Instructor: Okay, my scan is over. 2 2
And I'm here now at the assets page. 3 3
And as you can see that we have one asset. 4 4
Has been scanned. 5 5
We can see that the asset is running Ubuntu 6 6
and the skills that you need 7 7
to hack into this asset is novice. 8 8
Now already from this you can see that Nexpose 9 9
show us much more information than Metasploit Community, 10 10
and it's a much more advanced 11 11
vulnerability management framework. 12 12
We can see that we scanned one target, 13 13
it's Metasploitable, and the site is Global. 14 14
Let me zoom in. 15 15
It's running on Ubuntu Linux 8.04. 16 16
We discovered no malware and 177 exploits, 17 17
308 vulnerabilities. 18 18
Remember with Metasploit Community, 19 19
I think we only only discovered eight, 20 20
only one exploitable vulnerability, 21 21
and eight modules that can be used. 22 22
Here we discovered 308 vulnerabilities, 23 23
so it's covered so many more vulnerabilities and exploits. 24 24
You can see that there is a risk factor assessed to this 25 25
and the last time that the scan was done. 26 26
Now if we go down we can see that the operating system 27 27
that we discovered again, it's Metasploit. 28 28
We can see the software that is installed 29 29
on the target computer. 30 30
So not only the services that's running on ports, 31 31
we can see actual software installed on the target computer. 32 32
This can be very useful after we have the computer, 33 33
so after we've managed to hack into it, 34 34
it's very useful to find local exploits 35 35
that can be used to increase our privileges, 36 36
for example, if you got a normal user 37 37
and you wanted to become a route, then you can use 38 38
a local buffer overflow to increase your privileges 39 39
or to do other kind of stuff. 40 40
So these are very useful in terms of post-exploitation. 41 41
If we go down, we'll see the services that's installed 42 42
on the target computer. 43 43
Just like UNMAP gave it to us, 44 44
we can see that HTTPs running, 45 45
DNS, and so on. 46 46
If you click on any of these services, 47 47
you'll see that it'll give you more information about it, 48 48
for example it's a HTTP service, a description about it 49 49
and the ports that it's running on. 50 50
So we can see that HTTPs running on port 80, 51 51
and on port 8180. 52 52
Now let's go up. 53 53
And if we wanted to have a closer look 54 54
on the vulnerabilities, 55 55
we can go to the vulnerabilities page here. 56 56
And you can see we have a graph here 57 57
about the vulnerabilities, 58 58
categorized based on their risk factor. 59 59
And here they're categorized based on the skill level 60 60
needed in order to exploit these vulnerabilities. 61 61
And in here you can see a list of all of them 62 62
and we can switch between them using this right here. 63 63
Again, this, if there is any malware, 64 64
you'll see it in here. 65 65
And if there is an exploitation you'll see it in here. 66 66
Now all of these top vulnerabilities here 67 67
don't have an exploitation using their tool 68 68
but they are ordered based on their risk. 69 69
So these are very risky vulnerabilities 70 70
and then as we proceed through them, 71 71
the risk will be a bit less. 72 72
So you can see here I discovered that VNC password 73 73
is 'password', so we can go in and try to connect using VNC. 74 74
Now VNC is a service very similar to Remote Desktop, 75 75
basically it'll show you the desktop 76 76
and it'll allow you to gain full access 77 77
to the target computer, just like Remote Desktop. 78 78
I'm not gonna show you how to do that, very simple. 79 79
Was telling you here, the password is 'password', 80 80
now it's also telling you that there is a backdoor running 81 81
and we used that already. 82 82
It's telling us that it's running an old version of PHP 83 83
that can be exploitable, just an old version actually. 84 84
Now let's look at something that can be exploitable. 85 85
So I'm gonna click on this to order them by the exploit, 86 86
and you can see that all of these have an 'M' logo, 87 87
which means that they can be exploited using Metasploit. 88 88
You can see here we have the remote shell service 89 89
that we use, and there is the rlogin service here 90 90
that can be used as well, that we already had a look on. 91 91
So let's click on something that we haven't seen before. 92 92
And here you can see a description of this vulnerability. 93 93
Again, you can see the port that it's running on. 94 94
And you can see why it thinks that this particular target 95 95
is vulnerable to this exploit. 96 96
If you go down, it'll show you how you can exploit it. 97 97
So there's three different modules 98 98
that can be used to exploit it. 99 99
But it doesn't really have to exploit it, 100 100
sometimes you just see modules that can be used 101 101
to verify the existence of this exploit. 102 102
But basically these are modules associated with it. 103 103
And if we click on this it'll take us to the Rapid7 page 104 104
that we always use to see when we Google stuff. 105 105
And we see the module name where we can just copy 106 106
and paste it in Metasploit and it shows the options 107 107
and then use this exploit the same way that we seeing it 108 108
in previous videos. 109 109
Again when you go down, you'll see references to this, 110 110
to this particular exploit. 111 111
And at the bottom it'll show you the solution 112 112
on how you can fix this exploit. 113 113
So for this one, all you need to do 114 114
is just change the administrator password 115 115
and not use the default configuration. 116 116
Another useful thing is the reports. 117 117
So this framework allow you to generate reports 118 118
for each scan that you do. 119 119
And there is different types of templates for the reports 120 120
so if you go on Create Report, 121 121
you can see that there is an audit report 122 122
that contains a lot of information, detailed information 123 123
for the programmers or for the technical people. 124 124
Or you can use an executive report 125 125
which has less information and it's made for the managers 126 126
or for the top level people that don't have much experience 127 127
with technical stuff. 128 128
You can select any template you want, call it anything, 129 129
so I'm gonna call this 'Metasploitable' or 'Metasploit'. 130 130
And you select the format that you want, 131 131
so it's set to PDF here. 132 132
Then I'm going to select the target scan 133 133
that I want to generate the report for, 134 134
and I selected my Metasploitable. 135 135
And then you save, and run the report, 136 136
to generate the report. 137 137
You can also get this to generate reports automatically 138 138
every time, 'cause as I showed you, 139 139
you can schedule reports, you can schedule scans, 140 140
and you can also schedule an automatic report 141 141
after each time a scan is done. 142 142
So for example, if you're scanning every week, 143 143
you can also generate a report every week, 144 144
every time that scans done. 145 145
Now let me just download the report and show you 146 146
what it looks like. 147 147
As you can see it has the date, it has the title, 148 148
it has all the exploits that have been found. 149 149
But this is the executive report so it has small details 150 150
about the exploits and more graphical stuff 151 151
to show the executives the risks that has been found 152 152
and how critical they are. 153 153
So as you can see, Nexpose shows you much more detail 154 154
and it's much more advanced. 155 155
It's directed towards bigger companies, 156 156
bigger infrastructures, where you need to always make sure 157 157
everything is up to date, and everything is installed, 158 158
and does not have any exploits.