Instructor: Now that we understand 2 2
the concept of pivoting, 3 3
it's really not that difficult to perform. 4 4
All we need to do is we can upload any tool we need to use, 5 5
for example, if you wanted to use Nmap 6 6
or ARP spoof or Desniff, 7 7
you can upload any of these tools, 8 8
run them on this computer 9 9
which is connected to this big network 10 10
and then you can run a port scanner on this, 11 11
you can do ARP poisoning and do man-in-the-middle attacks 12 12
like we learned before, it's very simple. 13 13
All you have to do is use the upload command, 14 14
upload it here and use it from the command-line 15 15
like we were using it anyway in the previous videos. 16 16
What I'm gonna show you today 17 17
is how to set up a route 18 18
between the hacked computer and your computer 19 19
so that you can use any Metasploit auxiliary 20 20
or module against this big network. 21 21
So we'll be able to use Metasploit exploits, 22 22
we'll be able to use port scanners 23 23
that come in with Metasploit 24 24
and other useful modules. 25 25
So to do that, we're going to use a module 26 26
called autoroute and let me show you first 27 27
how if I try to run exploit 28 28
on the target computer on the Metasploitable computer, 29 29
it's not gonna work because it's not visible to me. 30 30
So I'm gonna do a session list 31 31
and you see that I already have a connection 32 32
with the Windows computer here, 33 33
so I've already hacked it. 34 34
And I'm going to use exploit/multi/samba 35 35
and usermap_script. 36 36
Now, we already use this exploit 37 37
against a Metasploitable before. 38 38
But it was on the same network 39 39
so it was visible to us. 40 40
What we're doing now is trying attack a device 41 41
that is not visible to us. 42 42
And then I'm gonna do show options, 43 43
I'm gonna set my RHOST to 10.20.15.4 44 44
'cause that's the IP of the Metasploitable device. 45 45
Then I'm gonna do show payloads. 46 46
And I'm going to use this payload right here. 47 47
So I'm gonna do set PAYLOAD to this. 48 48
Show options. 49 49
Everything's set up properly, 50 50
so I'm gonna do exploit. 51 51
And you'll see that this exploit will time out 52 52
because if we go back to the diagram here, 53 53
this device cannot see this device, 54 54
so it's trying to run an exploit on this device, 55 55
even though this device has that vulnerability 56 56
but I won't be able to use it 57 57
because I can't see that device. 58 58
And as you can see now, 59 59
the exploit failed, connection timeout, 60 60
you just couldn't connect to the target computer. 61 61
So what I'm going to do now, 62 62
I'm gonna interact with my metepreter 63 63
on ID one so sessions -i one. 64 64
So I'm in my metepreter. 65 65
I'm gonna run ifconfig first 66 66
to see what my network look like 67 67
or the networks that the target computer is connected to. 68 68
So we can see all the interfaces connected 69 69
to the target computer 70 70
and I'm gonna look for interfaces with IP addresses. 71 71
So we have this interface number four has an IP address 72 72
and we can see that this IP address 73 73
is on our network, 74 74
so it's really not very useful. 75 75
It's already on our network, 76 76
we're on the 10.20.14 anyway on that subnet. 77 77
So this one is not very useful for me. 78 78
Another one that I can see is this 79 79
which is connected to 10.20.15.5. 80 80
So it's on a different subnet right here 81 81
which I cannot see from my Kali Linux device. 82 82
So I'm going to try to set a route 83 83
between this subnet and my current subnet. 84 84
So I'm gonna copy this. 85 85
And then I'm going to background my current session, 86 86
so I'm back in Metasploit 87 87
and I'll clear this. 88 88
Then I'm going to use 89 89
post/manage/windows.manage/autoroute. 90 90
Now, by the way, at any stage of this, 91 91
if you wanted to see all of the manage modules, 92 92
for example, you can just leave it at this 93 93
and double tap and you'll see all 94 94
the post Windows manage modules 95 95
and you can try and use them 96 96
and experiment with them. 97 97
So our one that we want to use is autoroute. 98 98
And I'm gonna do show options 99 99
to see the options that I can set. 100 100
And we have two options that we need to set. 101 101
We need to set the session 102 102
that we have 103 103
and the subnet. 104 104
So I'm gonna set the session first. 105 105
And it's session number one. 106 106
And then I'm gonna set the subnet to what we've seen 107 107
when we did the ifconfig command. 108 108
So it was 10.20.15 109 109
and I'm gonna put a zero to it. 110 110
So again, we're using the set, 111 111
very simple commands we already learned. 112 112
We're setting the session to number one, 113 113
that's the session that we hacked for the Windows 114 114
and the subnet is the subnet which the Windows 115 115
is connected to and we don't have access to 116 116
so it's the 10.20.15.0. 117 117
And I'm gonna do exploit. 118 118
And this will create the connection 119 119
or the route between my device 120 120
and the Windows device. 121 121
So what I'm going to do now, 122 122
I'm gonna go back to the same exploit 123 123
that I tried at the start of the video 124 124
and you'll see that the exploit 125 125
is going to work because the Windows device 126 126
is visible to me now. 127 127
So instead of using that exploit, 128 128
you can use, as I said, port scanners 129 129
or discovery modules 130 130
that can win with Metasploit 131 131
or any other module 132 132
that come with Metasploit 133 133
because my device can now see the target computer, 134 134
it can see this Metasploitable device 135 135
because it was not visible for me at the start, 136 136
but now I have a connection to this computer 137 137
and I set up a route between this network 138 138
and my computer 139 139
so I can actually see the Metasploitable device now. 140 140
So I'm going to use the exploit I used before. 141 141
And it was exploit/multi/samba/usermap_script. 142 142
Just clear that. 143 143
Now I'm gonna show the options 144 144
and I'm gonna leave them the same 145 145
because everything is actually set up correctly. 146 146
So I'm just gonna do exploit. 147 147
And as you can see, 148 148
now command shell was started properly 149 149
and I actually have access to the Metasploitable device now 150 150
so I can do id and I'm root. 151 151
I can do a uname -a to just confirm that for you. 152 152
And we can see that we're in the Metasploitable device 153 153
and I can run any Linux command that I want 154 154
so I can do ls, 155 155
pwd and I should be in the root. 156 156
And I can do cd. 157 157
Go to var, for example. 158 158
And do any Linux command that I want 159 159
so I basically have full access to the target computer. 160 160
Now again, as I said, you could upload stuff 161 161
and run them from the target computer 162 162
but it's not always a good idea 163 163
to upload things to a hacked computer, 164 164
so setting up the routes like this 165 165
and using pivoting is a much safer choice. 166 166
And I highly recommend that you go 167 167
and have a look on other Metasploitable modules 168 168
'cause Metasploit is really, really big, 169 169
it's hard for me to cover everything. 170 170
I just covered the main basic stuff 171 171
but you can always just go in 172 172
and have a look on other modules and try them. 173 173
Using the modules is usually the same. 174 174
We had a look on a broad array of modules, 175 175
so it should be easy to just configure options 176 176
and run these modules the way you want.