Metasploitable 2 Walkthrough: Part V

Exploiting Port 139 – NetBIOS Session Service, Samba

Session mode lets two computers establish a connection, allows messages to span multiple packets, and provides error detection and recovery. Do you remember what is the exact Samba version that is running on the Metasploitlabe2 VM? Use Nmap to refresh your memory:

The vulnerability in this service takes advantage of the username map script functionality of Samba. There is no filtering of user input, so an attacker could connect to an SMB session, and use shell metacharacters as input for the username, causing the commands to be executed on the remote system. This could allow the attacker to gain a remote shell to the victim machine with root access.

This is extremely easy, just load the Metasploit module and run it.

The default port for the previous exploit is set to port 139 but it can be changed to port 445 as well.

Exploiting Port 445 – SMB, Samba

Confirm version number with Metasploit:

This version of Samba has several vulnerabilities that can be exploited. The first you will explore is the issue with “wide links” being enabled. This feature is enabled by default on older versions of Samba.

It can be exploited to gain access to file shares without authenticating through SMB.

Exploiting SMB using smbclient

You can use a tool called smbclient to connect to the Metasploitable box, and list the available shares without having a valid username/password. Just hit enter when it asks for root’s password, and it will grant you anonymous access.

NOTE: In the current Kali version you will need to edit the /etc/samba/smb.conf to get the proper results.

You can get even better results from smbmap:

What is really important is that you have found a possibly exploitable directory, “tmp”. There is an exploit for this in MSF:

The exploit was successful, so now you can connect again using smbclient, and see if you can get to the rootfs dir.

So, now you have access to browse the root file system. You could continue enumerating the machine, looking at various config files, etc., to see if we can find any other holes. Please note you don’t have full root access here, so some files/directories will not be accessible.

Exploiting Ports 512, 513, 514: r-Services

TCP ports 512, 513, and 514 are known as “r-services”, and have been misconfigured to allow remote access from any host.

These are related to the historically insecure Berkeley r-commands developed back in 1982 based on an early implementation of the TCP/IP protocol stack.

To take advantage of this, make sure the "rsh-client" client is installed (otherwise the system would default to SSH connections), and run rlogin command as your local root user.

NOTE: Current Kali does not include the rsh-client tool. To install it just type apt-get install rsh-client

Exploiting rexec

It is not possible anymore to install the rexec command on Kali and therefore you cannot take advantage of the vulnerable port 512.

Exploiting rlogin

The rlogin command will automatically connect to port 513 and give you a root shell:

Exploiting rshell

The rshell command will automatically connect to port 514 and give you a root shell.

If you run this command (and the same for rlogin) as root, you don’t need to specify it in the command line:

Metasploitable 2 Walkthrough: Part IV

Exploiting Port 80 – PHP

Navigating to the root of the web server, you will see some vulnerable web applications, along with the msfadmin account details which you got earlier with Telnet.

The Mutillidae and the DVWA web applications are outside the scope of this post because this is mostly focused on host-based exploitation. However, you can use easily exploit the other web applications to get a shell.

Exploiting PHP using Metasploit

You know port 80 is open so you type the IP address of Metasploitable 2 in our browser and notice that it is running PHP. If you dig a little further you will find which version of PHP is running and also that it is being run as a CGI.

When running as a CGI, PHP up to version 5.3.12 and 5.4.2 is vulnerable to an argument injection vulnerability.

Search and use the appropriate MSF module to get a shell.

Exploiting Port 80 - TWiki

TWiki is a Perl-based structured wiki application, typically used to run a collaboration platform, knowledge or document management system, a knowledge base, or team portal. Users can create wiki pages using the TWiki Markup Language, and developers can extend wiki application functionality with plugin.

Exploiting TWiki using Metasploit

The OpenVAS scan certainly revealed that the TWiki web application is vulnerable to remote code execution. There are some exploits available in MSF for this application.

Both twiki_history and twiki_search are supposed to work flawlessly but that does not appear to be the case.

Confusing, but the session is created.

The other one refuses to create a session…

Exploiting Port 80 - WebDAV

WebDAV stands for Web Distributed Authoring and Versioning. The WebDAV protocol provides a framework for users to create, change and move documents on a server, typically a web server or web share. WebDAV is exploitable in many different ways.

Exploiting WebDAV using Davtest

You can test out DAV using the davtest command line utility. To scan a WebDAV server using the program just specify the URL:

From the davtest scan, you saw a bunch of actions failed. I guess that means you need credentials to do anything. Or maybe you need a better tool…

Exploiting WebDAV using Cadaver

Cadaver is a utility for dealing with WebDAV systems on the command line. With cadaver, we can connect to the DAV server directly. It turns out this method does not require credentials. Once we type the cadaver command to connect to the server, we're immediately connected. Once connected you can issue a number of different commands.

What this means is, you have access to the WebDAV directory, therefore you can create files. Namely, you can upload web shells to the WebDAV server.

Web shells are the scripts which are coded in many languages like PHP, Python, ASP, Perl and so on which further use as backdoor for illegitimate access in any server by uploading it on a web server. The attacker can then directly perform the read and write operation once the backdoor is uploaded to a destination, you can edit any file of delete the server file.

Kali Linux has inbuilt web shells PHP scripts. They are stored inside /usr/share/webshells/php and a pentester can make use of them without wasting time in writing PHP code for the malicious script.

You can take advantage of these scripts to get a remote shell. You start by uploading the script to the server using cadaver.

Upload the simple-backdoor script:

Then you execute the script on the web browser.

The script is now ready to execute commands

Try using a different script (php-backdoor)

This script will give you true web shell to perform a number of tasks:

Run a command:

Try a different script (qsd-php-backdoor):

And you will get an even better web shell:

You can also create a reverse shell but for that you need to edit the script in order to adjust the settings to your needs. Namely, you will need to insert the IP address of your attacker machine so that the victim knows where to send the shell.

Edit the php-reverse-shell.php file and make the necessary changes:

Now put the script on the server with cadaver, start a Netcat listener, and open the script with the web browser as before:

And you will get a shell:

Exploiting WebDAV using Metasploit

To check for WebDAV, you can use a couple of different modules:

Wrong results…

Also, not very useful…

Nothing…

But if you manage to find a writable directory, you can use it to get a remote shell.

Creating a payload with MSFVenom

The msfvenom utility can be used to generate a reverse TCP shell in a PHP script. Basically, here's what you specify with msfvenom:

• LHOST - This is the machine that you want your target machine to try and connect to. This must be the publicly-visible (or at least visible to the target) IP of your attacker machine.
• LPORT - this is the port number that you want the target machine to connect to. The attacker machine must have this port open, for the target to connect to it.

In this case, 172.16.1.6 is the IP of the attacker machine and 4444 the listener port on the attacker.

Now use cadaver to connect and put the PHP shell onto the web server:

Now start a Metasploit listener using the proper MSF module and choosing the proper payload:

This will wait for the reverse connection from the target machine.

The final step is to execute the PHP file. Click the PHP file or visit its URL in the browser.

This will execute the PHP code, create a shell, and open a connection to your Metasploit console.

Exploiting Port 80 - Apache Server

This chapter will cover techniques for exploiting the Metasploitable Apache server (running Apache 2.2.8). It will start with some general techniques (working for most web servers), then move to the Apache-specific.

This will also ignore the Tomcat server - we'll get to that later.

Exploiting Apache Server using Metasploit

Let’s try some MSF modules:

The files_dir module checks for the presence of any interesting files on the web server. By default, it uses a dictionary list that comes with Metasploit (/usr/share/metasploit-framework/data/wmap/wmap_files.txt) but you can also use your own.

Some directories return the HTTP code 301 (Moved Permanently).

Telnet to explore the 301s

If we use telnet to connect to port 80 and send a GET request for a resource that returns a 301, we can see more information:

Connect to port 80 and type out a GET request, with the location being requested, and specify the host (then press ENTER to make a new line):

You will get a phpMyAdmin page that looks like it has lots of information that could be fuzzed. However, fuzzing the phpMyAdmin login page (and attacking vulnerabilities in phpMyAdmin itself) will launch you into a whole new set of tools and concepts, so we'll leave that for some other time.

Try some other MSF modules:

Funny, it doesn’t even show the previously found directories

This next one will find some additional directories

There are many Apache-specific modules and that makes it difficult to figure out where to begin. Take a look at Legion/Nikto scan results and you’ll see the following vulnerability:

Load the Metasploit module to scan for this vulnerability:

Running it confirms that the Apache web server is vulnerable (IP addresses of vulnerable web servers are printed out).

Now load the other auxiliary module to try to take advantage of the vulnerability:

In this case, nothing happens confirming what you have found before; the index.php is the only file available on this Apache server.

Metasploitable 2 Walkthrough: Part III

Exploiting Port 25 – SMTP

SMTP stands for Simple Mail Transport Protocol and is a server-to-server protocol and keeps a local database of users to which it must send and receive emails.

Exploiting SMTP using Metasploit

Our first task is to determine which software and version is running behind port 25. Metasploit has an auxiliary module for you to use, so try it:

Now you can search in Google, ExploitDB, etc.

And you can also try to enumerate the service users, using the proper Metasploit module.

The module was able to extract a list of users in the SMTP service

Exploiting SMTP using other tools

SMTP has a set of commands that can be used for several tasks. You can to connect to your target through port 25 using Netcat and then get info on the email’s database using the SMTP commands.

Or, instead of verifying users one by one, you can try to use other tools.

smtp-user-enum -M VRFY -U user.txt -t [Target IP]

or

smtp-user-enum -M VRFY -u root -t [Target IP]

And you can also use Nmap to enumerate the target but the script appears to have problems.

nmap --script smtp-enum-users -p 25 [Target IP]

As a side note, keep in mind the existence of enum4linux:

enum4linux -U [Target IP]

However, these options rely on old scripts/apps created in now obsolete versions of Perl or Python so don’t be surprised if they don’t always produce the best results when used inside the current Kali version (2020.3)

Exploiting Port 53 – BIND

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) of the Internet. It performs both of the main DNS server roles, acting as an authoritative name server for domains, and acting as a recursive resolver in the network. As of 2015, it is the most widely used domain name server software and is the de facto standard on Unix-like operating systems.

Searching for exploits for ISC BIND 9.4.2, you will find the following exploit:

https://www.exploit-db.com/exploits/6122/

This exploit is labeled auxiliary/spoof/dns/bailiwicked_domain in Metasploit and it will allow you to insert malicious DNS records into the DNS server.

Exploiting DNS: bailiwicked domain

This attack allows you to add your own DNS entries to a target DNS nameserver. Thus, you could create a DNS entry like somethingveryevil.microsoft.com that would direct visitors wherever you wish.

After setting the options for the module, it should be possible to test it, but it fails:

And the exploit itself also fails.

Exploiting DNS: bailiwicked host

This attack allows you to add your own host entry to a DNS nameserver's list of hostnames. This is done by confusing the nameserver by sending responses to fake DNS queries.

Similar exploit, similar results.