that are useful to us. 94 94
Now the payload might let us do Linux commands 95 95
and there is other type of payloads we'll look at 96 96
in the future. 97 97
So, to see that payloads that you can use 98 98
with this particular exploit, all you have to do 99 99
is run show payloads. 100 100
And these are he different type os payload that you can use. 101 101
Now I'm gonna talk about this again, so payloads are small 102 102
pieces of code that will be executed on the target computer 103 103
once the vulnerability has been exploited. 104 104
So, when we exploit the vulnerability, the code that we're 105 105
gonna pick here will be executed and depending on the type 106 106
of payload we choose, that payload will do something 107 107
that is useful to us. 108 108
So, right now you can see that all the payloads are cmd 109 109
so that's short for command, so they let you run commands 110 110
on the target computer, just like Linux commands. 111 111
And all of them only run on Unix and that's okay 112 112
because our target is Linux. 113 113
And there is two main types, there is bind payloads 114 114
and there is reverse payloads. 115 115
The bind payloads, all they do is they open a port 116 116
on the target computer and then we connect to that port. 117 117
The reverse, they do the opposite. 118 118
So they open a port in my machine and then they connect 119 119
from the target computer to my machine. 120 120
This is useful because the reverse allow us to bypass 121 121
firewalls, so the firewall will filter any connections 122 122
going to the target machine but if the target machine 123 123
connects to me and I don't have a firewall, 124 124
then I'll be able to bypass the firewall. 125 125
So I'm going to use the cmd Unix reverse 126 126
or actually I'll use the cmd Unix reverse netcat. 127 127
The last part of these payloads are the program and language 128 128
order tool that's going to be used 129 129
to facilitate the connection. 130 130
So for example we can see there is payloads written in perl 131 131
in ruby or in python, php or use a netcat 132 132
which is a tool that allows connections between computers. 133 133
So this is the one that I'm going to use 134 134
and I'm gonna use it the same way you use an exploit. 135 135
So I'm just gonna say, actually sorry, I'm gonna use it 136 136
using the set command. 137 137
So the same way you use set and option, 138 138
we're gonna set payload, so just like an option, 139 139
to the payload name that we just picked. 140 140
Now I'm gonna do a show options to see if there is any 141 141
other options that I need to set. 142 142
And yes, because we picked a payload now 143 143
there is more options. 144 144
So there is an option called L-HOST 145 145
and it's the listening address which is my own address. 146 146
So I'm gonna get my own IP address using if config. 147 147
And my own address is 10.20.14.203. 148 148
So I'm gonna close this 149 149
and I'm gonna set the L-HOST. 150 150
So it's like the same way that we set the R-Host before, 151 151
we set the L-HOST. 152 152
Do 10. 153 153
20. 154 154
So, before we used to do set R-HOST to set this option, 155 155
now we're setting the L-HOST to set this particular option. 156 156
So set is really simple, set, you put the option name 157 157
and then the value that you wanna set it to. 158 158
Then I'm gonna do show options 159 159
and now everything seems fine. 160 160
So we're using this exploit, the R-HOST is set to this, 161 161
which is okay. 162 162
And then the L-HOST is set to this which is perfect. 163 163
And then you can also set the port 164 164
that you're gonna be listening on, on your current computer. 165 165
You can actually set it to 80 if you wanted to, 166 166
that's the port that is used by web browsers. 167 167
So if you set the L-PORT to 80, the target computer will try 168 168
to connect to you using port 80 which is never filtered on 169 169
firewalls because that's the port that web browsers 170 170
or web servers use. 171 171
So whenever you access a website you actually access port 80 172 172
on that website. 173 173
So if you open port 80 on your machine and the target 174 174
connects to you on 80, then the firewall will think 175 175
that the target is only browsing the internet. 176 176
I'm not gonna do that now because I have a web server 177 177
running on port 80 and that will conflict. 178 178
So I'm just gonna set the L-PORT 179 179
to 555 just for example of you, just to see that you can 180 180
change any option using the same way which is set, 181 181
the option name and then the value. 182 182
So I'm gonna do show options again. 183 183
And as you can see, this has been changed to 5555 184 184
and I'm gonna do exploit to run the exploit. 185 185
Now as you can see, 186 186
it's telling me that session one has been opened. 187 187
And the connection is between this device and this device. 188 188
Which is the target and my device. 189 189
So I'm gonna do a pwd 190 190
and, or I do an id. 191 191
You'll see that I'm root therefore I do a uname -a. 192 192
You'll see I'm in the Metasploitable machine 193 193
and if I do an ls, I'll be able to list the files and so on. 194 194
I can use any Linux command, just like we did before 195 195
in the other videos.