Welcome to part four of this module we'll be picking up right where we left off after the last video.
So if you're just joining us please consider watching all videos in this module in order.
Now it's time to get into some basic exploitation.
We've been through the lengthy explanation of what everything is.
So let's see a system actually get penetrated.
Imagine the following scenario.
We have just gained access to the local network perhaps by cracking the router password.
So let's hack another system on that network.
Remember this could be any network that we've broken into.
Or it could be a public Wi-Fi.
Like a coffee shop or something.
So once again our target is going to be met hospitable to a virtual machine.
But don't worry we'll be getting to Windows examples very soon to save time.
I've already gone ahead and loaded up the MSF console because by now I trust that you all know how to
do that.
And because this video was not recorded immediately after the last I'm going to run Zend map to refresh
our list of open ports if you'd like more information on z map please see the video dedicated to it
and your IP range may of course vary.
So if you aren't sure Just use the F command to see what your network has assigned you and then use
the Net discovered a command to find other machines on the network as has been shown.
Okay so we have a nice long list of open ports.
So what do we need to do first.
Well the first thing we need to do is know what service we are attacking.
In this case we're trying to attack port 21 the F T.P. port.
We can see from our scan that our target is running V S F T.P. version two point three point four which
is a version of the service that is extremely vulnerable.
We know our target IP and we know the point of compromise that we are attacking.
So now we just need to run the right exploit if you've been following along the syntax should hopefully
look pretty familiar to you by now.
Let's use the search command to bring up an exploit suitable for the point of attack that we've chosen.
Generally speaking met a split has a wide range of exploits available but if you run into a machine
that is fully up to date and met exploitive all seems to be lacking and exploit for it.
Be sure to do some checking around online you may be able to find one an update on the fly so we do
our search and from here it is very simple to go off the information that we have.
We know that it's version 2.0 3.0 for but we'll just search for BSF T.P. and see what comes up and our
exploit comes up right away.
Now again if you get a message saying that your module database cachet is not built yet and your search
ends up taking forever please use the optional commands provided in the first video to sort this problem
out.
If worse comes to worse you can also reinstall met a split although that shouldn't be necessary.
I know that some older systems particularly 32 bit versions of Carly seem to have a little bit of trouble
with the database based cachet and I'm really not too sure why that is.
But this shouldn't be an issue that will affect many of you not in this day and age.
Also as a side note even though we are only seeing a single result from this current search it is not
unusual to pull up a rather long list of possibilities.
If this happens don't panic unless you have some specific reason to use a particular exploit and in
some cases you might.
I recommend that you go with the exploits ranking this one on our screen right now as ranked excellent
so we can be pretty confident that it is going to work well for us.
The ranking is more important than you might think at first glance when you are in the comfort of home
or sitting in an office with virtually unlimited time to conduct day sanctioned penetration test you
can afford to spend time studying the various exploits and figuring out which one you want to use.
Sometimes though you can't afford to sit there and dilly dally.
Particularly if systems are coming and going off a network frequently.
Now obviously it is best to know what each exploit you're using actually does and how it works whenever
possible.
But if push comes to shove it's best to just go with whatever is ranked highest.
I also need to quickly mention if you watch the video dedicated to end map then you know that ports
can have additional states beyond just open and not open.
It is sometimes possible to attack ports in the more advanced states such as filtered determining whether
or not this is possible for a particular services outside of the scope of this current video.
But just Barrett bear that in mind if all else fails and you aren't sure.
It usually doesn't hurt to try.
So this is the exploit that we're going to be using under match modules.
It has found one and in the path presented we can see that it is a Unix exploit for F T.P. and that
it is a type of backdoor.
We can also see that this specific exploit exactly matches what we're looking for which is fantastic
this exploit.
As I said as a backdoor we can see it was disclosed in 2011 so it is a very old vulnerability and back
doors are essentially what you think they are.
They allow us to obtain backdoor access to a target computer.
Let's use it.
What we're gonna do is we're going to highlight the name we could just type it out but we'll copy it
and then we're going to use use and we'll paste in the exploit name
Easy as pie.
And now that the exploit is all loaded up and displayed in red we know that it's basically ready to
use.
You've seen this before but repetition helps with the learning process and the next part is very important.
The first thing to do with any exploit is to do show options.
There we are.
These are the options that are available for this exploit.
Let's go through this step by step.
Different exploits and different modules have different options that you can customize depending on
the attack vector.
In this case we have our host which is the IP address or target IP that we will set to tell the module
what we are aiming or exploit at.
And then we can set the R port which in this case is Port 21.
Keep in mind and this is very important.
If a port is incorrectly configured by default or if an administrator does some shenanigans to change
which port certain services work on you may need to manually change the setting.
This strategy of security by obscurity really doesn't work.
As I've mentioned before but it does throw off beginners depending on what kind of scan you run and
how you run your scan during the information gathering phase.
Port 21 for example might come up and be listed as FTB but unless your scanner is configured to actually
check it may just assume that port 21 is FCP when it is actually something else.
I've seen this happen.
What I've never actually seen happen although I've heard about it is some system admins who like to
run dummy services on ports that are obviously points of attack which act like trip wires to alert them
of hacking attempts.
This sort of thing comes up a lot in the movies.
Rarely in real life but it can be done.
So just be aware of it.
It is also important to spend some time during the information gathering phase of a penetration test
to make sure what's what.
Now we need to set the R host.
We've seen this before.
It's just set our host and in my case it'll be 10 0 0 0 at eleven.
Remember that your IP will likely be different.
We'll do show options again to confirm that it did set.
And of course it did.
And all that is really left to do is run the exploit by typing.
Exploit.
Now if everything works correctly we should get a back door in the form of a reverse shell
we can see the port that it is going that is outgoing and the port that is incoming good.
It may not be immediately apparent what has just happened because my display doesn't exactly tell you
or provide a prompt.
Kind of like you'd expect but we've just hacked into our target.
We have a command shell and we can start executing commands on the target computer.
For example you name tack lowercase a we can see that we are now inside the Mideast applicable to a
virtual machine.
We have access to the server itself and now we can list files and it can be seen that we have access
to everything and we could do literally anything.
I'm sure I don't have to explain all the ways we could do damage here if we wanted to.
Let's enter the root directory will list that out.
Not having a prompt can be somewhat disconcerting we can also check the desktop.
But since it's meant exploitable nothing will come up although if this was a Windows system it might
be worth doing.
Don't worry we'll get to a Windows example soon.
What you really want to do here is set things up so that you have access to the system again in the
future.
You can upload and run any sort of remote access tool you want key loggers other back doors you name
it.
These are outside of the scope of this video but my point here is that once you have access on this
level you may want to make sure that you can get back in even after the target has left the local network.
Exactly how you go about doing that is up to you.
There are a wide range of options.
It is a good idea to practice on your own and develop a plan and a strategy of what to do here so that
you can put that plan into action very quickly.
Just to give you an example you might want to disable certain security features like antivirus or firewall
while making it appear to the user that they are still functional.
Or better yet authorize your remote access tool to go through the defenses while leaving them otherwise
completely alone.
The sky is the limit.
It is of course not necessary to escalate privileges in this example but that is also something you
can work on when you're dealing with certain systems.
Last but not least it is possible to set up a bot which we'll be talking about will make it to the module
covering bots and bought nets.
So a lot of options here and I'm sure you probably have some ideas at this point everything you do here
should be invisible to the user.
And if you aren't sure test it out using your own metal split able to machine in windowed mode so that
you can see both screens at the same time.
Control C will abort the session.
All right.
I know this was a short one but now we've seen how to get a reverse shell against a machine so our feet
are now good and wet.
Hopefully you feel that your patience with the lengthy explanations given in the first videos is paying
off and will pick up again in the next video with more direct examples.
And as always I have to say this in every video.
Never use this or any other tool to hack into any machine that you do not personally own or have written
permission to penetration test.
Always obey the law and be careful.
Thank you.