Speaker: Welcome back.
Let's continue with exploiting over our exploitable machine.
So we already found three vulnerabilities regarding telnet,
ftp and the bind shell with no authentication.
Let us see what else can we find.
And what I got in mind for now,
is this samba open port right here.
Matter of fact, these two open ports 139 and 445.
Why them?
Well, because it seems that we do not have
the exact version of samba right here.
It tells us that samba is between three point something
to four point something.
So let's see, how we will figure out what X plate to use
and how to find it.
Here's a small hint.
we don't need to Google it to be able to find it.
We have everything we need right here in Cal Linux.
So don't use Google to find it since it is cheating,
and you will most likely find it on the first link.
Let's see whether we can figure it out by ourselves.
So right here in our scan we have this samba version
right here.
Not the exact version, but it does give us some information
about in between which range does the version belong to.
And that is something.
We also see that ports hosting this are 139 and 445.
So we do get some information.
What now?
Well, let's just search samba inside
of Searchsploit and see what comes up.
So I got this scan right here.
I got my MSF console right here,
and I will open a third terminal
and type searchsploit samba.
Well, it seems that we get a lot of results.
And these are exploits for a bunch of different
samba versions as we can see right here.
Now we could just try all of them out to see
whether they will work,
or we can try to figure out the samba version first
and then narrow down our exploit search
and see whether we find something for that specific version.
So how are we going to find out the samba version?
Our nmap scan didn't manage to do it.
Well, luckily, nmap is not the only scanner
that we can use for these types of things.
Remember that in method split framework,
besides having all of these exploits and payloads,
we also get those auxiliary modules
and those auxiliary modules can sometimes be scanners.
Let's search and see whether we can find a scanner for this.
If we just type in the Metasploit,
search samba and press enter.
We get some of the results right here.
Matter of fact, we will get a lot of the results
once again.
Some are exploits, some are auxiliary modules,
and down here I believe there is one
post exploitation module.
And if we go to the auxiliary modules,
it'll only give us two auxiliary scanner modules.
These aren't the scanners that we need.
Let's try to find it ourselves.
If I go down here, clear the screen
and type use auxiliary
and then we search for a scanner
and then smb, because that is the port that
we are enumerating,
and then type vise,
these are all of the available auxiliary scanners
that we have for smb.
The one that we are particularly interested in
is this smb version.
So let's copy it.
If I copy the entire command right here,
paste it
press enter,
Oops, let me just delete this, we type the command twice.
So use auxiliary scanner, smb, and then smb version.
And if I type show info right here,
it'll tell me in the description,
display version information about each system.
This looks like something that we need.
Let's type all of the needed information for this to run.
So we're going to type show options first
and we require our hosts.
We got some other things as well
but these three things are not required.
As it says right here.
The threads we leave on one
and the RHOST will be the IP address
of our meta exploitable,
in my case 192.168.1.9
I will set this right here,
and if we run it,
well it worked.
Even though it says right here,
host could not be identified,
in the brackets we get the exact samba version
on the metasploitable.
Which is 3.0.20,
cool.
Let's see what we can find from exploits
now that we know what version it runs.
So I'll copy this 3.0.20
and go back to my searchsploit,
clear the screen and type it.
Once again, just this time I will paste the entire version.
Press enter and we manage to narrow it down
to only five results.
And it seems that these two are the same results.
So it's actually four results in total.
The first one, seems to be some type of a security bypass
and it affects our version since it's between 3.0.10
and 3.3 0.5,
but it also seems to be a txt file,
which really don't want to bother with right now.
We want something that we can execute right away.
The most interesting thing we have right here
is this samba username map script or the command execution.
Why?
Well, it's a Ruby exploit,
and it belongs to Metasploit framework.
Plus it also affects our version of samba,
As we can see right here.
These two down here are also txt files,
not really interested in,
and they also don't seem to actually affect our version.
They only affect the versions below our version.
And the last one, which is the denial of service
or DOS attacks.
Seems to be affecting our version
but we are once again not interested
in the denial of service attacks.
But in a real penetration test,
you would 100% write this on a report
with the references to the possible attack.
For now, let's just go with the Metasploit module
that we found.
Let's remember the name, username, map script,
command execution.
And if I search once again
in my Metasploit, search samba,
That is trying to find the exploit that we found
using searchsploit.
If I go up here, go through all of these results.
And here it is, under the 13 exploit multi samba
usermap script command execution.
This is the same script that we saw right here.
Here it is.
If a copy the script name,
so exploit multi samba, here's our map script
and type right here, use then pays the script name.
It'll set the default payload to be command unix
reverse netcat.
And by the way, this multi right here
means that it can be targeted on multiple operating systems.
While as if you had only Windows or Linux
specified right here,
it would mean that only that specific operating system
is vulnerable to this attack.
So let's show information about this exploit.
I will first clear the screen and type show info
and it'll tell us this module exploits
a command execution vulnerability in samba versions 3.0.20
through 3.0.25
when using the non default username map script
configuration operation.
And if I also set up all of the things that we need,
so show options,
seems that we need one thing which is the RHOST,
so let's set it up right away.
This is the IP address of Metasploitable.
The port right here, we do not want to change
since it is already set correctly as we can see right here,
Port 139 is running samba.
And down here is our payload, which is the reverse netcat.
We set the IP address of our Cal Linux machine here
and any port that we want.
Once all of this is ready, we can run our exploit.
And here it is.
We once again got command shell opened on target system
using Samba vulnerability.
And we can as usual execute commands.
If I type, who am I? It will tell me root.
So we are already highest privilege on that machine.
Great. This is the fourth vulnerability we found.
To close the connection,
we can just control C this
and click on Y,
and you would write this down as another successful exploit
if this was a real penetration test.
In the next video, we're going to cover
a different type of the attack
that we haven't performed yet.
Which is brute force attack on Port SSH.