So now let's talk about launching exploits, so once we determine how our expertise might work and make
sure that I'm not malicious, you know, we can safely launch an attack.
So typically, you're going to do this by exploding it from the command line using the appropriate arguments.
You also might do it, you know, from exploit, for example, as well.
When you launch the exploit, it will mostly turn out like, you know, text on the screen for like
stuff that's happening in all kinds of different updates and stuff, you know, on the status of what's
going on to exploit.
And, you know, if all goes well to be successful and you have, you know, what's called a shell or
a command line, you know, on your host that's connecting out back out to your target.
So let's go see if we can actually launch an exploit and be able to do this.
OK, so you see how you can, you know, search for exploits, download them, check them out.
They actually launch them from the command line manually.
But you don't necessarily need to do that.
So the goal is actually to make this a little bit easier for you guys, though sometimes you may have
to do exploits manually, but for the most part, you can use something that's called.
So the most popular tool for hacking, you know, using callisthenics, Xbox that we're actually using
is a program called Medfly.
So Métis point is really like a one stop shop for hacking.
And it makes it very, very easy for a beginner to do everything that we've done so far.
It's going to give you a little bit less control.
In a sense.
It might not cover as much ground as you can manually, but a lot of your information effectively and
maybe launching attacks a lot easier.
And the searching process as far as exploits is a lot more streamlined and it be easier to actually
set it up.
So let's go check out mercifully.
OK, guys.
So I'm back on my college machine.
So if you want to launch off my display, it is going to take in MSF kosal and then you're going to
enter.
So one thing you might want to also do is just make sure that your machine is actually up to date before
you do it.
It'll take a second to open depending on, you know, your computer three speed.
I have a lot of things ready right now, so I might take a second, but make sure that your system is
as do like a pseudo Abati update and then upgrade just to make sure you have everything that you need,
although it did open up and then we're going to pop back early going and check out my display.
So one of the first things that you're actually going to notice about my display is that it has a lot
of things, you know, inside of it, essentially.
So if you recall before when we did the Help Command, we saw an array of commands that we got that
we could actually do so in.
One of them is DB maps.
So you remember that we did map scans before.
So what we could do is you can import with the DMAE import command and just point select the file like
if you did if you outputted a file from your map scans that you did, you get imported with this command.
It would just be debe import, demonically import and then the path to the file.
But we can also do an end map from here in and actually store everything from that and map inside this
database and we can just access all of it.
So let's actually try that out.
So let's do a DBI underscore and map and then we know that the target is one or two one six eight four
six one zero four.
So we can do this typical and I would do for I would be very verbose mode.
It doesn't matter what order you put these tags in, kind of like freestyler every single time I do
it.
So I'm going to be very verbose.
No, I'm just going to do a version scan.
I will do pause one, two, six, five, five, three, five.
That's what I'm going to do.
And then we can go ahead and enter and it's going to start to map and it's going to do the scan and
then it's also going to do a service scan.
So then we know what services are running and it's going to be stored inside of the display database.
So I'm going to let it run.
This is going to take a couple of minutes and then we'll come back.
OK, guys, so I map asking is finished now.
So let's check out, you know, what medicine we put into the database so we can come in and we can
do for scanning, getting multiple hosts.
We just type in command and it'll actually show you a list of the different addresses that you scan
right now is just one.
But now we know, hey, you know, our most vulnerable server is a part of our database.
So now we have information on it.
So another command that you can do is services.
And this will actually list out all the services that it found.
So you don't have to keep going back to a text file is scrolling back to the map output.
You just type in services in and print out all the services for all the hosts.
And I believe also you can specify by IP address here, we only have one here, of course, but you
can specify my IP address and I'll show you just for that IP address, it just lists all the services.
So now you know we're in medicine.
And we have this list right here so we can use this list to actually go through and try to find some
actual exploits to see if we can break into this box.
So another command that we can do, like we do when we do a search for the command line attacks or exploits
search, we can just type in search and then type in, you know, whatever we want to search, kind
of like kind of like an expert.
So.
So right now, let's check out this BSF TPD version two point three point four.
Let's see if that has some type of vulnerability.
So BSF, TPD two point three point four and let's see what comes up.
So, OK, so a few things came up.
What stands out to me after looking at these ViaSat DVD version, two point three point four Back-Door
command injection.
So that might be something that we could use.
So if you ever want to find an exploit, so you see over on the left here, there's a column with a
Pouncy right here for number.
So each one of these has a number if you want to use one of these.
So like, for example, this one has the number three beside it.
So you just have to use three and this is going to take us into the exploit.
So any time that you get into an exploit and you don't really know what it is or you don't know how
to use it, you can just type in info in order to give you information typically about it, you can
scroll up typically.
Sometimes they'll have like an explanation, like I had a description, figure out the name of the exploit.
Our platform is for different information about it.
And this is showing you the options right here.
I typically like to do that and then read the little description here where it tells you, you know,
what the exploit is doing exactly.
Or you know what it's for.
So that's pretty helpful.
So what I also what you also can do, they just type in options and tell you the options.
So with each module, which is what this is inside of Medfly, there are options that you have to set
and these options are what the exploit is actually going to use when it runs.
Think of it as setting variables so that the exploit just automatically knows what to do.
So like, for example, here, the two options are our hosts, which stands for remote hosts, which
would be our target, you know, typically, and then our port, which is like what port or what's our
destination port.
So this one in particular is FTP.
And, you know, FTP runs over Port twenty one.
So the ports are already set.
So what we need to do is actually set our host variable.
So what we can do is just to set our hosts.
You don't have to do a capital.
I figured that out a while back.
I think that you had to but you really don't.
It's smart enough to know and then you're going to put the IP address.
So one on two one six eight five six one two four in this case, Bamp.
So now our host is set today and you can confirm it by just typing options again.
And I'll tell you what is setsu.
So you always want to do this before you run and exploit, just to make sure that everything is good
to go.
So when the exploit is an exploit is all set up correctly, you have your variables set.
What you can do is you give you the time run or you get time and exploit type minute exploit feels a
little bit cooler, but they both work.
The same doesn't make a difference.
So you timing X winner and then is actually going to go through and actually attempt to exploit.
So right now and you typically you'll see stuff pop up on the screen, just output of what's going on,
what's happening.
A lot of the time you might run into areas.
You might have to go back and fix things or change report change and address change.
One of the options stuff happens like that, and it's just trial and error to figure it out.
That's the beauty of princesse.
So for this one, hey, is they found the shell and it looks like it's the root, so the root account.
So we have a session open, which means that we have pretty much access to a command line, you know,
on that hosts.
So let's actually see.
So one way you can confirm is something actually worked is type in who am I?
Enter.
Oh wow.
Group.
So we just gained access to this computer using numerously, literally within minutes.
Pretty easy.
And you can do different things.
You know, you do a president working director, you figure out what you are doing, let's figure out
what's here like what's what's in the current location.
You can sense we're a route.
We try to do whatever we want.
We can make our stuff.
And how we can do casts a shadow, which is actually the file on Linux that actually holds.
The hashes for all the user accounts, so there we go now we own the hashes, so maybe we could take
some of these hashes and, you know, try to crack them later on.
That's something that we could do.
So as you can see, my response is very powerful and it's very, very quick.
So we're able to exploit FCP in a matter of minutes.
So that's pretty neat.
So now let's go ahead and try another site.
So what we can do now is we can actually, you know, just from here, we can either do back and get
out of this exploit or you can just stay there.
But it doesn't really matter.
So what we can do is actually let's see, let's do services again and let's try to get into another
one.
So let's see.
Let's see.
We have the telnet, Tonette, right here.
So we're not telnet is open.
So we already kind of whatever way to exploit so on it before at least take advantage of it.
So let's try to do something similar, a little bit more direct, I guess we could say, or just show
you how you can do it with display without having to take those extra steps.
So what we can do is actually just search Toinette, and a lot of stuff's probably going to come up.
If you want to actually look through these.
A lot of things come up depending on what you search sometimes.
So you'll be ready for that and just make sure that you're looking and reading and making sure that,
you know, you're looking at, you know, each exploit and trying to figure out which one that you actually
want.
I found that the more search terms you put in and the more resource that you will get, so that's not
necessarily good.
You want to be specific, but also not, I guess, too specific because they'll start to search based
on each term and then it gets confusing.
But anyway, so for this one, we are going to look at this one right here.
That's number 12.
So it's this is the path for us.
So this is an auxiliary scanner telnet version of this garbage, and that's what we're going to use.
So we're going to do a use 12.
And once again, like I said before, you know, figure out the info, get some information audit to
see what's going on.
So this is Tonette service, better detection.
So it's pretty much going to try to figure out what version it's running.
So once again, the options are there, but you can also do options, come in and see what you have
to set.
And what's good to know is that when you're setting these options, look at what's under the required
column.
So some experts will have a lot more options.
Other ones like this one has a lot more than the other one.
Some are required and some aren't required.
So you want to make sure that you look at that and make sure that all the ones that have it.
Yes.
Under it have something set over here under the current setting column.
So this one, we don't have it for our hosts.
We're probably going to have to set this every time we're going to new exploit some once again, which
to our host set our hosts one on two one six eight five six one zero four bam.
Now we can do options again just to make sure that we're good to go and make sure that is that it doesn't
hurt to confirm.
So then we can do run or exploit depending on how you feel if you like it sounds better, but we can
just do run and hey and pull it out to try to connect over that port and pull down the banner or whatever
it got back from trying to connect.
So was useful about this one.
Now this won't always be the case and probably never will be.
But in this case, it it's, you know, hey, we're able to do successfully connect and then actually
pull down.
What happens when you try to connect this metal box in particular?
It turns out a banner and we see, hey, you can log in with Amazon Admins admin.
So that's pretty neat.
So now we'll be able to go through and just do like a telnet command and actually be able to, you know,
log in.
But we've already done that before.
We know that it works, but it's definitely useful to, you know, run like this particular module or
auxiliary scanner just to make if you ever find, like, you know, telnet open on a computer, it doesn't
hurt to run his command because you could pull some information like this.
You never know.
Some places are very bad security practices.
So I wouldn't be surprised if you find something like this somewhere.
OK, OK, guys.
So let's try another exploit right now.
So let's use it to find a way to actually get into the system.
So in this one, we're going to just type my services again and see what services and you'll see that
an updated so that, you know, with that information from the barrier that we grabbed before.
So metastable is very good.
It's very dynamic.
It's always going to be updating as you're doing things.
So it's very, very helpful, very useful.
So this time we want to go for we've got to try to get into The Da Vinci.
So let's see Protocol three point three.
So this is the one that we want to look at next.
Just try to see if we can get to this one.
So let's actually do a search together and see.
And it came up with a lot of stuff.
So we want to actually look through this and try to see, you know, what you could potentially use.
So one thing that I found is actually pretty useful is actually the Vincey login right here.
So we can go ahead.
And there's a description over here as well.
This is obviously authentication scanner.
So you use three and then we do info and figure out, you know, what the information about this exploit
is, what options are required, what aren't required.
You definitely always want to do that.
So Brigaded description says this module will test the server on a range of machines and report on successful
organs.
OK, so this is going to check hey, can we log in using.
And so what we know from the services for not the services being is one point fifty nine hundred.
So we know that that's already set here.
So we're good to go on that.
We just need to make sure that we said to our hosts, I actually already said it before.
So we have our Métis floatable address here.
So we want to make sure that those two are set and then we should be good to go on every.
So what we can do is actually we can just type and run, and it's a long and successful and this Colen
right here and then Password is showing that there was the user name was blank and they were able to
login with password.
And this might be something that you guys should find in a while a lot, because a lot of people want
to reset the default password on a lot of things, on a lot of services.
So it's definitely something to look for.
So now that we know that we can use different commands and actually try to connect, you know, via
VANOC, so and VSC is just kind of a way to have almost like a remote desktop and like a Linux kind
of way so we can actually use commands that are actually already installed onto the coffee machine to
try to connect, you know, to the machine.
So what we can do is we can type in VSC Connect and then one nine two dot one six eight dot five six
one zero four and enter and actually execute it.
So now that we connected with A, B and C, which is a good time to be in C viewer and now is asking,
hey, what B and C server do you want to connect to.
We do one on two one six eight five six one zero four.
And I was going to ask for a password.
So we know from our metastable exploit that the password is password.
So ssw d enter and bam now we have a desktop on the Métis political machine.
So it's pretty neat.
It's pretty useful.
Pretty quick.
You can play around with this and do anything.
Just like before when we had the root shell for the ATP Command, we pretty much had access to this
machine.
So that's pretty useful and pretty cool is very, very quick.
See, I hope you start to see how useful and how quick things are when using better split-Level and
it allows you to really dig in and be able to get all the information that you need and actually be
able to find your expertise pretty easily and run them pretty quickly.
OK, guys, so we're back at the display menu.
So what we can do is type in services just to see what's going on and let's try to check out something
else.
So I see my superior.
So we know my school is used for databases.
So maybe we can get into the Marsico database, maybe we can find some sensitive information.
So let's actually go in and try that.
So what we can do is search my school and see what comes up.
So there's thirty two things, the things that came up.
So that's not too bad.
So we just go to the top and start looking through and you can try a bunch of these different things,
you know, especially like the auxiliary ones, because those are just for confirming and finding information
and then they actually get you in there.
So we're going to look for is the my school login.
So which is right here.
So it's number ten.
So use ten and then there we go.
We had the my school log in module loaded so we could just typing info, get some information about
it.
So this modules simply queries the my single instance for a specific user and pass.
So the default is going to be a sort of default username that's on here if you don't say anything specifically
is going to be just through and then the password is going to be blank.
So if you want to, as you can see from these options, you can set up a password file.
So you would just do like if you wanted to do this.
User said user on the score file user pass is a pass fail and then you can just go to the directory
whenever you have a password file set up and you can also do a user file.
So user on this file and like linked to a directory where you have a list of username and a text file
or something.
So that's an option that you can do right now.
We're just going to keep it how it is right now and see if we can get into my school, you know, using
what the default credentials are, because more often or not, you might actually find that out in a
while.
But know that you can also, you know, if you want to set username, you know, to, I don't know,
eight there, say you can do that.
So that's an option.
And then you can always check and was said to there you go.
It's so what we're going to do actually we're just going to keep it as root.
And then I believe that everything else is set that needs to be set.
So what we can do is.
Actually run this exploit, so this type of explainer, and so I found my school version 5.0 A's, we
have a successful logging from route and then call them right there.
So there's a blank password.
So now we know that overreport 33 06, we can connect to my school with the route account.
So now knowing that information, what we can do is actually typing my school and actually connectivity
BS.
So the way that you can connect to my school database is my school that you are then using.
So in this case, Root and H then put the this is going to be the IP address of the target.
So this be one or two one six eight five six one zero four.
And then after that we could just sit here and say we just got access to the high school degree.
So that's pretty neat.
So just to quickly show you guys a little bit in case you don't know any Marsico, I know a little bit
just for, you know, just to be able to use it in the field very quickly to get information.
So what you can do is like a show database's, come in and make sure you always have a calling out.
Everything for my school's part of the syntax so you can't enter and it's going to show you the different
databases.
So what we can do is actually select one of these databases.
So if we want to, for example, use a tent, this will actually select the OOS 10 database so we can
do that.
And then now, hey, we changed our database.
So what we can do now is actually look at the tables inside of the database so we can show tables and
then that's semicolon.
And then now it's shown it's, hey, these are the tables inside of this database.
So now this is where the fun part comes.
We can select information from it.
So, uh, I like the credit cards one.
So I want to go buy something on Amazon.
So select star from credit cards.
So just briefly go over it.
This is going to select.
Everything this star means everything from the credit cards table, so we're selecting everything from
this credit card table.
So now let's see what is actually going to give us.
And hey, oh, we got some credit card numbers.
Nice.
So we have the credit card number to see as we the expiration date.
This is pretty much everything we need to go by something that happens.
Not if you want to see this.
That's pretty neat.
So you can look into more in depth as you all come in and practice a little bit.
Definitely get used to it, because if you're going to be ethical hacker, you know, these kind of
skills are going to be pretty useful.
So I recommend that you guys kind of look into that and yet you're going to be on your way to becoming
a pro.