1
1
00:00:00,150 --> 00:00:00,990
In this lesson,
2
2
00:00:00,990 --> 00:00:02,640
we're going to talk about Metasploit
3
3
00:00:02,640 --> 00:00:05,010
which is a multi-purpose computer security
4
4
00:00:05,010 --> 00:00:07,080
and penetration testing framework.
5
5
00:00:07,080 --> 00:00:11,100
It contains a lot of great things inside of Metasploit.
6
6
00:00:11,100 --> 00:00:12,900
Now it comes installed by default
7
7
00:00:12,900 --> 00:00:14,760
inside of Cali and Parrot Linux
8
8
00:00:14,760 --> 00:00:17,460
and most other penetration testing distributions
9
9
00:00:17,460 --> 00:00:19,680
because it is probably the number one tool
10
10
00:00:19,680 --> 00:00:23,010
that most penetration testers are going to use, to launch it,
11
11
00:00:23,010 --> 00:00:25,140
simply type in MSF console
12
12
00:00:25,140 --> 00:00:28,650
for Metasploit framework console and hit enter.
13
13
00:00:28,650 --> 00:00:29,730
When you do that,
14
14
00:00:29,730 --> 00:00:32,550
the Metasploit framework is going to load up.
15
15
00:00:32,550 --> 00:00:34,620
Now it takes a couple of seconds for it to load
16
16
00:00:34,620 --> 00:00:35,760
and every time you load it,
17
17
00:00:35,760 --> 00:00:38,250
you're going to get a different splash screen.
18
18
00:00:38,250 --> 00:00:40,980
In this case, we have this big C looking thing
19
19
00:00:40,980 --> 00:00:42,720
with a lot of words in it.
20
20
00:00:42,720 --> 00:00:44,820
Every time you launch it, you're going to get a different one
21
21
00:00:44,820 --> 00:00:45,690
and usually there's some kind
22
22
00:00:45,690 --> 00:00:48,120
of a joke or pun inside of those.
23
23
00:00:48,120 --> 00:00:50,940
More importantly though, you can see down at the bottom
24
24
00:00:50,940 --> 00:00:55,290
that I have Metasploit framework version 6.1.27
25
25
00:00:55,290 --> 00:00:59,040
and it tells me how many exploits, auxiliaries, posts,
26
26
00:00:59,040 --> 00:01:02,850
payload, encoders, NOPs, and evasions there are.
27
27
00:01:02,850 --> 00:01:04,800
Now, what are all of those things?
28
28
00:01:04,800 --> 00:01:06,390
Well, let's talk about them.
29
29
00:01:06,390 --> 00:01:08,130
First, we have exploits.
30
30
00:01:08,130 --> 00:01:11,790
You can see here, there are almost 2200 different exploits.
31
31
00:01:11,790 --> 00:01:15,270
An exploit is simply some piece of code or software
32
32
00:01:15,270 --> 00:01:18,300
that can deliver a payload and do some sort of an attack
33
33
00:01:18,300 --> 00:01:20,010
on a given target.
34
34
00:01:20,010 --> 00:01:22,320
All these different exploits go after different
35
35
00:01:22,320 --> 00:01:25,710
vulnerabilities on different windows, Linux, mobile
36
36
00:01:25,710 --> 00:01:28,130
and other systems that you may encounter in the field.
37
37
00:01:28,130 --> 00:01:31,740
The second category we have there is known as auxiliary,
38
38
00:01:31,740 --> 00:01:34,050
now auxiliary, there is over 1100
39
39
00:01:34,050 --> 00:01:36,390
of these inside the Metasploit framework.
40
40
00:01:36,390 --> 00:01:40,410
This includes scanners, sniffers, fuzzer, spoofers
41
41
00:01:40,410 --> 00:01:43,830
and other non exploit features of this tool set.
42
42
00:01:43,830 --> 00:01:47,340
For example, instead of using Nmap to do your port scanning,
43
43
00:01:47,340 --> 00:01:50,220
you can actually use auxiliaries that are set up inside
44
44
00:01:50,220 --> 00:01:53,610
of the Metasploit framework to do that same type of work.
45
45
00:01:53,610 --> 00:01:55,950
The next one we have is what's known as post
46
46
00:01:55,950 --> 00:01:58,920
and you can see there are 400 as of this version.
47
47
00:01:58,920 --> 00:02:01,560
Now, a post is basically any additional task
48
48
00:02:01,560 --> 00:02:04,440
that you may need to perform on a compromised host
49
49
00:02:04,440 --> 00:02:07,620
And post stands for post exploitation, which means
50
50
00:02:07,620 --> 00:02:09,960
once you've broke into the box, what are those things
51
51
00:02:09,960 --> 00:02:12,810
you need to do to maintain persistence, cover your tracks
52
52
00:02:12,810 --> 00:02:14,310
and other things like that.
53
53
00:02:14,310 --> 00:02:16,950
Next you'll see we have payloads and we have almost
54
54
00:02:16,950 --> 00:02:18,880
600 payloads in this version.
55
55
00:02:18,880 --> 00:02:22,440
Essentially, payloads are what exploits are going to deliver
56
56
00:02:22,440 --> 00:02:23,280
and then run.
57
57
00:02:23,280 --> 00:02:25,640
When you run those payloads, it gives you control
58
58
00:02:25,640 --> 00:02:28,110
over machine or it gives you elevated permissions
59
59
00:02:28,110 --> 00:02:30,330
or something like that.
60
60
00:02:30,330 --> 00:02:33,180
Next we have encoders and there's 45 encoders
61
61
00:02:33,180 --> 00:02:34,013
in this version.
62
62
00:02:34,013 --> 00:02:36,660
Now, encoders are used to ensure the payloads make it
63
63
00:02:36,660 --> 00:02:40,140
to their destination in one piece and undetected,
64
64
00:02:40,140 --> 00:02:42,240
you may encode things or encrypt things
65
65
00:02:42,240 --> 00:02:45,960
to bypass different intrusion detection systems, firewalls,
66
66
00:02:45,960 --> 00:02:49,500
router ACLs and things like that, we also have NOPs.
67
67
00:02:49,500 --> 00:02:51,510
There are 10 different NOPS here.
68
68
00:02:51,510 --> 00:02:54,090
Now, a NOP is a non-op operation.
69
69
00:02:54,090 --> 00:02:56,670
NOPs are used to keep the payload sizes consistent
70
70
00:02:56,670 --> 00:02:58,620
across all the different exploit attempts
71
71
00:02:58,620 --> 00:02:59,790
that you're going to going to do.
72
72
00:02:59,790 --> 00:03:02,580
This is also useful as part of your evasion.
73
73
00:03:02,580 --> 00:03:04,470
And finally, we have evasion.
74
74
00:03:04,470 --> 00:03:06,810
This is a category that has nine different types
75
75
00:03:06,810 --> 00:03:09,900
of evasion techniques that again, you can use as ways to
76
76
00:03:09,900 --> 00:03:13,260
try to get by or get through some sort of defenses
77
77
00:03:13,260 --> 00:03:15,232
that somebody has set up against you.
78
78
00:03:15,232 --> 00:03:18,690
Now you'll notice once you go into the Metasploit framework,
79
79
00:03:18,690 --> 00:03:21,600
you come up to the Metasploit prompt and here you can see it
80
80
00:03:21,600 --> 00:03:24,990
as MSF6 telling me I am in version six
81
81
00:03:24,990 --> 00:03:27,150
of the Metasploit framework.
82
82
00:03:27,150 --> 00:03:29,790
Now, when you go and use the Metasploit framework,
83
83
00:03:29,790 --> 00:03:32,850
you need to tell it what tools you want to use.
84
84
00:03:32,850 --> 00:03:36,690
So everything is built up in a specific pattern.
85
85
00:03:36,690 --> 00:03:38,940
They list it out by the module type saying
86
86
00:03:38,940 --> 00:03:43,140
if it's an exploit, auxiliary, post, payloads, encoders,
87
87
00:03:43,140 --> 00:03:46,560
NOPs or evasion, then the platform that you're targeting,
88
88
00:03:46,560 --> 00:03:50,860
Windows, Linux, Apple, et cetera, then the target service
89
89
00:03:51,869 --> 00:03:55,200
SMB, FTP, whatever that happens to be, and then
90
90
00:03:55,200 --> 00:03:56,790
the module name.
91
91
00:03:56,790 --> 00:03:58,110
So to use one of these things,
92
92
00:03:58,110 --> 00:04:00,240
you simply have to list out its name.
93
93
00:04:00,240 --> 00:04:02,940
Now, that's easier said than done because there are so many
94
94
00:04:02,940 --> 00:04:03,870
of these, right?
95
95
00:04:03,870 --> 00:04:06,420
But I have one memorized that I use all the time
96
96
00:04:06,420 --> 00:04:07,824
and so I would just type in use
97
97
00:04:07,824 --> 00:04:12,824
exploit/windows/SMB/MS17_010_psexec.
98
98
00:04:19,620 --> 00:04:21,330
Now what does this say?
99
99
00:04:21,330 --> 00:04:24,210
This says, I want to use this exploit that targets
100
100
00:04:24,210 --> 00:04:28,890
Window systems over SMB using the vulnerability associated
101
101
00:04:28,890 --> 00:04:33,330
with Microsoft patch 010 in the year 2017.
102
102
00:04:33,330 --> 00:04:35,340
And if you're not familiar with this, this was known
103
103
00:04:35,340 --> 00:04:38,220
as Eternal blue, which was a large vulnerability back
104
104
00:04:38,220 --> 00:04:41,970
in 2017 and made up the core of the ransom order known
105
105
00:04:41,970 --> 00:04:45,870
as WannaCry, when you hit enter, it's going to then load
106
106
00:04:45,870 --> 00:04:49,800
that module for you to use, notice my prompt has changed.
107
107
00:04:49,800 --> 00:04:52,920
It now says MSF6 exploit and then
108
108
00:04:52,920 --> 00:04:56,220
in parenthesis what exploit I'm going to be using.
109
109
00:04:56,220 --> 00:04:58,290
Now from here we would have to look
110
110
00:04:58,290 --> 00:04:59,910
at the different options that are available
111
111
00:04:59,910 --> 00:05:02,790
for this particular exploit, to do that,
112
112
00:05:02,790 --> 00:05:04,472
simply type in options.
113
113
00:05:04,472 --> 00:05:07,290
When you type in options, you'll see all the things
114
114
00:05:07,290 --> 00:05:09,240
in this table that you have to have a setting
115
115
00:05:09,240 --> 00:05:11,520
for in order to use this attack.
116
116
00:05:11,520 --> 00:05:14,190
For instance, do you want to have the setting true
117
117
00:05:14,190 --> 00:05:15,990
or false for debug trace?
118
118
00:05:15,990 --> 00:05:18,350
And this shows extra debug information.
119
119
00:05:18,350 --> 00:05:21,210
You'll notice this is a required field.
120
120
00:05:21,210 --> 00:05:22,043
As you go through
121
121
00:05:22,043 --> 00:05:24,180
there's going to be different things you're going to use
122
122
00:05:24,180 --> 00:05:25,890
based on this particular exploit
123
123
00:05:25,890 --> 00:05:28,920
and every exploit and every auxiliary in post
124
124
00:05:28,920 --> 00:05:31,050
and NOP is going to be set up differently.
125
125
00:05:31,050 --> 00:05:32,490
But by using options,
126
126
00:05:32,490 --> 00:05:35,130
you could always see what options need to be made.
127
127
00:05:35,130 --> 00:05:36,030
In this case,
128
128
00:05:36,030 --> 00:05:37,920
one of the things that's required that has not
129
129
00:05:37,920 --> 00:05:40,170
been set yet is the R host
130
130
00:05:40,170 --> 00:05:43,020
which is the target host you want to go after.
131
131
00:05:43,020 --> 00:05:45,600
For example, if during my information gathering
132
132
00:05:45,600 --> 00:05:46,860
and vulnerability scanning,
133
133
00:05:46,860 --> 00:05:48,960
I identify that there is a workstation
134
134
00:05:48,960 --> 00:05:51,240
with a certain IP address that might be vulnerable
135
135
00:05:51,240 --> 00:05:53,940
to this attack because it was missing this patch,
136
136
00:05:53,940 --> 00:05:56,070
I could then use that as my Rhost.
137
137
00:05:56,070 --> 00:05:57,573
And to do that, I'll just type in set,
138
138
00:05:57,573 --> 00:06:00,810
the option I want to, set in this case Rhost
139
139
00:06:00,810 --> 00:06:02,670
and then the IP address of that machine.
140
140
00:06:02,670 --> 00:06:07,470
Let's say it was 192.168.1.2 and hit enter.
141
141
00:06:07,470 --> 00:06:08,790
Now you'll see that it is set
142
142
00:06:08,790 --> 00:06:11,190
to that Rhost, to that IP address
143
143
00:06:11,190 --> 00:06:13,800
and if I type in my options again, you will see now
144
144
00:06:13,800 --> 00:06:16,830
that everything that is required has been filled in.
145
145
00:06:16,830 --> 00:06:19,260
And this is the way you use these different tools
146
146
00:06:19,260 --> 00:06:21,150
inside the Metasploit framework.
147
147
00:06:21,150 --> 00:06:24,630
When you see things like Rhost, that is the remote host
148
148
00:06:24,630 --> 00:06:27,680
or the IP you want to target, Rport, the remote port
149
149
00:06:27,680 --> 00:06:30,207
you want to target, things like Lhosts
150
150
00:06:30,207 --> 00:06:31,900
and Lport are the local host
151
151
00:06:31,900 --> 00:06:35,610
and local port notice you'll see the payload options down
152
152
00:06:35,610 --> 00:06:36,540
at the bottom.
153
153
00:06:36,540 --> 00:06:39,330
The payload options here is what are we going to do
154
154
00:06:39,330 --> 00:06:41,310
once we run that exploit?
155
155
00:06:41,310 --> 00:06:43,350
Just exploiting something doesn't do you any good,
156
156
00:06:43,350 --> 00:06:45,810
you have to run some kind of code afterwards.
157
157
00:06:45,810 --> 00:06:49,440
And in this case, we are setting up a reverse TCP shell
158
158
00:06:49,440 --> 00:06:52,920
using the interpreter shell inside of Metasploit.
159
159
00:06:52,920 --> 00:06:55,530
This will allow us to have a connection to that machine
160
160
00:06:55,530 --> 00:06:58,800
and then do things on that machine that we want to do
161
161
00:06:58,800 --> 00:07:00,990
as part of our post exploitation
162
162
00:07:00,990 --> 00:07:03,870
like doing more information gathering, collecting files
163
163
00:07:03,870 --> 00:07:06,900
and doing data exfiltration, changing settings,
164
164
00:07:06,900 --> 00:07:10,290
pivoting to other machines and all of those type of things.
165
165
00:07:10,290 --> 00:07:12,210
Now there is a lot to Metasploit
166
166
00:07:12,210 --> 00:07:13,650
and we're not going to cover all of it
167
167
00:07:13,650 --> 00:07:16,590
in this video because that can be an entire course
168
168
00:07:16,590 --> 00:07:19,170
of 20 to 40 hours on its own.
169
169
00:07:19,170 --> 00:07:20,760
But what you need to understand is
170
170
00:07:20,760 --> 00:07:23,430
that Metasploit is a very powerful framework
171
171
00:07:23,430 --> 00:07:26,070
and you should be able to understand the very basics
172
172
00:07:26,070 --> 00:07:27,000
of setting up things
173
173
00:07:27,000 --> 00:07:29,514
like options and then running those exploits.
174
174
00:07:29,514 --> 00:07:32,070
If this option was already set up perfectly
175
175
00:07:32,070 --> 00:07:34,380
and I'm ready to run the exploit, to do that,
176
176
00:07:34,380 --> 00:07:37,830
I would simply type in the command run and hit enter.
177
177
00:07:37,830 --> 00:07:39,390
Now, in this particular case,
178
178
00:07:39,390 --> 00:07:41,790
I'm not on a network where there is a vulnerable host
179
179
00:07:41,790 --> 00:07:45,960
at 192.168.1.2, so if I try to run it,
180
180
00:07:45,960 --> 00:07:47,040
it's going to end up failing
181
181
00:07:47,040 --> 00:07:48,690
because it's not going to be able to talk
182
182
00:07:48,690 --> 00:07:49,860
to that particular device
183
183
00:07:49,860 --> 00:07:53,010
because it was unreachable as you saw here.
184
184
00:07:53,010 --> 00:07:54,000
Now let me go ahead
185
185
00:07:54,000 --> 00:07:57,000
and show you how we use this in the real world.
186
186
00:07:57,000 --> 00:08:00,540
To do this, I've gone ahead and set up a vulnerable machine
187
187
00:08:00,540 --> 00:08:02,160
called Metasploitable two
188
188
00:08:02,160 --> 00:08:06,180
and you can download this from Rapid seven who created this.
189
189
00:08:06,180 --> 00:08:07,950
This is a Linux distribution.
190
190
00:08:07,950 --> 00:08:10,260
It is intentionally vulnerable and has lots
191
191
00:08:10,260 --> 00:08:12,510
and lots of different problems with it
192
192
00:08:12,510 --> 00:08:15,420
and that is good for us to be able to practice on.
193
193
00:08:15,420 --> 00:08:17,070
So what I want to do is I want to get
194
194
00:08:17,070 --> 00:08:18,420
out of this particular exploit.
195
195
00:08:18,420 --> 00:08:20,220
So I'm going to type in exit and you'll see
196
196
00:08:20,220 --> 00:08:23,580
that that took me out of the entire Metasploit framework.
197
197
00:08:23,580 --> 00:08:25,500
So now that I have a nice clear screen,
198
198
00:08:25,500 --> 00:08:27,300
what we're going to do is we are going to search
199
199
00:08:27,300 --> 00:08:30,438
on this network using Nmap to try to identify
200
200
00:08:30,438 --> 00:08:35,040
what is that particular vulnerable machine's IP address.
201
201
00:08:35,040 --> 00:08:37,080
And I know this, it's on the same local area network
202
202
00:08:37,080 --> 00:08:39,210
as I'm in, so I'm just going to type in IF config
203
203
00:08:39,210 --> 00:08:40,686
to find out my IP address,
204
204
00:08:40,686 --> 00:08:45,630
which is 172.16.218.128.
205
205
00:08:45,630 --> 00:08:46,950
And so I'm going to use Nmap
206
206
00:08:46,950 --> 00:08:51,950
and I'm going to scan172.16.218.1/24.
207
207
00:08:53,910 --> 00:08:55,950
because I'm not sure what the IP address is
208
208
00:08:55,950 --> 00:08:57,690
of that vulnerable machine.
209
209
00:08:57,690 --> 00:08:59,550
When I do this, Nmap is going to go
210
210
00:08:59,550 --> 00:09:01,230
out and scan the entire network
211
211
00:09:01,230 --> 00:09:04,680
of up to 254 hosts on this subnet.
212
212
00:09:04,680 --> 00:09:05,760
Now as it comes back,
213
213
00:09:05,760 --> 00:09:08,520
you'll see that we found a couple of things.
214
214
00:09:08,520 --> 00:09:11,273
Let me scroll up a little bit so we can see what we have.
215
215
00:09:12,330 --> 00:09:15,360
And you'll see that Nmap went and found two
216
216
00:09:15,360 --> 00:09:18,030
different hosts that were reporting back ports.
217
217
00:09:18,030 --> 00:09:23,030
The first one was located at 172.16.218.1
218
218
00:09:23,040 --> 00:09:25,230
and that is my router or gateway.
219
219
00:09:25,230 --> 00:09:27,990
And you'll see that there is an Apple file server
220
220
00:09:27,990 --> 00:09:32,370
and there is UPNP that is open on those particular ports.
221
221
00:09:32,370 --> 00:09:34,680
Now the more important one is the one that we see here
222
222
00:09:34,680 --> 00:09:39,680
at the bottom, 172.16.218.130,
223
223
00:09:39,990 --> 00:09:42,060
this is my vulnerable machine.
224
224
00:09:42,060 --> 00:09:44,280
And you'll notice, there are a lot
225
225
00:09:44,280 --> 00:09:46,590
of different things on this machine.
226
226
00:09:46,590 --> 00:09:49,530
Notice that there are 23 open ports
227
227
00:09:49,530 --> 00:09:53,320
and these are things like FTP, SSH, Telenet,
228
228
00:09:53,320 --> 00:09:58,320
SMTP, domain, HTTP, RCP bind and many others.
229
229
00:09:58,320 --> 00:10:00,300
Now, if we wanted to find out more information
230
230
00:10:00,300 --> 00:10:02,160
about these particular ports,
231
231
00:10:02,160 --> 00:10:06,050
we can do that by fingerprinting those ports or using Nmap
232
232
00:10:06,050 --> 00:10:09,030
with a service scan to figure out what they're running.
233
233
00:10:09,030 --> 00:10:11,190
And that's exactly what I'm going to do.
234
234
00:10:11,190 --> 00:10:12,960
So I'm going to use Nmap,
235
235
00:10:12,960 --> 00:10:15,170
I'm going to target just the IP that I want to go after
236
236
00:10:15,170 --> 00:10:19,790
which is 172.16.218.130.
237
237
00:10:19,790 --> 00:10:23,350
and I want to do that with a service scan of dash SV.
238
238
00:10:23,350 --> 00:10:24,720
If I go ahead and hit enter,
239
239
00:10:24,720 --> 00:10:27,723
it's going to go run off and do that scan for me.
240
240
00:10:28,630 --> 00:10:30,810
All right, now that the results are back,
241
241
00:10:30,810 --> 00:10:33,000
we can look at those particular services
242
242
00:10:33,000 --> 00:10:35,070
and see if there's anything that's vulnerable.
243
243
00:10:35,070 --> 00:10:37,010
Now this is where you'd normally do your information
244
244
00:10:37,010 --> 00:10:39,690
gathering and vulnerability assessment part
245
245
00:10:39,690 --> 00:10:41,040
of your engagement.
246
246
00:10:41,040 --> 00:10:42,360
Now, I've already done this,
247
247
00:10:42,360 --> 00:10:46,710
and I know that port 6667, that is open for IRC,
248
248
00:10:46,710 --> 00:10:50,730
using the Unreal IRC damon is a vulnerable version.
249
249
00:10:50,730 --> 00:10:52,140
And so that's what I'm going to target
250
250
00:10:52,140 --> 00:10:54,630
and show you how to use Metasploit to go after
251
251
00:10:54,630 --> 00:10:59,190
and exploit the vulnerability in that unreal IRC damon.
252
252
00:10:59,190 --> 00:11:01,080
To do this, we again need to go back
253
253
00:11:01,080 --> 00:11:03,030
into the Metasploit console.
254
254
00:11:03,030 --> 00:11:05,160
So we're going to go MSF console.
255
255
00:11:05,160 --> 00:11:07,620
And when we get up into that screen again,
256
256
00:11:07,620 --> 00:11:10,110
we are going to use the vulnerability
257
257
00:11:10,110 --> 00:11:13,140
for the Unreal IRC damon.
258
258
00:11:13,140 --> 00:11:15,090
Now the first thing I want to do is search
259
259
00:11:15,090 --> 00:11:16,740
for that vulnerability to see
260
260
00:11:16,740 --> 00:11:19,350
if there is any exploits associated with it.
261
261
00:11:19,350 --> 00:11:23,970
So if I type in search IRC, I can hit enter
262
262
00:11:23,970 --> 00:11:25,950
and all of the things that have IRC in it
263
263
00:11:25,950 --> 00:11:27,420
are going to show up.
264
264
00:11:27,420 --> 00:11:30,600
If you look down at line 18, there is one
265
265
00:11:30,600 --> 00:11:34,863
for exploit/unix/IRC/unrealIRCD3281backdoor.
266
266
00:11:39,420 --> 00:11:40,713
Now what this means is
267
267
00:11:40,713 --> 00:11:44,010
that this is an exploit that targets Unix systems
268
268
00:11:44,010 --> 00:11:45,840
which is what Metasploitable is.
269
269
00:11:45,840 --> 00:11:50,280
It targets the IRC port, which is what was open at 6667
270
270
00:11:50,280 --> 00:11:54,700
and it targets the Unreal IRC damon, version 3281
271
271
00:11:54,700 --> 00:11:57,780
and there's a backdoor in that particular version.
272
272
00:11:57,780 --> 00:12:00,090
And so that's what we want to use.
273
273
00:12:00,090 --> 00:12:02,730
Now to use it, I can type out the entire thing
274
274
00:12:02,730 --> 00:12:07,730
of use exploit/unix/IRC/unrealIRCD3281backdoor,
275
275
00:12:11,010 --> 00:12:14,310
or I can use it based on its number, and in this case,
276
276
00:12:14,310 --> 00:12:17,172
it's number 18, so I'll go ahead and hit 18
277
277
00:12:17,172 --> 00:12:21,030
and you'll notice it is now the one listed as my exploit.
278
278
00:12:21,030 --> 00:12:23,280
So we're going to go ahead and look at our options.
279
279
00:12:23,280 --> 00:12:26,850
And for our options, we only need to set two things
280
280
00:12:26,850 --> 00:12:28,905
the Rhosts and the Rport.
281
281
00:12:28,905 --> 00:12:32,220
Now we already know what the Rhost is.
282
282
00:12:32,220 --> 00:12:34,590
In this case we're going to set our Rhost
283
283
00:12:34,590 --> 00:12:38,373
to 172.16.218.130 and hit enter.
284
284
00:12:41,430 --> 00:12:44,430
Now the port is port 6667
285
285
00:12:44,430 --> 00:12:46,950
which is the port that was running on our server.
286
286
00:12:46,950 --> 00:12:49,200
If it was running on a different port, we would just type
287
287
00:12:49,200 --> 00:12:52,170
in set port and the port we want to set it to.
288
288
00:12:52,170 --> 00:12:53,003
Now I'm going to go ahead
289
289
00:12:53,003 --> 00:12:55,530
add options again to make sure it took and yes it did.
290
290
00:12:55,530 --> 00:12:58,620
I can see my Rhost is now there.
291
291
00:12:58,620 --> 00:13:01,380
Now that we have our Rhost and our port set up,
292
292
00:13:01,380 --> 00:13:03,180
we are ready to run this exploit.
293
293
00:13:03,180 --> 00:13:05,890
But if we do that now, nothing's really going to happen
294
294
00:13:05,890 --> 00:13:09,810
because we've set an exploit but we haven't set a payload.
295
295
00:13:09,810 --> 00:13:11,460
And a payload is necessary to say
296
296
00:13:11,460 --> 00:13:14,220
what do you want to do once you exploit this server?
297
297
00:13:14,220 --> 00:13:15,450
So I'm going to show you what that looks
298
298
00:13:15,450 --> 00:13:16,920
like just so you can see the error.
299
299
00:13:16,920 --> 00:13:18,960
And if you hit run, it's going to go off
300
300
00:13:18,960 --> 00:13:22,110
it's going to try the exploit, but it fails.
301
301
00:13:22,110 --> 00:13:23,160
Why did it fail?
302
302
00:13:23,160 --> 00:13:24,994
Because a payload was not selected.
303
303
00:13:24,994 --> 00:13:27,630
So as you can see, there was no payload.
304
304
00:13:27,630 --> 00:13:30,870
So we have to be able to set a payload, to do this,
305
305
00:13:30,870 --> 00:13:33,690
we're going to type in show payloads and hit enter
306
306
00:13:33,690 --> 00:13:35,940
and this will show us all the compatible payloads
307
307
00:13:35,940 --> 00:13:38,760
that are known to work with this particular exploit.
308
308
00:13:38,760 --> 00:13:41,520
And here you can see there are 11 different payloads.
309
309
00:13:41,520 --> 00:13:44,100
To keep things simple, I'm going to use the first one
310
310
00:13:44,100 --> 00:13:48,480
which is payload/command/unix/bindpearl,
311
311
00:13:48,480 --> 00:13:50,670
which is going to set up a bind shell
312
312
00:13:50,670 --> 00:13:53,400
on that remote server so that I can connect
313
313
00:13:53,400 --> 00:13:56,940
into it at any time I want and take over the system.
314
314
00:13:56,940 --> 00:14:00,660
To do this, we're going to use set payload and then the name
315
315
00:14:00,660 --> 00:14:04,170
which is command/unix/bind pearl.
316
316
00:14:04,170 --> 00:14:05,670
Notice this is a little bit different
317
317
00:14:05,670 --> 00:14:07,320
than when you're using an exploit.
318
318
00:14:07,320 --> 00:14:10,320
When you use an exploit, you're going to say use space
319
319
00:14:10,320 --> 00:14:13,590
and then everything after that is all one big word
320
320
00:14:13,590 --> 00:14:15,150
with the slashes between it
321
321
00:14:15,150 --> 00:14:19,080
but with payloads it's set payload, and then the command,
322
322
00:14:19,080 --> 00:14:21,213
the system and the payload you want to use.
323
323
00:14:21,213 --> 00:14:24,810
Go ahead and hit enter there and then hit show options.
324
324
00:14:24,810 --> 00:14:25,643
When you do this,
325
325
00:14:25,643 --> 00:14:27,360
you're going to be able to see the configuration
326
326
00:14:27,360 --> 00:14:30,840
for both the exploit and the payload, for the exploit,
327
327
00:14:30,840 --> 00:14:33,390
we're going to go and connect to that IRC server
328
328
00:14:33,390 --> 00:14:38,250
at 172.16.218.130 over port 6667.
329
329
00:14:39,420 --> 00:14:40,890
We're going to then send a payload
330
330
00:14:40,890 --> 00:14:44,700
that is a bind shell that's going to bind on that IRC server
331
331
00:14:44,700 --> 00:14:48,930
and open up a connection port at 4444.
332
332
00:14:48,930 --> 00:14:50,190
This will allow me to connect
333
333
00:14:50,190 --> 00:14:54,870
to that remote host anytime I want over port 4444
334
334
00:14:54,870 --> 00:14:58,440
and be able to access this vine shell using pearl.
335
335
00:14:58,440 --> 00:15:02,670
Now to run this, I'm simply going to type in run and hit enter.
336
336
00:15:02,670 --> 00:15:05,040
You can now see that we are connecting
337
337
00:15:05,040 --> 00:15:10,040
from our Colli machine to that server over port 6667.
338
338
00:15:10,140 --> 00:15:11,940
We set the back door command
339
339
00:15:11,940 --> 00:15:15,120
and we were able to start that buying TCP handler
340
340
00:15:15,120 --> 00:15:20,120
on that remote server of 172.16.218.130 over port 4444.
341
341
00:15:22,560 --> 00:15:25,140
And now I have a valid connection that is
342
342
00:15:25,140 --> 00:15:27,840
called command shell session one that is open
343
343
00:15:27,840 --> 00:15:30,480
between my Colli machine 172.16.218.128
344
344
00:15:33,270 --> 00:15:38,270
from port 46773 over to the remote shell that I created
345
345
00:15:38,790 --> 00:15:43,790
with that bind shell on port 4444 of that IRC server.
346
346
00:15:44,190 --> 00:15:46,230
Now you'll see that nothing really happened.
347
347
00:15:46,230 --> 00:15:47,550
We're just sitting there
348
348
00:15:47,550 --> 00:15:50,010
and we are at basically a blank screen.
349
349
00:15:50,010 --> 00:15:50,910
Why is that?
350
350
00:15:50,910 --> 00:15:52,860
Well, because we're actually at a command prompt
351
351
00:15:52,860 --> 00:15:54,150
you just don't know it.
352
352
00:15:54,150 --> 00:15:56,070
And so if you want to see where you are,
353
353
00:15:56,070 --> 00:15:58,441
you can use your Linux commands like PWD
354
354
00:15:58,441 --> 00:16:00,800
to figure out what is the working directory you're in
355
355
00:16:00,800 --> 00:16:04,800
and I am right now in the slash etc unreal directory.
356
356
00:16:04,800 --> 00:16:08,160
If I wanted to see the files in there, I can type in LS
357
357
00:16:08,160 --> 00:16:11,730
and I get back the answers of donation, license, aliases
358
358
00:16:11,730 --> 00:16:13,720
and all the other things that are in that directory.
359
359
00:16:13,720 --> 00:16:16,860
If I want to figure out what type of permissions I have,
360
360
00:16:16,860 --> 00:16:18,240
I can do, who am I?
361
361
00:16:18,240 --> 00:16:20,300
And when I do, who am I? I am root.
362
362
00:16:20,300 --> 00:16:23,360
I was able to get into this box using brute access
363
363
00:16:23,360 --> 00:16:26,010
by running this particular exploit.
364
364
00:16:26,010 --> 00:16:27,450
And that's the way these things work
365
365
00:16:27,450 --> 00:16:30,090
at a very basic level to set up an exploit,
366
366
00:16:30,090 --> 00:16:32,700
set up a payload, and then run an attack.
367
367
00:16:32,700 --> 00:16:35,220
Now, the last thing I want to show you is this concept
368
368
00:16:35,220 --> 00:16:36,053
of sessions,
369
369
00:16:36,053 --> 00:16:38,790
notice here it said the command shell session one
370
370
00:16:38,790 --> 00:16:42,086
was opened, that means there might be other sessions too.
371
371
00:16:42,086 --> 00:16:43,440
What this is is
372
372
00:16:43,440 --> 00:16:46,470
that Metasploit allows you to run multiple sessions
373
373
00:16:46,470 --> 00:16:48,450
so you can do multiple different attacks
374
374
00:16:48,450 --> 00:16:51,390
or if you need to chain exploits across multiple systems
375
375
00:16:51,390 --> 00:16:54,540
you can do that, now, right now I'm in session one
376
376
00:16:54,540 --> 00:16:57,780
and I'm at the command prompt on this IRC server.
377
377
00:16:57,780 --> 00:16:59,100
If I want to get out of that,
378
378
00:16:59,100 --> 00:17:02,610
I can press Control Z and this will send that session
379
379
00:17:02,610 --> 00:17:05,250
to the background when I hit yes,
380
380
00:17:05,250 --> 00:17:06,690
that allows me now to get back
381
381
00:17:06,690 --> 00:17:09,060
to my Metasploit framework prompt.
382
382
00:17:09,060 --> 00:17:10,920
Now I can go and set up a new exploit
383
383
00:17:10,920 --> 00:17:13,410
and a new payload and a new target and run that
384
384
00:17:13,410 --> 00:17:15,360
and that will become session two.
385
385
00:17:15,360 --> 00:17:18,270
If I want to see all the sessions that I have going on,
386
386
00:17:18,270 --> 00:17:20,190
I can do that by simply typing
387
387
00:17:20,190 --> 00:17:24,120
in sessions and then dash L to list them.
388
388
00:17:24,120 --> 00:17:26,910
You'll notice right now I only have one session
389
389
00:17:26,910 --> 00:17:28,080
because that's all I've done
390
390
00:17:28,080 --> 00:17:29,700
but I could be working here all day
391
391
00:17:29,700 --> 00:17:33,030
and have 5, 10, 15 sessions running at once.
392
392
00:17:33,030 --> 00:17:35,340
Now, if I wanted to use a different session,
393
393
00:17:35,340 --> 00:17:37,410
I would just type in sessions
394
394
00:17:37,410 --> 00:17:40,050
and the number that I want to use, for instance, session two
395
395
00:17:40,050 --> 00:17:43,200
or three or four, in my case, I only have one session
396
396
00:17:43,200 --> 00:17:44,850
so I'm just going to select session one
397
397
00:17:44,850 --> 00:17:47,280
and that brings me right back into session one.
398
398
00:17:47,280 --> 00:17:49,860
And again, I'm right back on that terminal.
399
399
00:17:49,860 --> 00:17:52,140
And if I do, who am I? I'm root.
400
400
00:17:52,140 --> 00:17:54,690
If I do LS, I'm in that directory.
401
401
00:17:54,690 --> 00:17:56,760
If I wanted to create a file or a directory
402
402
00:17:56,760 --> 00:17:59,010
I can do make directory test.
403
403
00:17:59,010 --> 00:18:02,880
And now if I do LS, you'll see there is this test directory
404
404
00:18:02,880 --> 00:18:04,354
that was just added by me,
405
405
00:18:04,354 --> 00:18:06,420
if I want to remove that directory,
406
406
00:18:06,420 --> 00:18:08,640
I can do remove directory tests.
407
407
00:18:08,640 --> 00:18:12,480
And now if I do LS, that test is no longer there.
408
408
00:18:12,480 --> 00:18:14,220
These are all the different things you can do
409
409
00:18:14,220 --> 00:18:16,580
just from a very high level when you start using
410
410
00:18:16,580 --> 00:18:19,860
Metasploit, Metasploit is a truly powerful tool
411
411
00:18:19,860 --> 00:18:22,770
and it's one that you really got to become comfortable with.
412
412
00:18:22,770 --> 00:18:25,650
Now, for the exam, you just need to know the basics.
413
413
00:18:25,650 --> 00:18:28,140
But for the real world, I definitely recommend
414
414
00:18:28,140 --> 00:18:30,930
you take an in-depth course on Metasploit
415
415
00:18:30,930 --> 00:18:33,180
or you spend some time with Metasploit,
416
416
00:18:33,180 --> 00:18:35,610
it's documentation and some vulnerable machines
417
417
00:18:35,610 --> 00:18:38,100
from VulnHub or Metasploitable 2
418
418
00:18:38,100 --> 00:18:40,710
and be able to start using this to conduct your attacks
419
419
00:18:40,710 --> 00:18:42,990
and practicing securing those vulnerable machines
420
420
00:18:42,990 --> 00:18:45,453
to simulate an analyst job in the real world.