Hi, and welcome back to a deep dive
into Network. Assessments by easy console. This
is section for advanced network
security techniques. In this way.
You will be covering using components with
known security vulnerabilities. So
that's the iPhone 10.
So we're here without calling ice machine on.
Let's get started by scanning all next week
so we can open up to him now. And I
just want a little bigger like so we
can type. I p a d d
r to verify our network, interfaces. Sorry,
connected to Internet
0. On the one. I to 16506
Warner to networks.
I want to copy this IP address like Sue and
I play and type and map
and let's do - P report.
That's due e. T a
z o e, t t and even 443
support. A 1080ti is
40 texting h. U d p. +
443 is https.
So I'm going to change this
loss of their 2-0, too. Dear for
and my business. Can my entire network and
look for any systems with these 3421, or
any of these reports of an answer on
the results. Should not take too long to populate.
And are you? So currently we have two systems,
there is a want to system but this
boss actually closed forever. There's a
one-on-one. So what we can do, we
can simply copy this IP address, then we
can open a web browser. And what
a cool thing to do is simply visit actual application
threats to http.
Colon slash slash followed by
the IP address on the tendo. So this is
all metasploitable to Virtual Machine within the
smallest portable to Virtual Machine. There's a
lot of vulnerable web applications. So let's
click on d, v w e
Once upon the login page, lets you see you soon. A
Madman our password is password and
all the work is like so so you can
simply choose to save the password or not. That's totally up
to you. But let's take a look at exploiting summon
call file upload vulnerabilities.
So why do things off you want to look for is
where we could upload? A malicious file. Once
you upload a malicious file, we
can simply call the file as a
user and Gainey River shell on this
target to operating system is running this
way of obligation to get started.
Let's click on upload and you can see
Tia's on upload menu, so I can upload any
file. I should be stored on the server. However, I
create a malicious pillow, Donald
Kali Linux machine, football, to
mow. The first things you want to
do is less double-check, or IP address West. To
IP EDT are once more like, so, and this
is how IP address. So we will
need us IP address to help create LP load. So, now
we have IP address, that's like where
I am. Now, let's use it to
Nora's msfvenom to generate.
Custom payload can be
a massive Dunham. Has a name of the two likes. O
P & P
lewd is. Let's a peach who create
a meta portal, review, show.
Piala's a specified. A
Prelude on this. Entire thing is, the name of
the people who actually die. Reverse on. This quote is
CP, Ellis will allow Security review shell on,
will need to specify. I will look up what to
do, Local, Host equal and
let's keep it simple. Let's do 4, 4, 4 4,
And we also need to specify our local.
Oops. See who's Sue or
IP supposed to go there.
All right. Now in to specify Oil, Portage is
all look up or to listen on. I will use four,
four, four, four likes who will do.
Have to specify format. Create a
roll form up to Lucinda, generate the
peach we could force slots at
Endor and this will generate a malicious
pill with us, but it will give
us a quarter.
I forgot to send Oxford Al both, swipe over the
equal sign music set up once more.
Foxface equal. And now his answer.
And it should work fine.
And there you go. So what we need to copy it. Some
right here. I'm going to copy this entire thing.
So we going to copy this next. Let's
open our text editor. Let's see
we should have most part right
here. It's like one more spot. Let's right.
Click, click on
file, a null. Let's
save our files and let's see
downloads on let's put
in them. So that's but I am G2 Peach be.
So this will be a piece of beef. I'll just fix
it.
All right. So now we have
a malicious payload save in a format of
a PHP file.
Next, let's start Metasploit on
will use models Floyd to create
a listener. But before we do, so, let's copy the
name of all. Lightest. Let's open
a new tab. So we'll do pseudo msf
console and hit.
Enter, enter password for Kali
Linux machine at enter.
And this will start all Metasploit
rework.
The starting multi Handler, let's use
to use exploit
multi. Like
so once you set them all on
low, it automatically chooses a jerk. But
you don't want to use that. So that's two set.
Like, so I see, five New Hope
Road, which is peach Pima to Pretoria Vista CT options
to see
what options are needed to be set to currently o
l. Port is all, Ready, Set, Sew less
actually said the most tell, who's, who
beset L whose lightest and
you specify IP address. So let's
grab OIP from here.
Copy, can I
please? Listen by. So let's i
options. Once more to ensure that everything is
that perfectly?
Sonora be configured.
Our listener. Let's type exploit to
start all this more. So all
this nice listening on this IP address on this phone. Let's
have a back to all of vulnerable without the
heat. Let's click on browse
slacker IMG, 33 file
upload. Take
a look at it. Give us
a URL. We can use executor. With
no app loaded. Actually. Let's copy just
this portion of the address.
Thoughts come across here. And let's
edit ourl. So
Foxface this in a
piece is in on it, answer.
So what's happening now is we actually
calling this file? So once we
call this file, it will be executed. Now, how
do we know whether it's successful? And let's
check Metasploit. And look
at, is it started a
reverse Harem love with you already knew it sent a
speech. Which is from Metasploit to
all victim, High School procession. Now,
we have enmity portal session. We
can see all the
commands on Old actions. We can perform on the
socket. So for example, we could
kill various tasks. We could run suit and
scripts. We could even Lord Varys,
matter protest sessions, we could
check for any command so
we could type cop that we could download. We could
even upload scripts, we could
even perform port forwarding and so on.
And this video we took a look at discovering, our
exploitation of vulnerable web application. In
the next video. We will take a look at exploring Apache,
web server on performing curling.
I hope this video has her
phone with her for you. I'll see you in the next one.