-: So, now we're going to discuss the first vulnerability 2 2
we're going to exploit, 3 3
and that's the Microsoft 08-067 Vulnerability. 4 4
This was also known as the Netapi Vulnerability. 5 5
Now, everyone tends to use this 6 6
in ethical hacking as the first hack, 7 7
and the reason why is it's a fairly easy hack. 8 8
It works really well, 9 9
and it works pretty much every single time. 10 10
We're gonna go through this one first and get our feet wet. 11 11
Where does this attack fall in? 12 12
Well, we're gonna gain access using this attack 13 13
and this attack actually gets us a system level user. 14 14
So, we're actually gonna have an escalation of privilege 15 15
at the same time. 16 16
We're gonna be in both phase three 17 17
and phase four simultaneously as we begin this attack. 18 18
So, MS08-067, what does that really mean? 19 19
Well, MS08-067 is the vulnerability number 20 20
that Microsoft assigned 21 21
to this particular bug in their code. 22 22
It is the Microsoft Server Service 23 23
Relative Path Stack Corruption. 24 24
Now, this vulnerability allows for remote exploitation 25 25
of a Windows 2000, 2003, or XP system. 26 26
Once we got into Windows 7 and above, 27 27
they have started fixing this vulnerability 28 28
and taking it out. 29 29
Sometimes, you'll find that it works on Windows 7, 30 30
sometimes it doesn't. 31 31
It depends if the person is actually patched for it. 32 32
But it works almost all the time 33 33
on Windows 2000, XP, or 2003 34 34
if they're using file sharing services 35 35
on one of those machines. 36 36
What are the requirements for Microsoft 08-067 to work? 37 37
Well, you have to have a vulnerable service. 38 38
In this case, the Server Service is on Port 445. 39 39
That's why I said, you have to have file sharing enabled 40 40
for this to work. 41 41
We set up our lab before for our Windows XP vulnerable box, 42 42
we went and enabled printer and file sharing. 43 43
That is so this vulnerability will work 44 44
and we can attack it. 45 45
This requires that the Windows Firewall is either disabled 46 46
or file and print sharing is enabled. 47 47
What we did is we left the firewall on, 48 48
but we opened up the port for file and print sharing. 49 49
Is the machine still vulnerable? 50 50
Microsoft released a patch back in October 2008. 51 51
Microsoft Windows XP Service Pack 3 52 52
was released in May of 2008, 53 53
so this was before the patch was released. 54 54
If you have a brand new Windows Service Pack 3 system 55 55
like the one we made, it's still vulnerable. 56 56
Again, even though there's a patch available, 57 57
not everyone puts those patches out. 58 58
The hotfix Knowledge Base article is KB958644. 59 59
If you want to learn more about this vulnerability, 60 60
you can go in there and read all about it, 61 61
where Microsoft gives you the technical details. 62 62
Because they've given us those technical details, 63 63
the attackers have been able to reverse engineer it 64 64
and now we have this exploit available. 65 65
In Metasploit, in the Metasploit framework, 66 66
we have to have an exploit to be able to go against 67 67
that particular vulnerability. 68 68
The nice thing is, with Metasploit they tend to keep 69 69
the same naming scheme as Microsoft 70 70
to make it easy for us to find. 71 71
We talked about the fact that Microsoft 72 72
called it the MS08-067 vulnerability. 73 73
Well, Metasploit calls is the ms08_067_netapi exploit. 74 74
So when we search for that, 75 75
we'll be able to find it there. 76 76
What this module is gonna do is it's actually gonna exploit 77 77
a parcing flaw in the canonicalization code path 78 78
of the NetAPI 32 dll through the Server Service. 79 79
If the process reaches a state where the next instruction 80 80
to execute is in the stack, 81 81
the exception is raised. 82 82
If it's not handled properly, 83 83
then the process is gonna be terminated. 84 84
So the developers of the exploit 85 85
have actually taken the vulnerability, 86 86
reverse engineered it, 87 87
so they now have an exploit that works. 88 88
When the flaw is introduced, 89 89
instead of terminating, it's gonna actually go 90 90
and run the payload that we desire, 91 91
which in our case is gonna be a reverse shell. 92 92
So whenever you're setting up Metasploit, 93 93
you have to set up two main things 94 94
and that's your exploit and your payload. 95 95
It's how are you gonna break into that vulnerability, 96 96
and what are you gonna do once you've broke in? 97 97
In our case, you'll see here that we search 98 98
for the exploit, ms08_067_netapi. 99 99
We use that exploit. 100 100
We then are gonna set a payload, 101 101
which is what we're gonna do once the exploit is thrown. 102 102
In our case, we're gonna use 103 103
the Windows/Meterpreter/reverse_tcp. 104 104
And then I showed you the options. 105 105
From here you'll see that we need to set a remote host. 106 106
That's gonna be who we're gonna attack. 107 107
We need to set a local host. 108 108
That's ourself, our IP, 109 109
so we know who that remote host is gonna call back to. 110 110
You'll see here, our exploit and our payload 111 111
are shown here on the screen. 112 112
So if I run this exploit, 113 113
what are the forensic examiners gonna be able to see? 114 114
Here, I pulled up the log files, 115 115
the application, system, and security log files. 116 116
Notice that before the attack, 117 117
the numbers have not changed from before to after. 118 118
Again, that's because we're using 119 119
the Meterpreter reverse shell 120 120
and Meterpreter runs exclusively from memory. 121 121
It doesn't actually even get logged in the system. 122 122
It's not in the applications, it's not in the system, 123 123
and it's not in the security. 124 124
As you can see, there's very little trace 125 125
of our efforts here. 126 126
Now, once we've broke in, depending on what we do, 127 127
that can change the number of records 128 128
because we might trip on things that launch applications 129 129
that we actually hit the security trip points 130 130
or that we actually affect the system 131 131
but just running the exploit itself 132 132
has no effect on our log files, 133 133
making it a very quiet exploit for us to use. 134 134
And so now that we've walked through this 135 135
and you see that we're gonna be able to gain our access 136 136
and our escalation of privileges, 137 137
we're gonna walk through it interactively 138 138
as I go through the attack in a lab environment.