[MUSIC PLAYING]
Exploiting WebDAV with Metasploit.
In the previous video, we explored the process
of how we can authenticate to a WebDAV server,
and upload a web shell in order to perform,
or in order to execute system commands on the target,
and of course, that process was multifaceted.
It involved performing a brute force in order
to identify the WebDAV credentials, after which we can
utilize, or we utilize those credentials
to authenticate to the WebDAV server
and utilize Cadaver to upload the web shell onto the dev test
server.
Right?
Now we can also utilize the Metasploit framework in order
to exploit WebDAV, and of course, that
can be done through a plethora of ways,
and we'll be exploring two techniques that can be used
to essentially achieve this.
Now we don't really have any other slides to go through.
As I said, we're going to be utilizing a very similar lab
environment to the previous video, with a few small changes
and you'll actually see them in play.
All right.
So start up the lab environment, and I'll also
get my instance started up, and we
can get started with the practical demonstration.
So I'll see you back in the lab environment.
All right.
So I'm back within the lab environment
and you will be provided with the target IP
address, and of course, in your case,
it's going to be different.
Right?
Now as I said, this lab environment
is very similar to the previous video,
and we have a Windows target that's
running Microsoft IS that has WebDAV configured to run,
and the WebDAV credentials are also the same.
So the username is Bob, and the password is password_123321.
The only difference with this particular lab environment
is that the target, more specifically, the WebDAV server
has been configured to execute specific types of ASP payloads,
or ASP files.
In the previous video, we were able to execute ASP files
or ASP payloads.
The only difference was if we try
to utilize an ASP payload that would provide us
with a meterpreter session, that particular web
server or Microsoft IS server would not--
will essentially would not be able to essentially execute
that particular file primarily because of its functionality,
right?
In this case, we are able to do that
and of course, we'll go through the same process.
We can start off by performing an Nmap scan on the target,
just to confirm you know that IS is indeed running,
and WebDAV is configured to run.
So we will say Nmap, and we can say SV,
and we can run this on port 80.
Right?
And we can also use the script, HTTP enum.
So HTTP enum, and I'll paste in the target IP there.
And we'll give this a couple of seconds to complete.
All right.
The Nmap scan is complete.
And as you can see, we have WebDAV running,
and it actually requires credentials or authentication.
So if I open up my Firefox browser here
and I paste in the target IP, and try and access the WebDAV
directory, you will see that the credentials are
pretty much the same as we had in the previous environment,
or in the previous lab environment.
So I can say Bob, password_123321 hit Enter.
And we're successfully been able to authenticate.
Right?
So let's get started with how we can obtain a meterpreter
session, or really, a reverse shell on the target system
with Metasploit.
The first technique will involve generating the ASP payload
ourselves, with MSFvenom.
Now if you want to learn more about Metasploit,
or the Metasploit framework, you can check out my Metasploit
framework course on INE.
It's an extremely comprehensive course
that will make you proficient at using the Metasploit framework.
So again, in this case, I'll also explain as I move along.
All right so MSFvenom is a tool, Metasploit tool
that allows you to generate a payload that will essentially
provide you with reverse shell access or remote access
to a target system.
And in this case, we're going to obtain a meterpreter session,
which is really just an advanced reverse shell that
allows us to perform additional functionality like upload
files, download files from the target, et cetera, et cetera.
So in order to generate the ASP payload,
we're going to say MSFvenom, and we can then say Payload.
We will then be using a Windows meterpreter payload,
and this is a staged payload.
So we'll say meterpreter Reverse TCP.
We then need to provide our IP address,
and this is the [INAUDIBLE] next IP address.
So I'm just going to open up a new tab here.
And I'm going to type in ifconfig,
and my IP address is on the interface ethernet 1.
There's my IP there, and that is what
I'm going to set here because this
is the IP that the payload is going to connect
to when it's executed, right?
The L Port is the port that this particular payload
is going to connect to.
So this has to be a port that's currently open on your system.
In this case, I'll just use port 1234
for the sake of simplicity.
We then need to specify the file format, which in this case
is going to be ASP, and we can output that
into the actual payload, or the payload name.
And in this case, we will call this meterpreter.asp
or we can simply just call it shell.asp.
We'll give this a couple of seconds to generate.
All right.
So that is generated successfully.
It will select the architecture as 32-bit.
It is always recommended to use the 32-bit meterpreter payload
here, primarily because if you're not familiar
or if you're not sure what architecture
they operate the target operating system is, 32-bit
will work either way irregardless
of whether the system is 32-bit or 64-bit.
All right?
So that is generated and it's stored
within our home directory.
So there it is, shell.asp.
So we can now utilize Cadaver, and I'm just going
to copy the IP address here.
That is the target IP.
So I'm going to say Cadaver, as we did previously.
Cadaver, and we are going to say HTTP--
specify the target IP and the folder, which in this case
is WebDAV, hit Enter, the username is Bob,
and the password is password_123321.
All right.
So there we are.
We get the actual DAV pseudo shell,
and we can list out the files here.
And we have the same files that we
had when we explored this folder through our browser.
So we can upload the shell that we created by saying Put,
and the directory where it stored
is under root, and shell.asp and we hit Enter.
All right, so that has been uploaded successfully.
And of course, we can confirm that
by refreshing the actual directory listing of the WebDAV
directory through our browser, and you
can see we have shell.asp.
Right.
So we the next step would be to click on it,
and that will essentially execute it.
But before we actually execute it,
we need to set up a listener or a handler that
will receive the reverse connection
from the actual target system, and then
send the stage that will then provide us with an meterpreter
session when executed.
In order to do this, we will need to start up a Metasploit
framework console session, and in order to do this,
I'm just going to start the PostgreSQL Database
Service because Metasploit, the Metasploit framework console
requires the actual Metasploit framework database
to be started.
So I'll say Service PostgreSQL Start,
and I'll just say MSF console.
Right?
So MSF console, there we go.
We'll give this a couple of seconds to start up.
All right.
So in order to set up our handler,
we can say use multi handler.
This is a Metasploit module that essentially
is used to set up a listener for the malicious payload
that you have created.
In this case, we utilized the payload
or the payload that we use to generate our malicious ASP file
was--
so in order to set, it will say set payload
and it was Windows meterpreter reverse TCP.
And of course, this has to be the same payload
that you had specified when generating the actual ASP file.
So remember, when we were generating it here,
with MSFvenom, makes sure that the payload you specify
is the same one used to generate the ASP file, right?
And then of course, we need to set up the L host option as
well as the L port option.
So I'll just go back in there and we'll hit Enter.
We can then show the options here,
and the options we need to specify is the L host option.
This is just going to be our IP address.
So L host, paste that in there, and then
we specify the L port as 1234.
Remember, they have to be the same options
you used when you were generating your malicious ASP
payload with MSFvenom.
And we can then hit Run.
That is going to start up the listener, or rather
the reverse TCP handler, and it's now
going to wait for a connection from the actual ASP payload
that we generated.
So whenever it's executed on the target,
it will connect back to this particular reverse TCP handler.
So in order to execute it, we can
head over into the WebDAV directory,
and click on shell.asp.
You can see it's being executed, and if we go back
to our terminal, you can see it's going to say sending stage
and then tell us, meterpreter session one opened,
and we have successfully gained access to the target system.
All right?
So we can confirm this by saying Sysinfo.
And you can see that the system is a Windows 2016, or Windows
Server 2016 system.
It's a 64-bit system and currently,
we have two logged on users and we
can get our current privileges by typing in get user ID.
And we currently have elevated privileges,
as our privileges or anti-authority system.
So in the case of this particular system,
we do not need to elevate our privileges.
But again, this is set up for demonstration.
All right?
So this is one of the techniques that you can utilize.
You can go through the process of generating
your payload manually, and then uploading it using Cadaver.
There is another technique that you can utilize.
And again, this technique will essentially
involve utilizing a Metasploit framework module,
and this module essentially allows
us to automate this entire process.
So what I'll do is I'll exit.
And that will kill that particular meterpreter session
and we can confirm that that is the case by listing out
all sessions.
The name of the module is IIS Upload,
and that will essentially give us a list of payloads,
or modules for that matter, the one we're
looking for is this one right via exploit Windows IIS, IIS
WebDAV upload ASP.
So that is pretty self-explanatory.
This essentially allows us to upload a malicious
or a meterpreter ASP file.
That will provide us with a meterpreter session
onto the WebDAV server automatically, right?
And we can copy that here.
So I'll say copy, and we'll say use.
And you now need to specify your payload or the payload
that you want to use.
In this case, the default payload
is Windows meterpreter reverse TCP
because the target system is 64-bit,
and we have been able to confirm that, you can change this
to Windows x64 meterpreter reverse TCP.
But in this case, I'll leave it as is, right?
So if we say show options, you can
see that we need to specify our IP address as L host.
You then need to specify the L port option
and of course, in this case, it's
generating a new ASP file that it will then
be uploading onto the target.
And we have a few options that we need to specify.
Because this is also going to upload the ASP file for you,
you need to provide the HTTP password
and username for the WebDAV server.
So let's start off with that.
So I'm going to say set HTTP username to Bob,
and we're going to set the HTTP password to password_123321.
All right so those options are set.
So if I say show options, the next option that we need to set
is the target IP, which is right over here.
That's the R host option.
So I'll copy the target IP right over here
and I'll say set R hosts to the target IP.
And you can then change the R port option
to 443 if the actual WebDAV server has an SSL certificate,
and you can then set the SSL option to true.
In this case, everything looks fine.
As I said, because we're generating a new ASP payload,
you can specify a new port.
In this case, the default port is port 4444 which is fine.
We then need to specify the path.
This is the path to attempt--
that this module will attempt to upload the actual ISP
file that it will generate, and in order to set this,
we need to set up the-- we need to set it to the following.
So we will say path, and that is going
to be under the WebDAV directory.
So WebDAV, and then we can provide it with the name.
In this case, I'm just going to say metasploit.asp.
All right?
We can then exploit, and that is going to start the reverse TCP
handler.
It's going to check WebDAV.
It's then going to authenticate.
And once it authenticate successfully,
it is then going to upload the actual payload,
the ASP payload, and it will then
rename it into an ASP file.
It'll then execute the ASP payload,
and it'll also delete the metasploit.asp payload for you
in order to avoid detection.
Right?
So you can see it sends the stage,
and then it opens meterpreter session right over there.
So sysinfo, and we pretty much get the same information.
And if we type in get uid, anti-authority system,
so as you can see this particular Metasploit
payload automated all that we had done previously.
And again, the reason why I covered
the manual techniques is because it's
very important to know how to do it
without the help of a Metasploit payload.
And doing it manually also helps you understand what
is going on in the background.
Right?
So you can utilize the Metasploit payload in the event
that you want to essentially automate this process.
So if we take a look at the WebDAV directory here,
I'll head into WebDAV, and you can
see that it actually deleted the ASP payload that it generated.
So this module is very, very helpful in that way.
Now, of course, you can also delete it using the cadaver
utility, or we can delete the shell.asp
file that we had uploaded manually very, very easily.
So if we list out the Help menu here, you can see,
we can look for the Delete command.
So I can say Delete and shell.asp,
now that's going to delete it, and of course, we
can list out the contents now.
And that has deleted it successfully.
So that is always something that is recommended.
Once you've gained access to the target system,
delete any of the payloads or exploit files
that you uploaded onto the target
because again, that is something that can easily be detected.
So you want to be as clandestine as possible.
All right?
So that is going to conclude the practical demonstration
side of this video.
All right so now that we've explored
the process of exploiting WebDAV running on Microsoft IaaS,
we can now move on to exploiting SMB on Windows.
So in the next video, we'll get started
by taking a look at how to perform a brute force
attack on SMB, and how to utilize the credentials to gain
access to the target system through the use of the PS Exec
utility.
So I'll see you there.