Instructor: Welcome back.
And now that we've got our Windows 10 machines set up,
we want to perform a vulnerability scan real quick
to see whether it is vulnerable.
And then I will show you a tool that we can use
to crash the target system.
So first of all, open up both of your Kali Linux
and Windows 10 machines.
Right here, I ran the IP config command
to check out the IP address of the Windows 10 machine.
And what I'm going to do is
I'm going to scan it real quick
just to see what ports it has open
and whether our setup was correct from the previous video.
Okay, great.
We got the port 445 open, that is all we need.
Now, I have also performed a Nessus vulnerabilities scan
this morning on Windows 10 machine
and for some reason it didn't manage to find
this SMB ghost vulnerability.
Now, that could be some type of a bug, maybe, perhaps.
Since, if I type Locate and then the vulnerability name,
which is CVE dash 2020 dash 0796.
And this is just the name for this particular vulnerability,
and I type Enter.
Here it will find the path to the Nessus
with the module for that vulnerability.
So it seems that it has a plugin for that vulnerability
and it should be able to discover it.
But once again, for me personally,
it didn't manage to find it.
You can try it out.
You know right now how to use Nessus.
So just open it up, open your Windows 10 machine
and run a scan in Nessus on your Windows 10 machine,
and see if you can come up
with this vulnerability from there.
But what we want to do right now is
we want to copy this name, and we want to go to the Firefox.
Since remember, this is something
that we do not have in Mantis play framework,
we must find the exploit of ourselves.
Once the Firefox opens up,
paste the vulnerability name right here,
and I will just type it real quick to 2020, 0796,
and we can add GitHub.
Let us check out whether there are some available tools
on GitHub repository.
So we got a few responses right here.
And what we want to go with first
is the vulnerability scanner.
And what I mean by vulnerability scanner
is we want the tool that will tell us
whether the target machine is vulnerable
to this attack without crashing or exploiting it.
So we'll go to this link right here,
and it seems that this is the tool that we need.
It says the vulnerability name, scanner.py,
identifying and mitigating the CVE 2020, 0796
flaw in the fly.
So let's check it out.
Let's copy the name of this vulnerability.
Then we will go to our desktop,
and we will, Git clone that repository
to our desktop directory.
Once it finishes downloading, we can type Ls.
Here it is, right here.
Let's change directory to there by typing CD,
and let's see which files we have.
So we have only this scanner.py file,
so it is a Python file.
Let us go to this page and just check real quick
whether it is a Python two or three program
and by the usage that we can see right here,
it seems that it is a Python three program.
So let's test it out.
If I go right here, check out the IP address
of Windows 10 machine.
For me it is 192.168.1.5.
Let's run the program, Python three.
And then type the IP address.
Well, we get a response that we wanted.
It says right here, Vulnerable, great.
Now we can test other tools that will crash
and exploit the target.
First I want to show you a tool that you can use
to just crash the target.
And for this tool we don't need anything else
besides the IP address of the target machine.
So you can crash any target just by knowing its IP address.
For the exploit that we will cover in the next video,
we're going to cheat a little bit.
We need something in order for the exploit to work.
And I will show you that in the next video.
For now, we want to see how we can crash the target machine.
So if you go all the way down,
you will see this GitHub link.
It is from Jiasiting and it has the name
of our vulnerability.
If I go right here, we can see we've got a few files.
Once again, this is a Python tool.
Under here we got the usage.
So we got a demo gif.
Here we can see the command that he's running.
And if we go right here and copy the tool,
and once again we can go to our desktop,
and get clone the tool name, the link based right here,
wait for the download to finish.
And if I type Ls, we now have two directories.
This one is the scanner
and this one is the one that we just downloaded.
So let's go, CD, CVE, we got the demo gif,
the readme file, and the vulnerability itself.
Of course, if we want to we can nano the vulnerability file
or the Python file, and we can scroll all the way down
to see the code of this exploit,
and down here we get the usage.
So all we need to specify as it says right here,
is the target IP address.
Let's try it out.
If I go right here and type Python,
I believe it's Python three once again, and then cve.py
and then the IP address of the target machine.
Before I run it, I will lower this screen so we can see both
of our targets before running this program.
And right here, if I press Enter, well here it is.
We successfully crashed the target machine.
It got the blue screen of death
as we can see right here, and it is now restarting.
And this is also critical vulnerability.
Once again, I need to mention that you should never
be able to crash the target machine
just by knowing its IP address.
This is something that we would also 100% write down
inside of our penetration testing report.
Now that we managed to scan the target
to see whether it is vulnerable,
and we used another tool to crash the target,
let's see in the next video how we can exploit
the target machine and gain shell back
inside of our Kali Linux machine.
See you in the next video