Metasploitable 3 Ubuntu Walkthrough: Part IV

Exploiting Port 80 – Apache Server

Let’s start by getting as much information as possible about the remote website. Let’s try getting some additional information with Metasploit:

There is something interesting here; the /cgi-bin/ directory. Is there any exploit for this?

There is a Metasploit module to exploit his vulnerability:

Another failed attempt. This was supposed to work, but it didn’t…

Exploiting Port 80 – WebDAV

Let’s get more information about the target using Directory Buster:

The uploads directory appears to be promising. But is it writable? Let’s check it out. You can do WebDav Enumeration using Metasploit.

As you can see, the uploads directory is writable and a number of different file formats can be uploaded over there.

From here you need to create a payload, deploy it, set up a listener, execute the payload and you will have a shell…!

For detailed step-by-step instructions using multiple tools and options, please check my other Metasploitable 3 tutorial.

Metasploitable 3 Ubuntu Walkthrough: Part III

Exploiting Port 80 – Drupal

Drupal is a free and open-source web content management framework written in PHP and distributed under the GNU General Public License.

When browsing port 80 with Firefox, Apache will present you with a directory listing containing a number of entries:

If you go back to the OpenVAS report, you will see a lot of potential on port 80:

The first thing to do should be to identify Drupal’s version. Analyzing the source code for the Drupal page you can immediately get some information about the website’s structure, namely the fact that many things are coming from the drupal/modules folder.

Digging and researching online will lead you to the discovery of the blog.info file located inside the drupal/modules/blog folder.

Now you know Drupal is version 7.5

Exploiting Drupal using Metasploit

Searching inside MSF, you will find there are several modules available to use against Drupal:

Comparing this list with the vulnerabilities identified by OpenVAS will tell you exploits 2 and 3 are probably going to succeed.

Let’s try to exploit the SQL Injection vulnerability:

This is a low privilege session…

NOTES:

• The targeturi was set to /drupal/ instead of root (/) because that is the Drupal directory on the Apache web server.
• This exploit is supposed to work only against Drupal 7.0 and 7.31 (the vulnerability was fixed in 7.32). The server apparently has version 7.5 and is still vulnerable.

Now let’s try to exploit the remote code execution vulnerability:

And this is another low privilege shell…

Exploiting Port 80 – Payroll Application

Another interesting item is the file payroll_app.php. Clicking on it will load a Payroll Login interface.

The Nmap scan identified a MySQL server running on Metasploitable3. Therefore, it might be a good idea to try a basic SQL injection attack. Let’s use the classic ' OR 1=1#.

Clicking the Ok button with the classic injection string in the User input box will immediately reveal a total of 15 users in the Payroll App.

This could be the beginning of a real SQL Injection attack but instead I went after the code for the Payroll app. I remembered the file was listed in a previous exploit, namely ProFTPD. So, I repeated the exploit and investigated the contents of the file payroll_app.php.

These appear to be the credentials for the Payroll application but they are not…

However, let’s not forget about these credentials as they might still be useful.

Exploiting Port 80 – phpMyAdmin

Opening the phpMyAdmin link will take you to the service login page:

Brute forcing phpMyAdmin using Hydra

Brute forcing this service requires a bit of research but nothing special. You can use the wordlists provided with Kali, or you can add the previous credentials to the customized wordlists.

The credentials are valid for the phpMyAdmin service!

Brute forcing phpMyAdmin using Metasploit

There is a scanner module to use against phpMyAdmin but it’s broken and therefore completely useless:

Exploiting phpMyAdmin using Metasploit

The phpMyAdmin web application running on Metasploitable 3 has a remote code execution vulnerability which can be exploited using the phpmyadmin_preg_replace module:

Unfortunately, something went wrong with this exploit. It might be a simple thing but I decided not to waste time investigating it. Instead, I tried to use the previously collected credentials…

It worked! The created session is a low privilege one, but this means the credentials are valid for phpMyAdmin. Therefore, instead of using them inside MSF, why not use them directly in the phpMyAdmin login page?

From here, everything is your disposal. Take a look at the users table inside the payroll database:

You still need to get root access to the target, so why don’t you add all this information to your user/pass custom wordlists and try to brute force SSH again?

It works! All these accounts have SSH access and on top of that, Leia, Luke, and Han all have sudo privileges so some of these sessions have root access to the target machine.

Metasploitable 3 Ubuntu Walkthrough: Part II

Exploiting Port 21 – ProFTPD

The FTP service can potentially be exploited in several ways. Let’s try a few of them. Users can access the Metasploitable VM by logging into the FTP server with a valid set of credentials. Therefore, it is a good idea to try get access to this service. Pay attention to the results you got from OpenVAS:

Brute forcing ProFTPD using Hydra

Kali Linux has a number of wordlists that can be used for this purpose. Let’s use Hydra to launch an attack:

hydra -L [users file] -P [passwords file] [IP] [service]

This will take a very long time because the tool will try every password for each user. And it might not return any good results unless you use carefully selected wordlists.

Brute forcing ProFTPD using Nmap

Using wordlists provided with Kali, and using the proper Nmap script (ftp-brute) you will also get positive results and sometimes faster than you what can get using Hydra.

Brute forcing ProFTPD using Metasploit

Metasploit has an auxiliary module that can also be used to brute FTP force passwords just like Hydra did. I like to use it last with custom wordlists.

Using the custom wordlists previously created will produce the same results. But using Metasploit has a major advantage over Hydra because the credentials found are automatically added to the database.

Enumerating via ProFTPD

Once you have found a valid credential set, you can use it to login to the remote FTP server:

You have now a list of the systems’ users and you can explore further to get extra data.

Exploiting ProFTPD using Metasploit

If you look closely at the OpenVAS scan results, you will see this:

Searching for an exploit in MSF will return these results:

As you can see, there a specific module for this vulnerability. Use it!

This exploit gained remote access as the www-data user. Not very useful but always better than nothing, right?

Don’t forget to clean your tracks by removing the payload used.

Exploiting Port 22 – SSH

This port/service can also be attacked using the usual tool of the trade. Besides, keep in mind that sometimes it will be easy to get credentials for other running services. Then, using the previously identified credentials it is easy to create a small custom list of usernames and passwords and attempt to get more using the usual tools.

Brute forcing SSH using Hydra

Basically, the same as before, but this time much slower due to limitation in SSH.

Brute forcing SSH using Nmap

Using Kali’s wordlists, you will get some results.

Brute forcing SSH using Metasploit

Now that you have at least one valid credential, it might be a good idea to use it in Metasploit. Each successful login will immediately open a session on the remote machine and the valid credentials are added to the MSF database.

You will get a command session and you can upgrade it to a Meterpreter session!