[MUSIC PLAYING]
In this lab, we're going to put what we've learned
into a little bit of practice.
We're going to find a service and check
for our vulnerability.
And then from there, we're going to actually try exploiting it
based on what we find.
So let's jump into our environment and give it a look.
Ran an Nmap scan with service enumeration on our target IP.
And what we came across--
start at the top.
First port-- port 80/tcp.
It's plain old HTTP, and it's running on BadBlue 2.7.
The rest of this looks to be Windows,
and it says it's a Windows Server 2008 R2 to 2012.
And that's probably fairly accurate.
We could get into that more if we want,
but let's find out about this BadBlue.
Going to the IP address, looks like it automatically
loaded some information for us.
But this is a BadBlue.
Looks to be a file server.
And you can upload files.
Or there's this query area right here.
All right, this looks like it could be something.
What do we do if we want to research something?
Well it's 2022 now, so we go to Google.
Looking at BadBlue 2.7 for CVEs, we
can come across the missed page for it.
And there we are, CVE-2007-6377 details.
And it looks like there is a stack-based buffer overflow
in the PassThru functionality in ext.dll and BadBlue 2.72b
and earlier.
Allows remote attackers to execute arbitrary code
via a long query string.
Now, some of that might not make a ton of sense
to you right now, being that this is a junior penetration
test course, but what we do understand
there is we can run arbitrary code in old versions
of the software, software that we are currently
running on our target machine.
Well, that seems neat.
Anything else in here that we need to know about?
We could get into the AltaVista Advisory,
and that's just the exploit.
Get into the actual advisory.
And that is an old page.
Looks like this information is so old,
we're not going to get anything great in here.
Any extra in the analysis description?
No.
Basically, old versions of BadBlue 2.7 and earlier
have this problem.
There might be new versions of BadBlue,
or there might be other ways of serving up these files,
but in order to fully understand this,
let's go investigate a little further.
Might have seen I clicked over, and that took us to an exploit.
It might not have made a lot of sense.
Here is exploit-db with an exploit for it.
And let's navigate there ourselves.
This is exploit-db, exploit database,
and it's managed by our friends at Offensive Security.
But anyone can upload their proof of concepts,
their exploits here, and the community can then utilize them
after they've been verified or at least submitted
into the database.
How it works-- we have a search bar over here.
There's some functionality over here.
There's papers, which are helpful, shellcode,
which is great.
What I'm going to do is just start with what we know,
BadBlue.
And it will update as we go.
Ooh, looks like they're even older versions.
2.7 because that's what our machine says, is 2.7.
Looks to be a denial of service.
OK, that's not going to help us, but it's good to note.
It's also for 1.2.7.
Same with this full path disclosure.
It's 1.2.7, so probably not super helpful.
2.7.2, PassThru Buffer Overflow.
This one's for Metasploit here is a non Metasploit let's
jump into that one and see if there is notes in the code.
So your submissions to ExploitDB look like this.
Each has an ID, the CVE that it's related to,
the author for attribution.
See what else they've made.
What type of code is it?
It's remote in this case.
What platform does it apply to?
And then you can download the Vulnerable app,
if you really want.
You can get the code, see it raw.
This is the code.
[? Straight. ?] And this one is a Perl script.
If you don't know Perl, that's fine.
I don't know Perl either, but it's written in English,
and if you've seen one scripting language,
you've probably seen them all.
Let's just try to make a little bit of sense out of it.
Usually, things start with a pound sign, hashtag, are just
comments.
We've got an if statement.
It looks to see if it has arguments past.
It's going to say, hey, this is the usage, which is nice.
It tells you how to use it.
If you just type the exploit, I guess, or Perl and this file,
and you don't give an extra argument, then it tells you,
hey, you need to have a victim and a port.
OK, that makes sense.
Probably our victim IP number, n port 80 in our case.
There's this Metasploit Win32 bind,
and, OK, looks like they used an LPORT of 4444,
size of 709, this PaxAlphaNum encoder, and the exit function
is SEH.
To create this shellcode, this is in hexadecimal.
We'll get into hexadecimal and a lot more of the scripting
in a later course.
But we're just trying to see what's here.
OK, it said we needed a victim.
This looks to be a variable with that dollar sign
out in front, Java, and Perl, I guess.
Both use that dollar sign.
And it connects a socket over INET,
so it's just going to connect to that IP address.
Over TCP, utilizing our arguments.
And some other stuff--
OK, neat.
Looks to be some extra code.
OK, some more functionality.
With these buffer overflows, again, later courses
will make a lot more sense here, what they're doing in memory.
But basically, utilizing overflowing memory in order
to run our own code.
So what they do here is they overflow,
then they jump around in memory until they find a place where
they can run code.
And then they run the shellcode that's there, upload it
on top of the rest of this.
And it all gets passed via a GET request.
With that, OK, forward slash exit--
ext.dll, and then send commands.
Wait a second.
We had-- [INAUDIBLE] here.
All right, forward slash ext.dll question mark mfc, OK, command.
And it tells it to do stuff.
So the command is going to be PassThru&,
and then it's going to pass the rest of this stuff.
OK.
Neat.
We could go through and figure out how to use this manually,
or there was a Metasploit one.
We've got a whole course on Metasploit.
Alexi took you through how Metasploit works, why it works,
lots of great stuff.
There's an exploit for it.
So we could find this module and run it.
While we're here, let's read about it and see what it means,
see what it does.
Metasploit modules are written in Ruby.
I don't know Ruby either, as in I couldn't write Ruby.
If you asked me to make this, I could figure it out eventually.
But, again, it's in English, so let's see
if there's some things that make sense to us.
We've got classes, OK.
There's just a Metasploit exploit for remote.
Great ranking-- that probably means it works really well.
Note BadBlue doesn't give any HTTP headers when requesting.
That's good to know.
However, a proper server header is
returned when requesting index.html or using HEAD.
Neat, OK.
What it's going to pass us-- this module exploits stack
buffer overflow in 2.72b and earlier.
That's good to know.
Same CVE that we've seen before, and that same ID.
OK, we have some bad characters.
Neat.
We'll get into that, again, later course.
Excited to talk about it, but not going to do it here.
And then the exploit does some stuff.
It offsets a lot of what we saw in that Perl.
This stuff doesn't make a ton of sense
unless it's been explained.
How is it passing it?
OK, it's got a URI.
Forward slash ext.dll?mfcisapicommand
PassThru&.
OK, gotcha.
So it's going to do that and all those things.
Let's go play with it.
There we go.
Lit up some MSF console.
Search for BadBlue 2.7.
And there it is.
Use 29.
Yep, targets BadBlue and 2.72.
Anything else in here?
Same exploit we just saw.
And we can set up proxy chains.
Don't need to.
We need an RHOST.
We need an RPORT.
Don't need SSL because HTTP.
And-- doo, doo, doo--
we need to set a payload.
So windows x64.
Nope.
Meterpreter reverse_tcp.
Sorry, Metasploit's smarter than I am.
Set rhosts and stuff that copied.
I don't.
Linux is neat when you do the stuff.
Set lhost.
And eth1.
That LPORT works.
Everything with a yes has a yes.
Let's run it.
OK, so it's sending.
It's trying out the target.
Sends a stage.
Opens a meterpreter session, and we are in the machine.
Hey, we are on that Windows 2012 R2
and in a 32-bit meterpreter shell.
Oh, no, shows 64.
From there, we can do a lot.
And Alexi goes into details in what
you can do with Metasploit.
I was never-- auditing-- we will get into what else
we can find on this machine.
It's a Windows machine.
There's a bunch of-- baked into it
that we can take advantage of.
And from there, we'll see what else we can find.
But we found a vulnerability.
We found out that we could exploit it.
Found a nice way of running that.
Now, if you know Perl, if you could
run the get request yourself, if you knew Python or Ruby,
you could set this up yourself.
I didn't want to get into all that.
We had a Metasploit module.
Take advantage of that Metasploit module.
And it works.
So however you want to skin the cat, we found a vulnerability.
We found out that this machine is exploitable.
And we can now go into more, enumerate,
finish out the rest of our pen test.
This is something that we can include in our report.
You had a server running this software that is vulnerable.
Now, there's other versions of software.
There's other ways of serving up those files.
There's other options.
And this might be internal.
It might be-- it should probably be firewalled.
It might be firewalled.
But if it's HTTP, then anything going across the wire,
if there is a man in the middle, they
could read and pull out any objects from those packets.
There's just a lot in there that is worth
noting and worth bringing up to your client,
and a lot of remediation possibilities.
Now, then, they could decide, OK, that's fine.
This is internal.
We have it firewalled.
Maybe that server is firewalled, so only internal machines
can get to it.
And since we were VPNed in, we have access.
I don't know.
But you bring it up, you identify it, you highlight it,
and then it's up to your client to decide how they want
to mitigate or remediate it.
All we do is find and report.
All right.
With that, we're going to close out this one
and move on to the next course.