Welcome to part three of this module we'll be picking up right where we left off in the last video.
If you're just joining us please keep in mind that while I try to keep all videos as standalone whenever
possible this entire module is dedicated to the Metis point framework and Armitage and as such is intended
to be watched in the order presented in the last video.
We went deeper into what modules actually are and where they exist near Cally operating system.
Now we're going to be looking at some practical examples of how to use them within the Metis flight
framework before we begin.
It is required that I remind all those watching these videos to never use this or any other tool or
technique shown here against any system that you don't personally own or have written permission from
the owner to penetration test for this demonstration.
We'll be using a metal split able to virtual machine which we'll be running on the network like so we're
going to use the IAF config command to grab the IP address of the Met a spoiled evil machine on the
network and use that address in Cali when we target our modules.
In this case it's under the heading AI net a DDR 10 dot 0 0 dot eleven.
Yours may vary.
Now it's worth repeating here that in order for this to work you need to make sure that under your virtual
machine settings under network the adapter is set to bridged adapter.
If your adapter says any t or Nat this process won't work because in that instance both met a split
ABL 2 and the cowling machine that you're running will have the same network IP address meaning you
won't be able to target the Met a split level machine from within Cowley.
Of course if you're running Carly off a dedicated partition or a USP device with persistence.
This may not be an issue if you change to bridge adapter.
Please remember to restart all of your virtual machines so that the change actually takes effect and
just a little aside here before we begin.
This is one of those joke banners I was mentioning that tends to confuse people.
See we are supplied here with what appears to be an error message telling us kernel panic attempted
to kill the idol task swap or not sinking killing interrupt handler.
This is a joke and it can confuse some inexperienced users so there's nothing wrong with your Metis
plate machine.
If you see something like that on the startup banner anyway let's get started.
OK we've reached a point in this class where we will be going over some old ground specifically we'll
be using any map within the Metis Floyd framework to spot open ports and then run a scan against those
ports using a scanner found in the auxiliary modules.
There are already videos in this class which will go into great detail about the use of any map and
I dare say present you with better ways to pin down vulnerabilities in a target system than what you're
about to see here.
If you haven't watched these videos yet I suggest going back and having a look.
However it isn't required.
We can proceed without them but I'm not going to give a full blown explanation of how any map works
here because it really is ground that we've already covered.
I also need to make a comment at this point and this will be somewhat opinionated and controversial.
So take it with a grain of salt.
We've already covered information gathering and reconnaissance and if you've been following along with
these videos in order you should have a pretty good idea by now of how to spot vulnerabilities on a
system.
The modular nature of metal split means that we have tools within the framework for doing this very
thing.
So which method is superior.
Does it make more sense to scan a target for ports and vulnerabilities using a tool like say Sparta.
Or is it better to stick to tools within Metis ploy itself such as the scanners that are going to be
presented in the auxiliary modules section.
This is ultimately a matter of personal preference.
It is entirely possible to use only met a split every step of the way but in my case whenever I launch
met a spoiled I'm already past the information gathering phase of my pen test.
This is something you'll have to determine for yourself through experience.
So to begin with let's perform a basic bare bones and map port scan.
To that end let's pretend like we have a target which in this case is going to be the IP address of
the Met hospitable to virtual machine.
We do this exactly as we would in the normal terminal window and map tack lowercase s uppercase t 10
dot 0 0 dot eleven.
So this is just the basic scan.
Nothing fancy.
We initiate a three way handshake with the s t switch and have a look at our target.
Since the target is met exploitable too will get a lot of open ports returned back to us rather quickly.
You can see all the ports that are open.
We have FCP shell H2 GDP telnet and so on and so forth.
And that's great.
It is the end map that we know and love within the Metis point framework.
No real surprises here.
Again please see the video dedicated to any map.
If you have any questions about how to use the tool itself I suppose since we're pretending our target
is real we should do a stealth scan since a real target might have a firewall and we can do that just
like normal which is to say exactly as if we were running it in the normal terminal window.
We'll do an map tack lowercase S. uppercase s supply our AP IP address and again it should come up pretty
fast with a real target or a range of targets.
This process might take a little bit longer and of course a virtual box tends to be a little slow anyway.
But what matters here is that one way or another we are able to achieve a list of open ports at the
end of the day.
It doesn't matter how you get this information.
Once we have at least one open port we can proceed to the next step.
Now we can use the auxiliary modules that come with metal split assuming we haven't already gained this
information through other tools.
Remember that the auxiliary modules contain many built in scanners which are considered to be information
gathering tools met exploited really is a Swiss army knife of pen testing tools.
We'll use the SS H scanner for this demonstration although any of the scanning tools will work and they
all tend to work in met a split the way you expect them to.
One exception is I found that it is difficult to export Excel files using any map from within Metis
Floyd and there may be a few other little quirks.
It is best at least to start out that you use a scanner for a service indicated to be running based
on the open ports on your target system.
Just bear in mind that some system administrators like to mix things up and just because a particular
service runs on a particular port by default doesn't mean it will use that port on your target system.
And this can get a little confusing.
So any map is detected that port 22 is in an open state so we can be reasonably certain that SSA H is
using it.
So our goal here is going to be to use an SS H scanner found in the auxiliary modules to determine which
version of SS h the target is having an operation so that we can later find a suitable exploit to use
against it.
We aren't quite running yet but we are working up to a brisk jog so let's get started.
Before we can run the scanner we have to find it.
So for that we're going to just can use the search command.
So we'll do search.
SS H underscore version.
Now it should come up pretty quickly if you get a message telling you that the module database cachet
is not built yet and that your searches are slow.
Please go back to the first video and use the optional commands provided to rebuild the cachet and that
should speed things up for you.
So we don't need phasers right now.
We need the auxiliary scanner so for that to utilize that we're going to use the use command somewhat
redundant.
Sorry use auxiliary scanner.
S H slash SS H underscore version.
You also could have copy pasted that if you didn't feel like typing it.
And there we go it comes right up.
The prompt has now changed from just MSF to include the scanner name in red which means that it is ready
to use of course ready to use does not actually mean properly configured so we'll have to use our show
options command to supply the scanner with the target data that it needs.
This is very simple if you recall we just use the set command.
So we're going to set the R hosts field to include our current target which is the IP address of the
Met hospitable machine.
Our hosts.
There we go.
And now I suggest setting the threads to something high although not too high.
It depends on your system specifications for this demonstration.
I think we'll probably be okay setting threads to about 75
notice.
Our data is now all entered.
Excellent.
Now a common mistake people make here is that they get excited and they type exploit and they wonder
why the module doesn't work.
The exploit command is really only for launching the actual exploit this module is considered information
gathering.
So for this we're simply going to type run and right away we get a lot of information in the return
field.
We can see the SSA version number 2.0.
We can see with the Linux OS version number is et cetera et cetera.
And this is valuable information for the exploitation stage which is coming next.
And there are a lot of other things that you can do in terms of information gathering such as FCP scanners
banner grabbing and so on much of which we've seen in prior modules.
Generally speaking met a split always has a tool buried somewhere in the auxiliary modules category
to help you along with this information gathering process.
It really is a standalone tool but as you can see the way it presents you with information is maybe
not as pretty as some of the more streamlined information gathering tools out there.
Please understand I'm not trying to rag on the tools that metal split provides for this.
In fact there may be circumstances where using these scanners within met a split is the more sensible
choice on that junky little laptop I got for some of these demonstrations for example.
It is a 32 bit operating system with only 2 gigs of ram a single core processor that would make a Commodore
64 look brisk by comparison programs like Sparta and Zen map and even goal a ceremony are major resource
hogs and don't function well whereas MSF console works very smoothly.
This would also be true perhaps on a system like a raspberry pi or a chip where it's very small and
resources are in short supply so real quick just to make sure the idea of how this works is clear.
Let's go ahead and do another one.
We'll do search f T.P. versions whoops I'm sorry.
That's FCP version.
My apologies.
So let's pretend that we didn't detect an open and open SS H port but that there is an open FCP port.
So for that we'd use an FTE P scanner.
So we'll do use auxiliary scanner f T.P. F G P underscore version and we'll do show options.
Same as before.
We're going to set or hosts to our target
and we don't know the FTB password or user name so we'll just leave those as they are for right now.
Again this is where a program like Sparta comes in handy.
Not to belabor a point and we'll set threads to 75 all right and we'll go ahead and run it.
And we were able to grab the banner that time.
Wonderful.
All right so that pretty much covers it.
You can use scanners within met a split and even end map itself or you can do your information gathering
with other tools before you even load up the MSF console or both.
It really is up to you and as you practice and improve you'll learn what works best for you.
Remember that almost any Windows operating system is likely to have at least one or two UN patched vulnerabilities
or key applications that are not up to date and contrary to what people say.
This is often true of Linux as well just not as often.
Be patient and be persistent and remember practice makes perfect.
We're almost to the point of using this information for real exploits so I hope this was all clear and
we'll pick up in the next video.
Thank you.