Metasploitable 2 Walkthrough: Part VIII

Exploiting Port 3632 – DistCC

DistCCd is the server for the DistCC distributed compiler. It accepts and runs compilation jobs for network clients. Metasploit has a module to exploit this service.

This is another low privileged account.

Exploiting Port 5432 – PostgreSQL

One of the first pieces of information you will need, even before running a brute-force attack on a PostgreSQL login, is a database name.

Fortunately, the way that PostgreSQL works is by shipping with a default database called template1 that is the template database from which all other databases are created. This means that you can (probably) always find a database named template1 in any PostgreSQL database.

There is also a template0 database, which contains no local settings and is even more basic than template1, so there should always be at least these two known databases in any PostgreSQL service.

Brute forcing PostgreSQL using Metasploit

There are several Metasploit modules to be used against PostgreSQL, but you should start with the one that might give you access to the database.

The procedure is exactly the same as for the previous services:

• Load module
• Check default options
• Select user and password files, or other creds
• Run module

Try to run the module with the default settings, adjusting only the IP of the target machine

Another option is to use the credentials previously found and stored in the workspace

In this case, the result is exactly the same.

Now that you have login credentials for the PostgreSQL server, use them to do admin stuff like running arbitrary SQL statements with Postgres.

NOTE: Brute forcing the service using Hydra is exactly the same as it was done for previous services

Exploiting PostgreSQL using Metasploit

Load the auxiliary admin module to run the SQL commands

As you can see, the default options are almost perfect. Try to get the names of the existing databases:

Postgres implements its databases differently from MySQL, so to list all the databases, you need a different command then "SHOW DATABASES". For PostgreSQL, you can use the pg_database database.

The following SQL command gets names of databases from pg_database:

select datname from pg_database;

the following also works:

select pg_database.datname from pg_database;

Getting the /etc/passwd using PostgreSQL

With MySQL, you were able to obtain files on the remote machine using the SQL statement select load_file(\'/etc/passwd\'). However, the load_file function isn't available in PostgreSQL.

PostgreSQL implements it as load:

load \'/etc/passwd\'

This has a problem; invalid ELF header. (Like it is trying to load a binary file...?). So, this module doesn't allow you to load files as easily as, say, MySQL. Maybe you can try a different module.

Again, almost perfect default options.

It works perfectly, with an important bonus. Take a look at the end of the module output:

The contents of the /etc/password were saved inside the workspace for later use. You can see it with the loot command:

Delivering a payload with PostgreSQL

To deliver a payload, use the payload module associated with PostgreSQL.

Dumping the PostgreSQL database

To dump the contents of a PostgreSQL database, use the pg_dump command.

You can check all the flags with man pg_dump, but the basic ones you will need are:

• Username
• Password (does not accept password typed as an argument on command line, apparently?)
• Database (one of the three above, postgres, template0, or template1)
• Table (you can use wildcards to match table names)
• A file to capture all the output

Like mysqldump, pg_dump will output the SQL commands required to exactly replicate the database and tables selected.

However, unlike mysqldump, postgres implements an additional layer, implemented within SQL itself, that enables a lot of additional functionality. This implements all sorts of different databases and tables for PostgreSQL user management and function definitions.

While this represents a huge attack surface that would make malicious code difficult to find, this PostgreSQL database does not appear to be used for anything. The port is open and the server is listening, but there is no purpose. (Other than to provide Metasploitable users another route into the machine.)

That means that --table='*' will dump out a lot of superfluous stuff.

Metasploitable 2 Walkthrough: Part VII

Exploiting Port 3306 – MySQL

MySQL is an open-source relational database management system. A relational database organizes data into one or more data tables in which data types may be related to each other.

There are several possibilities to explore when connecting to the MySQL service running on the Metasploitable 2 VM

Blank password

The MySQL database in Metasploitable 2 has negligible security so you can connect to it using the MySQL function of Kali by defining the username and host IP. The password will be left blank.

Once you have root access to the database access you can do anything

Brute forcing MySQL using Hydra

Brute forcing MySQL is in its essence the same as brute forcing any other applications and therefore similar tools and techniques can be used

Brute forcing MySQL using Metasploit

Use the proper auxiliary module. Note that in order to successfully use this, you'll need some wordlists for username and password combinations. Try using a single user (root) and the rockyou list for passwords:

The result is the same as before; the root account has a blank password.

Exploiting My SQL using Metasploit

Once you have credentials to connect to the MySQL server, you will want to pivot from recon mode to attack mode. This means you'll be using different exploits from MSF. Whereas the initial exploit was a scanner, the subsequent exploits will be admin exploits.

There are two different ways to exploit the MySQL server to obtain system information and database information. These are covered below.

The mysql_sql auxiliary module can be used to connect to the remote database and execute SQL commands. As an example, execute SQL's load_file() function to scan the contents of the /etc/passwd file and get a list of users on the system.

Enumerating MySQL users with Metasploit

This module will enumerate all of the MySQL accounts on the system and their various privileges.

Since we already have access to the root user in MySQL, there's no need to brute force other login names. However, if there were many users in a complex database, this might yield a treasure trove of usernames with different privileges, allowing you to see different sections of the database.

Take a look at the credentials you have stored so far:

Dumping the MySQL database contents

Use the show databases SQL command to show the databases available.

Use the use databasename SQL command to use a particular database.

Once you've selected a particular database, you can start to explore it.

Select a different database and explore it

You can use the describe command to describe the fields in each SQL table, as well as data types.

Dumping the MySQL database contents using mysqlshow

You can also use mysqlshow to easily show the contents of the database. Use the host option to use a remote database.

Dumping the MySQL database contents using mysqldump

Like the mysqlshow command, the mysqldump command accepts the host argument. To dump a table, run the command like this:

# mysqldump --host=10.0.0.27 [database] [tablename]

This will result in an SQL script that will recreate the entire database from scratch. Be careful and make sure you use mysqlshow –count before, to avoid dumping out a 500 GB database.

DVWA

Try it with the dvwa database:

Unfortunately, the current version of mysqldump doesn’t work with the currently available version of Metasploitable 2. An older Kali version (2015) will work just fine and dumping the dvwa web app reveals some usernames and password hashes.

From this, we can see a couple of interesting things.

First, we have 5 users in this web app. The password field of the table consists of strings of 33 characters, in hex. You can use Hash-Identifier to identify the hash.

Looks like it is an MD5 hash. My advice; pay attention to the gathered info but don’t waste time trying to crack this.

OWASP10

The owasp10 database has some very good info too.

One table has plain-text passwords.

Another has credit card details

Several other tools can be used to enumerate and exploit this MySQL database but all revolve around the same basic procedures.

Metasploitable 2 Walkthrough: Part VI

Exploiting Port 1009 – Java RMI

GNU Classpath is a set of essential libraries for supporting the Java programming language. The Metasploitable VM runs a remote object registry for GNU Classpath using default credentials which can be leveraged to gain a shell on the machine using the Java RMI Server Insecure Default Configuration Java Code Execution Metasploit module.

This exploit is quite straight forward; just choose the exploit, set the proper options and run.

NOTE: After this exploit will need to reboot the Metasploitable2 as it will go to 100% CPU.

NOTE: There is another exploit available for this port (exploit/multi/browser/java_rmi_connection_impl) but it only creates a local listener ready to accept connections from the Metasploitable machine. It can be used in conjunction with the previous exploit or with other Java malicious implants to create persistence on the target machine.

Exploiting Port 1524 – Shell

Many attack scripts install a backdoor shell at this port.

Exploiting Bindshell service

Metasploitable 2 comes with an open bindshell service running on port 1524. Use Netcat to connect to it.

Exploiting Ingreslock service

Ingreslock is used legitimately to lock parts of an Ingres database. However, there are known trojans that also use port 1524 as a backdoor into a system. Some sysadmins allow this port to be open thinking it is needed.

This vulnerability could fall into the same group as Telnet, and rlogin, in the sense that it can be used as an unintentional backdoor. All you need to do is connect via Telnet to the port to gain access to the victim’s machine. You will be logged in with the same rights as the user in which the service is running.

Exploiting Port 2121 – ProFTPD

Telnet access

Connect to the target machine’s port 2121 via Telnet using the default credentials for Metasploitable 2.

FTP access

The FTP access can be brute forced exactly like you did for the vsFTPd running on port 21. Likewise, the connection to the ProFTPD is a normal FTP connection. Try using the “user” account:

From here you can GET these files and open them to extract additional info. Or you can try to login with one of the other accounts.

Exploiting Port 2049 – NFS

The Network File System is a distributed file system protocol allows a user on a client computer to access files over a network in the same way they would access a local storage file.

Connecting to NFS

Start by checking out what network services are running - use the rpcinfo command to do that:

There is an NFS service listening on port 2049 and need you need to use the showmount command to show what file systems are mountable on this NFS.

Yes! The entire filesystem is mountable/writable! To mount the network filesystem, you need to run the RPC service rpcbind. Start the service, create a temporary directory to act as a mount point, and then mount the filesystem at the IP address, with no credentials.

Abusing NFS to escalate privileges

Now you can abuse your write access to the filesystem. You can also download anything you want from the remote machine, like the shadow file to crack the passwords with John the Ripper.

Or you can try a different form of privilege escalation by copying an SSH key into the remote machine's trusted SSH keys, and obtain passwordless remote access. In this method, you will create an SSH key without a passphrase and exchange it with the SSH key of the victim machine for the root user.

You start by using ssh-keygen to generate an RSA keypair without a key phrase

Now you will place that key in the /root/.ssh folder where the key is found by default.

Don’t forget to unmount the remote file system

Now you have SSH root access without a password!