Instructor: Now that we understand the concept
of pivoting, it's really not that difficult to perform.
All we need to do is we can upload any tool we need to use,
for example, if you wanted to use Nmap
or ARP spoof or dSniff,
you can upload any of these tools,
run them on this computer,
which is connected to this big network,
and then you can run a port scanner on this,
you can do ARP poisoning,
and do man-in-the-middle attacks like we learned before.
So it's very simple.
All you have to do is use the upload command,
upload it here and use it from the command line,
like we were using it anyway in the previous videos.
What I'm gonna show you today
is how to set up a route
between the hacked computer and your computer
so that you can use any Metasploit auxiliary
or module against this big network.
So we'll be able to use Metasploit exploits,
we'll be able to use port scanners
that come in with Metasploit
and other useful modules.
To do that, we're gong to use a module called autoroute.
Let me show you first how if I try to run an exploit
on the target computer, on the Metasploitable computer,
it's not gonna work because it's not visible to me.
So I'm gonna do a sessions list
and you'll see that I already have a connection
with the Windows computer here.
So I've already hacked it.
And I'm going to use exploit/multi/samba
and usermap_script.
Now, we already used this exploit
against the Metasploitable before
but it was on the same network,
so it was visible to us.
What we're doing now is trying
to attack a device that is not visible to us.
And then I'm gonna do show options.
I'm gonna set my RHOST to 10.20.15.4
because that's the IP of the Metasploitable device.
Then I'm gonna do show payloads.
And I'm going to use this payload right here.
So I'm gonna do set PAYLOAD to this.
Show options.
Everything's set up properly,
so I'm gonna do exploit.
And you'll see that this exploit will time out
because if we go back to the diagram here,
this device cannot see this device.
So it's trying to run an exploit on this device,
even though this device has that vulnerability
but I won't be able to use it
because I can't see that device.
And as you can see now,
the exploit failed, connection timeout.
We just couldn't connect to the target computer.
So what I'm going to do now,
I'm gonna interact with my Meterpreter on ID one.
So sessions -i 1.
So I'm in my Meterpreter.
I'm gonna run ifconfig first
to see what my network look like
or the networks that the target computer is connected to.
So we can see all the interfaces connected
to the target computer.
And I'm gonna look for interfaces with IP addresses.
So we have this interface number four has an IP address.
And we can see that this IP address
is on our network.
So it's really not very useful.
It's already on our network.
We're on the 10.20.14 anyway, on that subnet.
So this one is not very useful for me.
Another one that I can see
is this one, which is connected to 10.20.15.5.
So it's on a different subnet right here,
which I cannot see from my Kali Linux device.
So I'm going to try to set up a route
between this subnet and my current subnet.
So I'm gonna copy this.
And then I'm going to background my current session,
so I'm back into Metasploit
and I'll clear this.
Then I'm going to use post/manage.
Now, by the way, at any stage of this,
if you wanted to see all of the manage modules,
for example, you can just leave it at this
and double tap
and you'll see all the manage modules
and you can try and use them and experiment with them.
So our one that we want to use is autoroute.
And I'm gonna do show options
to see the options that I can set.
And we have two options that we need to set.
We need to set the session that we have
and the subnet.
So I'm gonna set the session first.
And it's session number one.
And then I'm gonna set the subnet
to what we've seen when we did the ifconfig command.
It was 10.20.15 and I'm gonna put a zero to it.
So again, we're using the set,
very simple commands we already learned.
We're setting the session to number one.
That's the session that we hacked for the Windows.
And the subnet is the subnet,
which the Windows is connected to
and we don't have access to.
So it's the 10.20.15.0.
And I'm gonna do exploit.
And this will create the connection
or the route between my device and the Windows device.
So what I'm going to do now,
I'm gonna go back to the same exploit
that I tried at the start of the video
and you'll see that the exploit is going to work
because the Windows device is visible to me now.
So instead of using the exploit,
you can use, as I said, port scanners
or discovery models
that come in with Metasploit
or any other module that come with Metasploit
because my device can now see the target computer.
It can see this Metasploitable device
because it was not visible for me at the start
but now I have a connection to this computer
and I set up a route
between this network and my computer
so I can actually see the Metasploitable device now.
So I'm going to use the same exploit I used before.
And it was exploit/multi/samba/usermap_script.
Just clear that.
Now, I'm gonna show the options
and I'm gonna leave them the same
because everything is actually set up correctly.
So I'm just gonna do exploit.
And as you can see, now command shell was started properly
and I actually have access to the Metasploitable device now,
so I can do id and I'm root.
I can do a uname -a to just confirm that for you.
And we can see that we're in the Metasploitable device
and I can run any Linux command that I want.
So I can do ls, pwd and I should be in the root.
And I can do cd, go to var, for example.
And do any Linux command that I want.
So I basically have full access to the target computer.
Now again, as I said, you could upload stuff
and run them from the target computer
but it's not always a good idea to upload things
to a hacked computer.
So setting up the routes like this
and using pivoting is a much safer choice.
And I highly recommend that you go
and have a look on other Metasploitable modules
because Metasploit is really, really big.
It's hard for me to cover everything.
I just covered the main basic stuff
but you can always just go in
and have a look on other modules and try them.
Using the modules is usually the same.
We had a look on a broad array of modules.
So it should be asy to just configure options
and run these modules the way you want.