1
00:00:00,240 --> 00:00:02,310
Instructor: Hello and welcome back.

2
00:00:02,310 --> 00:00:05,073
Are you ready to hack your first target?

3
00:00:05,910 --> 00:00:07,814
Everything we learned up to here

4
00:00:07,814 --> 00:00:10,650
was building up to this moment.

5
00:00:10,650 --> 00:00:13,200
We're going to use all of our previous knowledge

6
00:00:13,200 --> 00:00:16,650
that we got to hack our target.

7
00:00:16,650 --> 00:00:19,260
Of course, this is just one of the many exploits

8
00:00:19,260 --> 00:00:21,060
that we will cover in this course

9
00:00:21,060 --> 00:00:24,033
but it is important because it is our first one.

10
00:00:25,110 --> 00:00:27,840
In this case, we are, of course, going to be attacking

11
00:00:27,840 --> 00:00:30,630
the metasploitable for our first exploit.

12
00:00:30,630 --> 00:00:32,490
So make sure you start it up.

13
00:00:32,490 --> 00:00:34,227
Check out the IP address of the metasploitable

14
00:00:34,227 --> 00:00:38,880
and in my case it is 192.168.1.5.

15
00:00:38,880 --> 00:00:40,830
And what I'm going to do is I'm going

16
00:00:40,830 --> 00:00:42,810
to open two terminals.

17
00:00:42,810 --> 00:00:46,050
In the first one, I will start my MSF console

18
00:00:46,050 --> 00:00:49,950
and in the second one I will perform the nmap scan

19
00:00:49,950 --> 00:00:52,080
for the version of the service.

20
00:00:52,080 --> 00:00:55,980
So we already know the command, sudo nmap-sV

21
00:00:55,980 --> 00:00:59,120
and then the IP address of my metasploitable.

22
00:00:59,120 --> 00:01:01,470
It will ask me for the password.

23
00:01:01,470 --> 00:01:03,270
I will input it right here

24
00:01:03,270 --> 00:01:05,640
and it will start the scan.

25
00:01:05,640 --> 00:01:07,890
And you can open your metasploitable framework

26
00:01:07,890 --> 00:01:11,400
once the scan is running and once you open it,

27
00:01:11,400 --> 00:01:13,173
just wait for the scan to finish.

28
00:01:14,076 --> 00:01:15,060
Okay.

29
00:01:15,060 --> 00:01:16,410
So here it is.

30
00:01:16,410 --> 00:01:20,010
This is an output that we are already familiar with.

31
00:01:20,010 --> 00:01:22,560
Let's see whether we can exploit the target.

32
00:01:22,560 --> 00:01:24,990
And we are going to start in order.

33
00:01:24,990 --> 00:01:27,900
Let's go with the ftp port first.

34
00:01:27,900 --> 00:01:30,480
So we notice right here which version

35
00:01:30,480 --> 00:01:32,310
of service is it running.

36
00:01:32,310 --> 00:01:35,013
In this case vsftpd 2.3.4.

37
00:01:37,410 --> 00:01:40,230
And also keep in mind that there is really no plan

38
00:01:40,230 --> 00:01:42,150
once you do something like this.

39
00:01:42,150 --> 00:01:43,260
We only know that the goal

40
00:01:43,260 --> 00:01:47,793
for us is to find an exploit if this software is vulnerable.

41
00:01:48,720 --> 00:01:52,260
Now, even though we know that best search would be us going

42
00:01:52,260 --> 00:01:56,130
on internet and typing vsftpd vulnerability,

43
00:01:56,130 --> 00:02:00,090
but I myself like to run the search exploit tool first

44
00:02:00,090 --> 00:02:02,460
just to see whether we already have it right here

45
00:02:02,460 --> 00:02:03,540
on the machine.

46
00:02:03,540 --> 00:02:05,670
So I will open another terminal

47
00:02:05,670 --> 00:02:07,440
and I will copy the name

48
00:02:07,440 --> 00:02:12,440
of the version in this case vsfdpd 2.3.4, copy it,

49
00:02:13,910 --> 00:02:17,940
and type searchploit and then paste the version name.

50
00:02:17,940 --> 00:02:22,260
If I press enter right here, we get one result,

51
00:02:22,260 --> 00:02:26,670
we get vsfdpd backdoor command execution.

52
00:02:26,670 --> 00:02:28,800
And in the right column, as you remember,

53
00:02:28,800 --> 00:02:31,620
we get the path to this exploit.

54
00:02:31,620 --> 00:02:33,840
There is one thing that we should notice right here.

55
00:02:33,840 --> 00:02:36,060
This is .rb.

56
00:02:36,060 --> 00:02:37,230
What does this mean?

57
00:02:37,230 --> 00:02:38,640
Well, this most likely means

58
00:02:38,640 --> 00:02:42,270
that this exploit belongs to metasploit framework,

59
00:02:42,270 --> 00:02:45,191
and it also tells us that right here in the brackets.

60
00:02:45,191 --> 00:02:48,420
So it means that we will have it right here

61
00:02:48,420 --> 00:02:51,330
under one of these 2000 exploits.

62
00:02:51,330 --> 00:02:53,610
So how we can find it, of course, we are not

63
00:02:53,610 --> 00:02:56,190
going to be listing all the 2000 exploits

64
00:02:56,190 --> 00:02:58,230
and trying to find the correct one.

65
00:02:58,230 --> 00:03:00,960
What we can do is we can type search

66
00:03:00,960 --> 00:03:03,880
and then the software name so vsfdpd

67
00:03:05,790 --> 00:03:10,790
and here it is exploit unix/ftpd

68
00:03:11,040 --> 00:03:15,933
and it is the vsfdpd 2.3.4 version backdoor.

69
00:03:16,800 --> 00:03:19,200
It came out in 2011.

70
00:03:19,200 --> 00:03:22,920
It is ranked excellent, which means this exploit works

71
00:03:22,920 --> 00:03:25,260
and here is the description for it.

72
00:03:25,260 --> 00:03:28,620
Let's read more about it, but first we need to select it.

73
00:03:28,620 --> 00:03:33,620
So to do that we can type use exploit/unix/ftpd

74
00:03:34,650 --> 00:03:36,363
and then the name of the exploit.

75
00:03:37,530 --> 00:03:41,580
Press enter and we can see the payload is default configured

76
00:03:41,580 --> 00:03:44,220
to cmd/unix/interact.

77
00:03:44,220 --> 00:03:46,410
But we are going to check this out in just a second.

78
00:03:46,410 --> 00:03:48,630
Let us first clear the screen

79
00:03:48,630 --> 00:03:51,240
and type the command show info.

80
00:03:51,240 --> 00:03:53,820
We want to read more about this exploit

81
00:03:53,820 --> 00:03:55,793
so it will tell us in the description

82
00:03:55,793 --> 00:03:59,250
this module exploits a malicious backdoor that was added

83
00:03:59,250 --> 00:04:02,520
to the vsftpd download archive.

84
00:04:02,520 --> 00:04:05,550
This backdoor was introduced in the zip file

85
00:04:05,550 --> 00:04:10,530
archive between June 30th, 2011 and July 1st, 2011

86
00:04:10,530 --> 00:04:13,470
according to the most recent information available.

87
00:04:13,470 --> 00:04:17,192
This backdoor was removed on July 3rd, 2011.

88
00:04:18,089 --> 00:04:19,680
Hmm, interesting.

89
00:04:19,680 --> 00:04:22,263
Let's see whether we got the vulnerable version.

90
00:04:23,130 --> 00:04:25,800
So if we clear the screen and type the next command

91
00:04:25,800 --> 00:04:28,477
which is show options, we will see right here

92
00:04:28,477 --> 00:04:31,110
what are the things that we need to set up

93
00:04:31,110 --> 00:04:32,850
in order for this to work.

94
00:04:32,850 --> 00:04:36,150
So in this case we only got two things.

95
00:04:36,150 --> 00:04:37,830
We got the r hosts

96
00:04:37,830 --> 00:04:39,490
and we got the r port

97
00:04:40,380 --> 00:04:42,960
and this is the remote host which is the IP address

98
00:04:42,960 --> 00:04:44,100
of our target.

99
00:04:44,100 --> 00:04:48,360
And the r port is the port number where the ftp is running

100
00:04:48,360 --> 00:04:49,890
on the target machine.

101
00:04:49,890 --> 00:04:51,450
If you go to my scan,

102
00:04:51,450 --> 00:04:54,750
we will see the port is set correctly, which is port 21.

103
00:04:54,750 --> 00:04:56,880
So this is something that we will not change.

104
00:04:56,880 --> 00:04:59,850
However, we need to set our remote host IP address.

105
00:04:59,850 --> 00:05:02,370
So let's set the IP address

106
00:05:02,370 --> 00:05:05,803
for metasploitable, set our hosts 182.168.1.5.

107
00:05:07,770 --> 00:05:10,710
In my case, the payload is set by default

108
00:05:10,710 --> 00:05:12,870
and if a type show payloads to see all

109
00:05:12,870 --> 00:05:14,700
of the available payloads that we have,

110
00:05:14,700 --> 00:05:18,870
for this particular attack, we only get this single payload.

111
00:05:18,870 --> 00:05:21,180
So there is nothing really to change right here.

112
00:05:21,180 --> 00:05:23,190
We're going to use that one

113
00:05:23,190 --> 00:05:25,080
and we can see it doesn't require

114
00:05:25,080 --> 00:05:27,420
any additional options whatsoever.

115
00:05:27,420 --> 00:05:29,670
So the easier for us the better.

116
00:05:29,670 --> 00:05:32,130
Under the description we can see it is a unix command.

117
00:05:32,130 --> 00:05:35,010
We simply just interact with established connection.

118
00:05:35,010 --> 00:05:37,440
So I expect that with this we're going to be able to

119
00:05:37,440 --> 00:05:39,480
execute commands on target machine

120
00:05:39,480 --> 00:05:41,080
if we manage to exploit it.

121
00:05:41,080 --> 00:05:44,280
Under the targets we can type show targets

122
00:05:44,280 --> 00:05:46,230
to see the available ones.

123
00:05:46,230 --> 00:05:49,500
And we got none because this is an actual exploit

124
00:05:49,500 --> 00:05:50,340
for the software.

125
00:05:50,340 --> 00:05:52,740
So in order to be able to exploit the target,

126
00:05:52,740 --> 00:05:55,230
the target has to be running this software version

127
00:05:55,230 --> 00:05:57,930
which in our case it is running.

128
00:05:57,930 --> 00:05:59,460
So everything is set.

129
00:05:59,460 --> 00:06:02,160
Let us double check type show options.

130
00:06:02,160 --> 00:06:03,960
We got the IP address of the target.

131
00:06:03,960 --> 00:06:06,990
We got the port number where the software is running

132
00:06:06,990 --> 00:06:08,190
on the target machine

133
00:06:08,190 --> 00:06:10,890
and all we need to type to execute this

134
00:06:10,890 --> 00:06:14,643
is type exploit, press enter,

135
00:06:17,220 --> 00:06:19,560
and here it is.

136
00:06:19,560 --> 00:06:22,800
We got the command shell session one opened

137
00:06:22,800 --> 00:06:24,033
on the target system.

138
00:06:24,870 --> 00:06:26,280
How do I know this?

139
00:06:26,280 --> 00:06:29,100
Well, it doesn't give us any output right here,

140
00:06:29,100 --> 00:06:32,730
but if I type, for example ls,

141
00:06:32,730 --> 00:06:35,220
you will see we are getting an output

142
00:06:35,220 --> 00:06:39,240
and this ls didn't execute on our linux machine.

143
00:06:39,240 --> 00:06:42,240
It executed on the metasploitable.

144
00:06:42,240 --> 00:06:44,400
We are on that machine right now.

145
00:06:44,400 --> 00:06:46,290
We successfully exploited it.

146
00:06:46,290 --> 00:06:47,810
We can run any commands that we want.

147
00:06:47,810 --> 00:06:49,620
So if I type, who am I,

148
00:06:49,620 --> 00:06:52,500
it will tell us that we are the root account.

149
00:06:52,500 --> 00:06:55,290
So not only did we manage to hack that machine,

150
00:06:55,290 --> 00:06:58,080
we also are root privileged account.

151
00:06:58,080 --> 00:07:00,450
So we can do anything we want on it.

152
00:07:00,450 --> 00:07:03,930
If I type pwd to check my current directory,

153
00:07:03,930 --> 00:07:06,090
I am in the slash directory.

154
00:07:06,090 --> 00:07:09,360
And if I type ifconfig just to prove to you

155
00:07:09,360 --> 00:07:11,490
that we are on the target machine,

156
00:07:11,490 --> 00:07:15,630
we can see the output is 182.168.1.5.

157
00:07:15,630 --> 00:07:18,510
So that is the IP address of metasploitable

158
00:07:18,510 --> 00:07:20,220
as you can see right here.

159
00:07:20,220 --> 00:07:23,760
Inside of the slash directory that we are currently at,

160
00:07:23,760 --> 00:07:25,473
we can create files right now.

161
00:07:26,370 --> 00:07:29,190
Let's go to metasploitable just to show you.

162
00:07:29,190 --> 00:07:31,800
And if I type ls in the slash directory,

163
00:07:31,800 --> 00:07:34,770
these are the current files inside of this directory.

164
00:07:34,770 --> 00:07:37,540
If I type now mkdir and then test

165
00:07:39,180 --> 00:07:41,160
and I type ls once again,

166
00:07:41,160 --> 00:07:43,140
now you will see that we successfully created

167
00:07:43,140 --> 00:07:46,200
the test directory on the metasploitable machine.

168
00:07:46,200 --> 00:07:48,653
And if we check it on the machine itself,

169
00:07:48,653 --> 00:07:49,830
(typewriter clicking)

170
00:07:49,830 --> 00:07:51,060
here it is.

171
00:07:51,060 --> 00:07:54,450
Here is the test directory that we just created.

172
00:07:54,450 --> 00:07:57,210
So we successfully hacked the target.

173
00:07:57,210 --> 00:07:59,730
Now, the reason we are getting an output like this is

174
00:07:59,730 --> 00:08:02,700
because this is not really that good of a shell.

175
00:08:02,700 --> 00:08:04,410
This is not an interpreter shell

176
00:08:04,410 --> 00:08:07,230
so that we get a well organized output

177
00:08:07,230 --> 00:08:09,360
but nonetheless, it is a shell indeed.

178
00:08:09,360 --> 00:08:10,680
We can execute the commands

179
00:08:10,680 --> 00:08:12,870
and we get the output of those commands back.

180
00:08:12,870 --> 00:08:15,360
And not only that, but we are a root account

181
00:08:15,360 --> 00:08:17,070
on the target system.

182
00:08:17,070 --> 00:08:20,170
Now, to exit the shell, we can just type exit,

183
00:08:20,170 --> 00:08:22,050
and it will tell us right here,

184
00:08:22,050 --> 00:08:24,900
command shell session one closed.

185
00:08:24,900 --> 00:08:27,180
And it was that easy.

186
00:08:27,180 --> 00:08:29,130
We gained root privilege account

187
00:08:29,130 --> 00:08:30,690
on the metasploitable machine

188
00:08:30,690 --> 00:08:33,840
and we could have done anything on it.

189
00:08:33,840 --> 00:08:36,150
This is as good as it can get

190
00:08:36,150 --> 00:08:38,370
and this is exactly what we are looking for

191
00:08:38,370 --> 00:08:40,860
once we try to exploit the target.

192
00:08:40,860 --> 00:08:45,210
Now, sometimes it is this easy but sometimes it isn't.

193
00:08:45,210 --> 00:08:48,357
And we will see some complicated exploits later on

194
00:08:48,357 --> 00:08:51,060
and it will be even more complicated to exploit a target

195
00:08:51,060 --> 00:08:53,670
if it doesn't have any vulnerability.

196
00:08:53,670 --> 00:08:55,620
But for now we are happy.

197
00:08:55,620 --> 00:08:58,170
We managed to hack our first target,

198
00:08:58,170 --> 00:09:00,480
but this is just one of the vulnerabilities.

199
00:09:00,480 --> 00:09:03,720
Let's keep exploring and see in the next few videos

200
00:09:03,720 --> 00:09:05,370
if the metasploitable has some

201
00:09:05,370 --> 00:09:07,020
other vulnerabilities as well.

202
00:09:07,020 --> 00:09:09,420
And then after we finish with metasploitable,

203
00:09:09,420 --> 00:09:12,243
we're going to move on to some other harder targets.