In this lesson,
we're going to perform a basic penetration test.
Now, our goal in this lesson
is not to make you into a pen tester
or to teach you how to use any
or all of these tools in depth, but instead,
I just wanted to give you a quick introduction,
so you could see what kind of things
a penetration tester will be doing,
as they try to attack an enterprise network.
This includes going through reconnaissance,
using tools like Nmap to do port scanning,
as well as using a tool like Metasploit
to be able to launch and exploit
and gain access to a remote target.
So by the end of this video, we are going to find a target.
We're going to exploit that target,
and we're going to create some kind of action on that target,
such as deleting files, modifying files,
or touching files on that system.
It's important to realize that for the exam,
you will not be asked to perform
any of the actions you're about to watch,
but instead, I just want you to remember
what tool is used for what thing
and what kind of actions a penetration tester might do.
To perform most of the techniques
that we're going to do inside of this basic penetration test,
we are going to use Metasploit.
Now, Metasploit is a multipurpose computer security
and penetration testing framework
that contains a lot of great things inside of it
that allow us to be able to do our penetration tests,
everything from reconnaissance to exploitation
to post exploitation techniques.
Now, Metasploit does come installed by default,
if you're using Kali Linux or Parrot Linux,
which are both considered
penetration testing Linux distributions
because it is probably the number one tool
that most penetration testers are going to use.
All right, if you're ready,
let's jump into the environment and get started.
To launch it, simply type in MSF console
for Metasploit framework console, and hit enter.
When you do that,
the Metasploit framework is going to load up.
Now, it takes a couple of seconds for it to load,
and every time you load it,
you're going to get a different splash screen.
In this case, we have this big C looking thing
with a lot of words in it.
Every time you launch it, you're going to get a different one,
and usually, there's some kind of a joke
or pun inside of those.
More importantly though, you can see down at the bottom,
that I have Metasploit framework version 6.1.27,
and it tells me how many exploits, auxiliaries, posts,
payload, encoders, nops, and evasions there are.
Now, what are all of those things?
Well, let's talk about them.
First, we have exploits.
You can see here, there are almost 2200 different exploits.
An exploit is simply some piece of code or software
that can deliver a payload
and do some sort of an attack on a given target.
All these different exploits
go after different vulnerabilities
on different windows, Linux, mobile,
and other systems that you may encounter in the field.
The second category we have there is known as auxiliary.
Now, auxiliary, there is over 1100 of these
inside the Metasploit framework.
This includes scanners, sniffers, fuzzers, spoofers,
and other non-exploit features of this tool set.
For example, instead of using Nmap to do your port scanning,
you can actually use auxiliaries
that are set up inside of the Metasploit framework
to do that same type of work.
The next one we have is what's known as post,
and you can see there are 400 as of this version.
Now, a post is basically any additional task
that you may need to perform on a compromised host,
and post stands for post exploitation,
which means once you've broke into the box,
what are those things you need to do
to maintain persistence, cover your tracks,
and other things like that.
Next, you'll see we have payloads,
and we have almost 600 payloads in this version.
Essentially, payloads
are what exploits are going to deliver and then run.
When you run those payloads,
it gives you control over machine,
or it gives you elevated permissions,
or something like that.
Next, we have encoders,
and there's 45 encoders in this version.
Now, encoders are used
to ensure the payloads make it to their destination
in one piece and undetected.
You may encode things or encrypt things
to bypass different intrusion detection systems, firewalls,
router ACLs, and things like that.
We also have nops.
There are 10 different nops here.
Now, a nop is a non-operation.
Nops are used to keep the payload sizes consistent
across all the different exploit attempts
that you're going to do.
This is also useful as part of your evasion.
And finally, we have evasion.
This is a category that has nine different types
of evasion techniques, that again,
you can use as ways to try to get by or get through
some sort of defenses that somebody has set up against you.
Now, you'll notice,
once you go into the Metasploit framework,
you come up to the Metasploit prompt,
and here you can see it says MSF six,
telling me I am in version six of the Metasploit framework.
Now, when you go and use the Metasploit framework,
you need to tell it what tools you want to use.
So, everything is built up in a specific pattern.
They list it out by the module type,
saying if it's an exploit, auxiliary, post, payloads,
encoders, nops, or evasion,
then the platform that you're targeting,
Windows, Linux, Apple, et cetera,
then the target service SMB, FTP,
whatever that happens to be, and then the module name.
So to use one of these things,
you simply have to list out its name.
Now, that's easier said than done
because there are so many of these, right.
But I have one memorized that I use all the time,
and so I would just type in use
exploit/windows/smb/ms17_010_psexec.
Now, what does this say?
This says I want to use this exploit
that targets Windows systems over SMB
using the vulnerability associated
with Microsoft patch 010 in the year 2017.
And if you're not familiar with this,
this was known as EternalBlue,
which was a large vulnerability back in 2017
and made up the core of the ransomware known as WannaCry.
When you hit enter,
it's going to then load that module for you to use.
Notice my prompt has changed.
It now says MSF six, exploit, and then in parentheses,
what exploit I'm going to be using.
Now from here,
we would have to look at the different options
that are available for this particular exploit.
To do that, simply type in options.
When you type in options,
you'll see all the things in this table
that you have to have a setting for
in order to use this attack.
For instance, do you want to have the setting true or false
for debug trace?
And this shows extra debug information.
You'll notice this is a required field.
As you go through,
there's going to be different things you're going to use
based on this particular exploit,
and every exploit and every auxiliary and post and nop
is going to be set up differently.
But by using options,
you can always see what options need to be made.
In this case,
one of the things that's required that has not been set yet
is the RHOST, which is the target host you want to go after.
For example, if during my information gathering
and vulnerability scanning,
I identified that there is a workstation
with a certain IP address
that might be vulnerable to this attack
because it was missing this patch,
I could then use that as my RHOST.
And to do that, I'll just type in set,
the option I want to set, in this case RHOST,
and then the IP address of that machine,
let's say it was 192.168.1.2, and hit enter.
Now, you'll see that
it has set that RHOST to that IP address,
and if I type in my options again,
you will see now that everything that is required
has been filled in.
And this is the way you use these different tools
inside the Metasploit framework.
When you see things like RHOST,
that is the remote host or the IP you want to target,
RPORT, the remote port you want to target.
Things like LHOST and LPORT
are the local host and local port.
Notice, you'll see the payload options down at the bottom.
The payload options here
is what are we going to do once we run that exploit?
Just exploiting something doesn't do you any good,
you have to run some kind of code afterwards.
And in this case, we are setting up a reverse TCP shell
using the Meterpreter shell inside of Metasploit.
This will allow us to have a connection to that machine
and then do things on that machine that we want to do
as part of our post exploitation,
like doing more information gathering,
collecting files and doing data exfiltration,
changing settings, pivoting to other machines,
and all of those type of things.
Now, there's a lot to Metasploit,
and we're not going to cover all of it in this video
because that can be an entire course
of 20 to 40 hours on its own.
But what you need to understand
is that Metasploit is a very powerful framework,
and you should be able to understand the very basics
of setting up things like options
and then running those exploits.
If this option was already set up perfectly
and I'm ready to run the exploit,
to do that, I would simply type in the command run
and hit enter.
Now, in this particular case,
I'm not on a network where there is a vulnerable host
at 192.168.1.2, so if I try to run it,
it's going to end up failing
because it's not going to be able to talk
to that particular device
because it was unreachable, as you saw here.
Now let me go ahead
and show you how we use this in the real world.
To do this, I've gone ahead
and set up a vulnerable machine called Metasploitable two,
and you can download this from Rapid7 who created this.
This is a Linux distribution.
It is intentionally vulnerable
and has lots and lots of different problems with it,
and that is good for us to be able to practice on.
So what I want to do is
I want to get out of this particular exploit,
so I'm going to type in exit,
and you'll see that that took me out
of the entire Metasploit framework.
So now that I have a nice clear screen,
what we're going to do is
we are going to search on this network using Nmap
to try to identify
what is that particular vulnerable machine's IP address.
And I know that it's on
the same local area network as I'm in,
so I'm just going to type in IF config
to find out my IP address,
which is 172.16.218.128.
And so I'm going to use Nmap,
and I'm going to scan 172.16.218.1/24
because I'm not sure what the IP address is
of that vulnerable machine.
When I do this, Nmap is going to go out
and scan the entire network
of up to 254 hosts on this subnet.
Now, as it comes back,
you'll see that we found a couple of things.
Let me scroll up a little bit, so we can see what we have,
and you'll see that Nmap went and found two different hosts
that were reporting back ports.
The first one was located at 172.16.218.1,
and that is my router or gateway.
And you'll see that there is an Apple file server
and there is UPNP that is open on those particular ports.
Now the more important one
is the one that we see here at the bottom, 172.16.218.130.
This is my vulnerable machine,
and you'll notice
there are a lot of different things on this machine.
Notice that there are 23 open ports,
and these are things like FTP, SSH, Telnet, SMTP, domain,
HTTP, RCP bind, and many others.
Now, if we wanted to find out
more information about these particular ports,
we could do that by fingerprinting those ports
or using Nmap with a service scan
to figure out what they're running,
and that's exactly what I'm going to do.
So I'm going to use Nmap,
I'm going to target just the IP that I want to go after,
which is 172.16.218.130,
and I want to do that with a service scan of -sV.
If I go ahead and hit enter,
it's going to go run off and do that scan for me.
All right, now that the results are back,
we can look at those particular services
and see if there's anything that's vulnerable.
Now, this is where you'd normally do
your information gathering
and vulnerability assessment part of your engagement.
Now, I've already done this,
and I know that port 6667,
that is open for IRC using the UnrealIRC Daemon,
is a vulnerable version,
and so that's what I'm going to target
and show you how to use Metasploit
to go after and exploit the vulnerability
in that UnrealIRC Daemon.
To do this,
we again need to go back into the Metasploit console.
So we're going to go MSF console,
and when we get up into that screen again,
we are going to use the vulnerability
for the UnrealIRC Daemon.
Now the first thing I want to do
is search for that vulnerability
to see if there is any exploits associated with it.
So if I type in search IRC,
I can hit enter,
and all of the things that have IRC in it
are going to show up.
If you look down at line 18,
there is one for exploit/unix/IRC/unrealIRCD3281backdoor.
Now what this means is that this is an exploit
that targets UNIX systems, which is what Metasploitable is.
It targets the IRC port, which is what was open at 6667,
and it targets the UnrealIRC Daemon version 3281,
and there's a backdoor in that particular version.
And so that's what we want to use.
Now to use it,
I can type out the entire thing of
use exploit/unix/IRC/unrealIRCD3281backdoor,
or I can use it based on its number,
and in this case, it's number 18.
So I'll go ahead and hit 18,
and you'll notice, it is now the one listed as my exploit.
So we're going to go ahead and look at our options.
And for our options,
we only need to set two things, the RHOST and the RPORT.
Now we already know what the RHOST is.
In this case, we're going to set our RHOST
to 172.16.218.130
and hit enter.
Now the port is port 6667,
which is the port that was running on our server.
If it was running on a different port,
we would just type in set port
and the port we want to set it to.
Now I'm going to go ahead and hit options again
to make sure it took, and yes it did.
I can see my RHOST is now there.
Now that we have our RHOST and our port set up,
we are ready to run this exploit.
But if we do that now, nothing's really going to happen,
because we've set an exploit, but we haven't set a payload.
And a payload is necessary to say
what do you want to do once you exploit this server?
So I'm going to show you what that looks like,
just so you can see the error.
And if you hit run, it's going to go off,
it's going to try the exploit, but it fails.
Why did it fail?
Because a payload was not selected.
So as you can see, there was no payload,
so we have to be able to set a payload.
To do this, we're going to type in show payloads and hit enter,
and this will show us all of the compatible payloads
that are known to work with this particular exploit.
And here you can see there are 11 different payloads.
To keep things simple,
I'm going to use the first one,
which is payload/command/unix/bind_perl,
which is going to set up a bind shell on that remote server,
so that I can connect into it at any time I want
and take over the system.
To do this, we're going to use set payload, and then the name,
which is command/unix/bind_perl.
Notice, this is a little bit different
than when you're using an exploit.
When you use an exploit, you're going to say use, space,
and then everything after that
is all one big word with the slashes between it,
but with payloads, it's set payload, and then the command,
the system, and the payload you want to use.
Go ahead and hit enter there and then hit show options.
When you do this,
you're going to be able to see the configuration
for both the exploit and the payload.
For the exploit,
we're going to go and connect to that IRC server
at 172.16.218.130 over port 6667.
We're going to then send a payload that is a bind shell
that's going to bind on that IRC server
and open up a connection port at 4444.
This will allow me to connect to that remote host
anytime I want over port 4444
and be able to access this bind shell using Perl.
Now to run this, I'm simply going to type in run and hit enter.
You can now see
that we are connecting from our Kali machine
to that server over port 6667.
We set the backdoor command,
and we were able to start that bind TCP handler
on that remote server of 172.16.218.130
over port 4444.
And now I have a valid connection
that is called Command Shell Session One
that is open between my Kali machine, 172.16.218.128,
from port 46773,
over to the remote shell that I created
with that bind shell on port 4444 of that IRC server.
Now, you'll see that nothing really happened.
We're just sitting there,
and we are at basically a blank screen.
Why is that?
Well, because we're actually at a command prompt,
you just don't know it,
and so, if you want to see where you are,
you can use your Linux commands, like PWD,
to figure out what is the working directory you're in.
And I am right now in the /etc/Unreal directory.
If I wanted to see the files in there, I can type in ls,
and I get back the answers of donation, license, aliases,
and all the other things that are in that directory.
If I want to figure out what type of permissions I have,
I can do, who am I?
And when I do, who am I?
I am root.
I was able to get into this box using root access
by running this particular exploit,
and that's the way these things work at a very basic level
to set up an exploit, set up a payload,
and then run an attack.
Now, the last thing I want to show you
is this concept of sessions.
Notice here it said
the Command Shell Session One was opened.
That means there might be other sessions too.
What this is is that Metasploit
allows you to run multiple sessions,
so you can do multiple different attacks,
or if you need to chain exploits across multiple systems,
you can do that.
Now, right now I'm in session one,
and I'm at the command prompt on this IRC server.
If I want to get out of that, I can press Ctrl Z,
and this will send that session to the background.
When I hit yes,
that allows me now to get back
to my Metasploit framework prompt.
Now, I can go and set up a new exploit
and a new payload and a new target and run that,
and that will become session two.
If I want to see all the sessions that I have going on,
I can do that by simply typing in
sessions and then -L to list them.
You'll notice right now I only have one session,
because that's all I've done,
but I could be working here all day
and have 5, 10, 15 sessions running at once.
Now, if I wanted to use a different session,
I would just type in sessions
and the number that I want to use,
for instance, session two or three or four.
In my case, I only have one session,
so I'm just going to select session one.
And that brings me right back into session one,
and again, I'm right back on that terminal.
And if I do, who am I?
I am root.
If I do ls, I'm in that directory.
If I wanted to create a file or a directory,
I can do make directory test.
And now if I do ls,
you'll see there is this test directory
that was just added by me.
If I wanted to remove that directory,
I can do remove directory test,
and now if I do ls, that test is no longer there.
These are all the different things you can do,
just from a very high level,
when you start using Metasploit.
Metasploit is a truly powerful tool,
and it's one that, as a pen tester,
you really got to become comfortable with.
I definitely recommend
you take an in-depth course on Metasploit,
or you spend some time with Metasploit, its documentation,
and some vulnerable machines
from VulnHub or Metasploitable Two
and be able to start using this to conduct your attacks
and be able to get better
at doing pen testing in the real world.