Vulnerability scanning : with Metasploit!

Scanning is one of the most important steps in the penetration testing
process; if done thoroughly, it will provide the best value to your
client.

A vulnerability scanner is an automated program designed to look for
weaknesses in computers, computer systems, networks, and applications.
A vulnerability scanner can also use a given set of user credentials to
log into the remote system and enumerate the software and services to
determine whether they are patched.

The Basic Vulnerability Scan :
we use netcat to grab a banner from the target 192.168.1.2. Banner
grabbing is the act of connecting to a remote network service and
reading the service identification (banner) that is returned.

root@kali:/opt/framework3/msf3# nc 192.168.1.2 80
GET HTTP 1/1
HTTP/1.1 400 Bad Request
Server: Microsoft-IIS/5.1

As you can see, The information returned tells us that the system
running on port 80 is a Microsoft IIS 5.1–based web server. Armed with
this information, we could use a vulnerability scanner to determine
whether this version of IIS has any vulnerabilities associated with it
and whether this particular server has been patched.

SMB Login Check :
A common situation to find yourself in is being in possession of a
valid username and password combination, and wondering where else you
can use it. This is where the SMB Login Check Scanner can be very
useful, as it will connect to a range of hosts and determine if the
username/password combination can access the target.

-----------------------
msf > use auxiliary/scanner/smb/smb_login
msf auxiliary(smb_login) > show options
      ---show options------

msf auxiliary(smb_login) > set RHOSTS 192.168.1.2 /24
RHOSTS => 192.168.1.2/24
msf auxiliary(smb_login) > set SMBUser user
SMBUser => user
msf auxiliary(smb_login) > set SMBPass pasword
SMBPass => pasword
msf auxiliary(smb_login) > set THREADS 50
THREADS => 50
msf auxiliary(smb_login) > run
--------------------------------------------

VNC Authentication :

The VNC Authentication None Scanner will search a range of IP addresses
looking for targets that are running a VNC server without a password
configured.

To utilize the VNC scanner, we first select the auxiliary module,
define our options, then let it run.
----------------------------------
msf auxiliary(vnc_none_auth) > use auxiliary/scanner/vnc/vnc_none_auth
msf auxiliary(vnc_none_auth) > show options

Module options:

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   RHOSTS                    yes       The target address range or CIDR identifier
   RPORT    5900             yes       The target port
   THREADS  1                yes       The number of concurrent threads

msf auxiliary(vnc_none_auth) > set RHOSTS 192.168.1.2 /24
RHOSTS => 192.168.1.2/24
msf auxiliary(vnc_none_auth) > set THREADS 50
THREADS => 50
msf auxiliary(vnc_none_auth) > run

Writing a Your Own Custom Scanner !

There are times where you may need a specific scanner, or having scan
activity conducted within Metasploit would be easier for scripting
purposes than using an external program. Metasploit has a lot of
features that can come in handy for this purpose, like access to all
of the exploit classes and methods, built in support for proxies, SSL,
reporting, and built in threading. Think of instances where you may
need to find every instance of a password on a system, or a scan for a
custom service.

Writing your own scanner module can also be extremely useful during
security audits by allowing you to locate every instance of a bad
password or you can scan in-house for a vulnerable service that needs
to be patched.

We will use this very simple TCP scanner that will connect to a host on
 a default port of 1337 which can be changed via the module options
at run time. Upon connecting to the server, it sends 'Hello world',
receives the response and prints it out along with the IP address of
the remote host.


Here is the Source code



----------------------------------------------------------------------
require 'msf/core'
class Metasploit3 < Msf::Auxiliary
        include Msf::Exploit::Remote::Tcp
        include Msf::Auxiliary::Scanner
        def initialize
                super(
                        'Name'           => 'My custom TCP scan',
                        'Version'        => '$Revision: 1 $',
                        'Description'    => 'My quick scanner',
                        'Author'         => 'Your name here',
                        'License'        => MSF_LICENSE
                )
                register_options(
                        [
                                Opt::RPORT(1337)
                        ], self.class)
        end

        def run_host(ip)
                connect()
        greeting = "Hello world"
        sock.puts(greeting)
                data = sock.recv(1024)
                print_status("Received: #{data} from #{ip}")
                disconnect()
        end
end

--------------------------------------------------------------------------------------

We have saved this custom script under modules/auxiliary/scanner/ as
simple_tcp.rb. The saved location is important in Metasploit.


To test this rudimentary scanner, we set up a netcat listener on port
1337
and pipe in a text file to act as the server response.

root@bt:/# echo "Hello Metasploit" > banner.txt
root@bt:/# nc -lvnp 1337 < banner.txt
listening on [any] 1337...

Next, we load up msfconsole, select our scanner module, set its
parameters,
and run it to see if it works.

msf > use auxiliary/scanner/simple_tcp
msf auxiliary(simple_tcp) > show options
Module options:
Name   CurrentSetting    Required     Description
----   --------------- -------- -----------
RHOSTS                      yes    The target address range or CIDR identifier
RPORT        1337  yes      The target port
THREADS       1    yes       The number of concurrent threads
msf auxiliary(simple_tcp) > set RHOSTS 192.168.1.101
RHOSTS => 192.168.1.101
msf auxiliary(simple_tcp) > run

Targeted Scanning with metasploit !

A targeted scan looks for specific operating systems, services,
program versions, or configurations that are known to be exploitable
and that provide an easy door into a target network.

SMB Version Scanning :
Now that we have determined which hosts are available on the network,
we can attempt to determine which operating systems they are running.

we will use the 'scanner/smb/version' module to determine which
version of Windows is running on a target and which Samba version is
on a Linux host.

msf > use auxiliary/scanner/smb/smb_version
msf auxiliary(smb_version) > set RHOSTS 192.168.1.155
RHOSTS => 192.168.1.155
msf auxiliary(smb_version) > set THREADS 11
THREADS => 11
msf auxiliary(smb_version) > run
if we issue the 'hosts' command now, the newly acquired information is
stored in Metasploit's database.

Hunting for Poorly Configured Microsoft SQL Servers :
When MS SQL is installed, it listens by default either on TCP port 1433
or on a random dynamic TCP port. If MS SQL is listening on a dynamic port,
simply query UDP port 1434 to discover on what dynamic TCP port MS SQL
is listening.


Let us search and load the MSSQL ping module inside the msfconsole.

msf > search mssql

Exploits
========

   Name                                       Description
   ----                                       -----------
   windows/mssql/lyris_listmanager_weak_pass  Lyris ListManager MSDE Weak sa Password
   windows/mssql/ms02_039_slammer             Microsoft SQL Server Resolution Overflow
   windows/mssql/ms02_056_hello               Microsoft SQL Server Hello Overflow
   windows/mssql/mssql_payload                Microsoft SQL Server Payload Execution


Auxiliary
=========

   Name                       Description
   ----                       -----------
   admin/mssql/mssql_enum     Microsoft SQL Server Configuration Enumerator
   admin/mssql/mssql_exec     Microsoft SQL Server xp_cmdshell Command Execution
   admin/mssql/mssql_sql      Microsoft SQL Server Generic Query
   scanner/mssql/mssql_login  MSSQL Login Utility
   scanner/mssql/mssql_ping   MSSQL Ping Utility

msf > use auxiliary/scanner/mssql/mssql_ping
msf auxiliary(mssql_ping) > show options

Module options (auxiliary/scanner/mssql/mssql_ping):

   Name                 Current Setting  Required  Description
   ----                 ---------------  --------  -----------
   PASSWORD                              no        The password for the specified username
   RHOSTS                                yes       The target address range or CIDR identifier
   THREADS              1                yes       The number of concurrent threads
   USERNAME             sa               no        The username to authenticate as
   USE_WINDOWS_AUTHENT  false            yes       Use windows authentification

msf auxiliary(mssql_ping) > set RHOSTS 192.168.1.0
RHOSTS => 10.211.55.1/24
msf auxiliary(mssql_ping) > exploit

The first command we issued was to search for any 'mssql' plugins. The
second set of instructions was the 'use scanner/mssql/mssql_ping',
this will load the scanner module for us.

Next, 'show options' allows us to see what we need to specify. The
'set RHOSTS 192.168.1.0' sets the target IP we want to start looking
for SQL servers on.
After the 'run' command is issued, a scan is going to be performed and
pull back specific information about the MSSQL server.

Service Identification with metasploit !

Again, other than using Nmap to perform scanning for services on our
target network, Metasploit also includes a large variety of scanners
for various services, often helping you determine potentially
vulnerable running services on target machines.

SSH Server Scanning
If during your scanning you encounter machines running Secure Shell
(SSH), you should determine which version is running on the target. SSH is a
secure protocol, but vulnerabilities in various implementations have been
identified.

You can use the Framework’s ssh_version module to
determine the SSH version running on the target server.


msf > use scanner/ssh/ssh_version
msf  auxiliary(ssh_version) > set RHOST 127.0.0.1 
RHOST=> 127.0.0.1

msf auxiliary(ssh_version) > set THREADS 50
THREADS => 50

msf auxiliary(ssh_version) > run

FTP Scanning :
FTP is a complicated and insecure protocol. FTP servers are often the easiest
way into a target network, and you should always scan for, identify, and fingerprint
any FTP servers running on your target.

Scanning FTP services using the Framework’s
ftp_version module:



msf > use auxiliary/scanner/ftp/ftp_version

msf  auxiliary(ftp_version) > set RHOSTS 127.0.0.1
RHOSTS => 127.0.0.1

msf auxiliary(ftp_version) > set THREADS 255
THREADS => 255


msf auxiliary(ftp_version) > run