[AUDIO LOGO]
Vulnerability scanning with the Metasploit framework.
In this section of the course, we're
going to be exploring the process of performing
vulnerability scans with various Metasploit framework
modules, both auxiliary and exploit modules,
and we'll also be taking a look at how
to utilize various Metasploit framework plug-ins that
can aid in this process, as well as how to import scans
from the Nessus Vulnerability Scanner
into the Metasploit framework.
All right, so first and foremost,
what is vulnerability scanning?
Vulnerability scanning is essentially
the process of scanning a target system for vulnerabilities,
and furthermore, verifying whether these vulnerabilities
can be exploited.
And in the context of the Metasploit framework,
we are specifically looking for Metasploit framework exploit
modules that can be used to exploit these vulnerabilities.
So again, we're really narrowing down our search
here for only Metasploit modules,
because again, this is a Metasploit course.
So that's really what we're going to be doing.
Now the vulnerability scanning section
is going to set the stage for the exploitation sections
that will of course entail the process of exploiting target
systems and, of course, target services.
So so far we've been able to identify and exploit
misconfigurations on target systems,
and we've of course explored this
during the information gathering and enumeration
phase, where we were able to obtain
the version of the service that's running on a target,
as well as the operating system version.
And then we took a look at how the perform a few brute force
attacks, which really exploited misconfigurations.
Now misconfigurations are fine, but when
we move into the exploitation phase,
we are going to be taking a look at exploit modules that exploit
specific inherent vulnerabilities within services
and within operating system.
So again, that's really what our focus will be.
Now in this section, we are primarily
focused with performing vulnerability scanning
on target systems, both Windows and Linux,
but we'll be focusing on Windows as a primary example.
And we'll also explore the process
of performing vulnerability scanning on web applications.
Now in this particular video, we are
going to be taking a look at how to perform vulnerability
scanning through the use of various auxiliary
and exploit modules in that we'll be utilizing
the auxiliary modules to scan for a specific vulnerability
or to actually check whether a particular service is
vulnerable.
And then we'll use the exploit modules to essentially verify
whether the target service is vulnerable or can be exploited.
So again, this is a very holistic process
that will involve or that will encapsulate information
gathering and enumeration, which we've already covered.
And then I'll be exploring some new techniques
here that we can utilize to identify
exploit modules or rather identify vulnerabilities,
and then utilize exploit modules to essentially take advantage
of these vulnerabilities.
We'll also be exploring the process
of importing Nessus scans into the Metasploit
framework in the next video.
So again, that's something that will also be very important.
But in this video, we are primarily
focused with the tools, modules, and plug-ins
that again, can help us perform vulnerability scanning
within the Metasploit framework.
So let's get started by taking a look at the lab environment
that we're going to be utilizing.
So for the purposes of demonstrating the vulnerability
scanning process, we will be utilizing
an intentionally vulnerable virtual machine
called Metasploitable3.
It is a virtual machine that is based on Windows Server 2008,
and was developed by Rapid7, the same company that actually
acquired the Metasploit project early on.
And this particular virtual machine
was created to demonstrate how the Metasploit framework can
be used to exploit a Windows system.
So again, this particular virtual machine
is set up for educational purposes.
And again, it's there to show you
how you can utilize the Metasploit framework
to full effect for exploitation.
Now again, if you want to actually set this up
for yourself, you can go ahead and do that.
The setup instructions are provided through that link that
is actually on the slides here.
And if you want to actually go ahead and set this up
on your own virtual lab, you can go ahead and do so.
However, you don't need to do that because we are primarily
going to be focusing on techniques here as opposed
to the target environment.
And the reason being is when you're performing a penetration
test with the Metasploit framework,
you're really not going to be again dealing
with the same type of lab or the same type of environment.
It's going to be different.
So the key thing is you need to be sure
and you need to be aware of the techniques as opposed
to the actual target environment.
So you can go ahead and take a look
at how to get that set up if you want to follow along.
Irregardless of that, you can just
take a look at the techniques we use and the various modules we
can utilize, and you should have no problem replicating
the process in any environment that you're working in.
That being said, let me switch over to my Kali Linux VM
and we can get started with the practical demonstration
of this video.
All right, so I'm currently within my Kali Linux
virtual machine, and I've set up the target virtual machine
on the same local network so that we
can communicate with it.
So the first step in this process
will involve identifying the target IP.
And in my case, I can simply run a quick Nmap scan here
to essentially detect active hosts on my network.
So I'll use the sn option, which will essentially just perform
a quick ping, and we are performing
this on my local network.
So that is 10.10.1, and that's the subnet there.
So I'm just going to hit Enter and provide
my password for the user kali.
I'll give that a few seconds, and it
should tell me what hosts are up and consequently the target IP.
So if I type in ifconfig, you can see that--
well, that actually doesn't display anything.
So if I type in ip a s, you can see that the Kali Linux VM is
10.10.10.5.
And right over here, it looks like the target IP is 10.10.4.
So we'll copy that.
The next thing or the next step is
to obviously ensure that the PostgreSQL database
service is started, which I've already
covered how to do quite a bit.
So you should be familiar with that.
Once that is done, we can type in msfconsole here,
and that will start up the Metasploit framework console.
We'll give that a few seconds.
Excellent.
All right, so that started up.
We'll just verify that the database is connected
by typing in db_status.
Indeed, it is.
The next step that we need to perform
is, of course, set our global variables for the RHOSTS
option, and what this will do is it will essentially
set up this variable globally so that the target IP is always
configured or is always set whenever we use
or whenever we load any module.
So we don't have to keep on typing it in.
So I'm going to Enter.
And we'll also do this for the RHOST option or setting.
I'll hit Enter and that should have the target IP configured
for any module that we load.
All right, so now when it comes down to vulnerability scanning,
the key piece of information that you
require in terms of identifying vulnerabilities for a target
operating system or the services that are running on a target
is the service version.
Now in the previous section when we were performing enumeration,
I showed you how to do that through the use
of various Metasploit auxiliary modules,
and we also took a look at how to import
Nmap scans into the Metasploit framework console.
So what we'll do for the target now
is we'll just run the db_nmap command,
and this will essentially allow us to perform an Nmap
scan within the Metasploit framework console,
and it will then automatically import the results
into the Metasploit framework database.
However, before we do that, I want to set up a workspace
here that will essentially help us to sort out
all of our results and all of our hosts
rather and keep them organized.
So I'm just going to create a workspace called
MS3, which is an abbreviation for Metasploitable3,
I'll hit Enter.
And that is the current workspace
that we're dealing with.
All right, so again we'll say db_nmap.
And of course, you can utilize the auxiliary modules
if you also want to do that.
But in this case, I'm just going to speed everything up here.
So we'll say db_map, and then we are performing a scene scan.
So I'm going to say a lowercase S uppercase S.
And we also want to perform some service detection,
and I'm also going to perform some operating system
detection, and then I'll type in the target IP, which we already
know.
And that's pretty much it.
Now, of course, I can increase the port range
if I want to to the entire TCP port range, which
is about 65,535 ports.
But in this case, I'm not going to do that because again, I'm
focusing primarily on techniques here.
So I'll hit Enter.
That's going to perform the Nmap scan.
So I'm just going to wait for this to complete.
And as I said, all the results or rather the results
of the Nmap scan will be added to the Metasploit framework
database, so that we can refer back to them whenever we want.
All right, so the Nmap scan is complete.
And as you can see, it's provided us
with a lot of information here.
And we have quite a few services running,
services that we have been able to enumerate
in the previous section.
So again, as you can see, Nmap gives us the port.
And of course, we know we are dealing with TCP here,
the service that's running on the port, as well
as the service version.
And so we already know that Nmap can automatically
enumerate the version.
So again, you can do this with Nmap
or you can utilize the auxiliary modules.
Whatever your choice is, it'll work just the same.
So what we can do is just clear out of this.
And if we type in hosts, you can see that information has now
been stored here.
And in this particular case, we have the target IP, the Mac
address, and for some reason, it's
telling us that the operating system
that's running on the target is Windows 7.
Of course, we know that it's Windows Server 2008.
So if we type in services, this will
display all the open services and the respective ports,
and we can see that we have quite a few common services
that you typically expect a server to be hosting.
We have FTP, we have a web server running on port 80,
we have SMB which is on both 139 and 445 facilitated by netbios
on 139 as I've already explained during the SMB enumeration
video.
But you can see that the SMB port gives us
an idea as to what the operating system is
or rather the specific version of the operating system.
And in this case, it tells us that this is Microsoft Windows
Server 2008 R2.
And then we have a few other services
and we also get their exact versions.
So for example, we have Apache Tomcat using Coyote JSP Engine
1.1.
So the question is, how do we utilize this particular service
information to find and identify vulnerabilities?
Because we are primarily focused on manual techniques here.
So the first thing we can do is, of course, just
utilize the exact version here or I can essentially search
for Microsoft IIS exploits.
So I can say search, and then limit the type to exploit.
So we can say exploit, there we are, and then the name.
I can then limit that to Microsoft IIS.
So I can say I can this space that in there, and I hit Enter,
and this is going to give me all Microsoft IIS exploits.
However, as you can see, these are
all for other versions of IIS like 5.0, 4.0, et cetera.
And the one that is running on the target is version 7.5.
So again, there's two scenarios here.
Number one, this particular version of Microsoft IIS
might not be vulnerable to an inherent exploit
or there isn't a Metasploit exploit module available
that can be used to exploit this particular vulnerability
or this particular service.
And, of course, in this case, we are primarily
focused on the Metasploit framework
and the exploit modules within the Metasploit framework.
So we really can't start exploring external exploits
or rather taking a look at how to use exploit code manually.
So again, that's pretty much a dead end.
Now we can take a look at some of the other services that
are running on the target like MySQL.
So we can say MySQL 5.5.
So let's perform a search for that.
And let's see if we get any results.
So I'll paste that in there.
And as you can see, it looks like we have a few MySQL
exploits, but they're really not for this particular version
of MySQL or rather the exploit names
and the descriptions don't give us an idea as to whether
or not these exploits actually exploit a vulnerability
within MySQL version 5.5.
So you can see that this is quite a tedious process when
it comes down to identifying exploits for specific versions
or rather for specific service versions.
So again, I can also do this for the Sun GlassFish service.
So I can essentially search for that.
So I can say, copy that, and then we'll say,
search, and then paste that in there.
And in this case, it looks like we have a module.
So how do we verify or how do we check
as to whether this particular exploit
module will work on the open source version of GlassFish?
And that is version 4.
So in order to do this, we can just copy the module here
and then say use.
And you can see that it will set up a payload,
and the payload, as I mentioned, is what
is sent to the target system.
And in this case, the default payload
is set to the Meterpreter payload for Linux system.
So we pretty much have to change that if this exploit will
indeed work.
And we need to change it to a Windows payload
so that we can get an Meterpreter session back.
However, before we do that, we need
to make sure that this will work on GlassFish version 4.
And in order to do this, we'll clear this out
and we'll say info.
Info will display information pertinent
to this particular module and what versions of the service
it will exploit.
So if we take a look at the description,
you can see it says this module logs into a GlassFish server
open source or commercial using various methods
such as authentication bypass, default credentials, or user
supplied log ins, and deploys a malicious WAR file in order
to get remote code execution.
It has been tested on GlassFish version 2, 3, and 4.
So that's great.
And it also works on the open source version.
So in order to run this particular module,
we know that it works on the version that's running
on the server or on the target.
And it also works on the specific version,
the open source version here.
So we pretty much have to configure the module options
in order to use it.
So the first thing we would typically do
is we would set the payload.
So we will set the payload to Windows,
and then we'd say meterpreter/reverse_tcp and hit
Enter because we are targeting a Windows system.
And now if we show the options, we
need to set up the APP_RPORT, which is the application
interface port.
We also need to set the target IP, which
is done through the global variable, the RPORT, which
is the target port where we have GlassFish running,
and then whether or not there is an SSL certificate, the target
URI, the username, et cetera.
And then, of course, we have to set the payload options,
we need to set our own IP, which is the Kali IP,
and the port that we want to listen on in order
to receive the reverse connection when the payload is
executed in order to receive a Meterpreter session.
Now in this case, we haven't performed
enough enumeration regarding this particular application
GlassFish in order to understand what ports we want to target.
But again, we can get a basic idea of what
values we need to change.
So if I type in services, you can
see that GlassFish is running on port 8080.
That's already been configured.
Yeah, that's the APP_RPORT.
What is the RPORT or the target port that we want to target?
We're really not sure about that.
So we pretty much have to check whether port 4848 is currently
open on the target.
But as I said, this is pretty much
how you would identify an exploit module
through the service version.
So this is just manual vulnerability scanning.
And of course, we're not going to exploit this module
because we're not there yet.
So I'm just going to take a step back.
All right, so if we again explore our services page,
let's explore a few other exploits or vulnerabilities
here.
And the one I'm particularly interested is the SMB exploit
or rather an SMB exploit for Windows Server 2008 R2.
And the way we can do that, of course,
or the way we can search for a particular exploit
is by, again, utilizing the Metasploit framework console
search utility.
Alternatively, we can also use an inbuilt utility
that's part of Kali Linux called searchsploit.
Now searchsploit is a utility or a command line utility that
allows you to search the ExploitDB or ExploitDB
database for exploits, and we can then
limit the results to only show Metasploit exploits.
So I'll open up a new tab on my Kali VM.
And as I said, in Kali Linux, searchsploit is prepackaged,
so only we need to do is type in searchsploit
and you can pretty much search for any exploit you want.
And as I said, searchsploit will actually
bring up exploits or exploit code
that is not available within the Metasploit framework console,
and it will also display Metasploit framework modules.
So we want to limit the results to only display the Metasploit
framework exploit modules.
Now in order to do this, we can again, what we'll do
is we'll try and find exploits for Microsoft Windows SMB.
So we'll say Microsoft Windows SMB, and then
I'm going to wipe out the actual output here,
or before we do that, if I hit Enter,
you can see there's quite a few exploits here.
And the way to distinguish the standard exploit code
from the Metasploit modules is you'll
see that right beside the name here,
there will be a bracket with the name Metasploit within it.
That means that there is a Metasploit
module available for this particular exploit.
So let's limit it to only the Metasploit modules.
And the way I'll do that is I'll pipe out the content
and I will say grep, and we'll use the expressions filter here
to make sure that we are case sensitive.
So I'll say Metasploit.
And once we hit Enter, it's only going
to show you the Metasploit modules.
OK, so we can see that there's quite a few modules
that we can utilize.
However, we still don't know whether any of these Metasploit
modules will work on the version or the operating system.
And in this case, we know it's Windows Server 2008.
Now if we take a look at the information
displayed here, so for example, if we actually
take a look at this particular exploit here,
we can see that this works on Windows 7, 8.1,
and Windows Server 2008, as well as R2.
And this is the EternalBlue exploit,
which we explored earlier on, and it provides us
with the Microsoft vulnerability code here.
Now the Metasploit framework already
has a module for this particular exploit.
As you can see, that's the one here.
So we can actually load it within the Metasploit framework
and check whether this particular version of Windows
is vulnerable to this exploit.
So what I'll do is I will say search eternalblue,
and we can see that we have the exploit module.
However, we also have another module
that's pertinent to this particular exploit,
and that is the auxiliary module for smb_ms17_010.
And what this module is used to do
is it's used to actually check whether the target is
vulnerable to this particular vulnerability
or this particular exploit.
So let's use that and let's see whether the target is
vulnerable at all.
So I'll say show options, and the only option
we need to change is the target IP, which is already done,
and the RPORT has been configured correctly,
we don't have any of the credentials or the domain
information.
So we just hit Run.
And it completes rather quickly.
And as you can see, it says the host
is likely vulnerable to MS17-010 Windows Server 2008 R2 Standard
7601 Service Pack 1, and it's a 64-bit version of Windows.
So this particular module tells us
that it is vulnerable to this exploit,
and furthermore, it also gives us some additional information
regarding the specific version of Windows Server that's
running and also the architecture.
So again, it's a very helpful module.
So now that we know that works, we
can actually utilize the real exploit module here,
which I'll just paste in there.
And as you can see, it sets the default payload to Windows x64
Meterpreter reverse TCP, which will work fine in our case,
because the target operating system is Windows
and the architecture is 64-bit.
So if I show the options now, you
can see that we need to set the payload options, which
is set perfectly fine.
In my case, this is my Kali Linux IP
and the LPORT is set to port 4444, which
is currently open in my case.
And again, we don't need to provide any other information
here because the global variable that we set earlier
has already configured the target IP
and the target port is set to the default SMB
port, which is port 445.
So I can just hit Run.
And as you can see, it looks like you
can see it told us right over here the host
is likely vulnerable to MS17-010,
and then it says the target is vulnerable,
it's going to connect to the target for exploitation,
and then establishes a connection,
and then it essentially performs the exploit here.
So it's going to send the stage and we
get a Meterpreter session, which means we now have access
to the target system.
So if I say sysinfo, you can see we are on the target system
and this just gives us basic information
regarding the target system.
So that's how to, again, identify or perform
some manual vulnerability scanning with the Metasploit
framework.
So I'll just exit and shut down that session.
The next technique that I want to highlight
is the process or the db_autopwn plugin.
Now this is very important because it's
an extremely useful plug-in for the Metasploit framework.
Let me just clear out the terminal,
and I'll open up my browser here.
So again, this particular plug-in
is available on its own GitHub repository,
and the name of the plugin is metasploit-autopwn.
So it'll give you a basic description as to what it is.
It says this is a Metasploit plug-in for easy exploit
and vulnerability attack.
What this means is that it is essentially utilized
to identify exploit modules for the ports that are currently
open on a target system.
And the way it does this is it takes a look
at your database and the services
that are currently running or that are currently
open on the target systems that you've scanned,
and then it provides you with a list of exploit modules
that you can use for each of those services.
So the way we can again utilize this particular plugin
is we can copy or download it, and then we
can transfer it into the user share Metasploit framework
plugins directory as it says here.
So I'll just copy that, and I'll open up a new terminal here,
and I'll just head over into my downloads directory
and paste in the wget code there.
That's going to download the Metasploit plug-in.
As you can see, it is a Ruby file.
So we'll give that a few seconds.
There we are.
It completes downloading.
So there it is.
So we now need to copy this, and in my case,
I'll move it and we want to move it
into the usr/share/metasploit-framework
plug-in's directory.
All right, so that is done.
Now in order to load this, what I would recommend doing
is just saying load and then db_autopwn.
So I can say load db_autopwn, hit Enter.
As you can see, it's going to say successfully
loaded plug-in.
And now in order to use it, we can say db_autopwn and hit
Enter.
That's going to bring up the documentation.
Now don't worry if it gives you this error here.
The db_autopwn command is deprecated.
That's because it's no longer supported,
but it still works perfectly fine.
And again, what this means is that it's not
a part of the Metasploit framework anymore,
and you have to sort of set it up manually as we did.
So what we can do, as I said, this
interacts directly with the Metasploit framework database,
and will only work if your scans or your service information
is already within the Metasploit framework database.
So I really recommend that you actually
start enumerating all of the information,
so that it's stored within the database,
and you can do that either through Nmap
or through the auxiliary modules as we
did in the previous section.
To use it, what we can say is we can type in db_autopwn,
and then what we want to use is the p option here,
which will select the modules based
on the open ports on the target system.
And the other option we want to use
is the t option, which will show all matching exploit modules.
Now if we just run it as is, you'll
see that it'll actually enumerate
quite a lot of modules.
So I'll hit Enter, we'll give that a few seconds to start up.
So as you can see, it's enumerating exploits
for each of the open ports.
Now, this can be quite hectic because as you can see,
it's going to display exploits for essentially all
the open ports, and it's really not specific
because it's not utilizing the service version.
So in order to make this more streamlined
or to narrow down our search, we can target specific ports
or specific services.
And in order to do this, what we can do is essentially--
let me just open up the documentation page,
we can utilize the PI option, which
allows us to specify the port range that we
want to perform the scan for.
So again, I can limit this to PI.
I'll just say PI and let's say target the SMB port which
is port 445, we hit Enter, again give
that a few seconds to start up.
All right, so that is complete.
And as you can see, it's now limited
all the matching exploits to just a few here.
However, as you can see it's also providing us
with exploit modules for Samba, which
is the Linux equivalent of SMB.
While in our case, we are targeting a Windows box.
However, it also does provide us with all the SMB
exploits for Windows here.
And they start right over here.
So you can see we have quite a few.
Now the next obvious step would be
to essentially perform more research about the target
operating system and what vulnerabilities
that specific version of SMB suffers from,
and then finding the appropriate exploit module to use.
And in our case, we know that the EternalBlue exploit
does work.
And again, it also provides that here,
and then it provides us with a few other exploit modules
that are very, very helpful.
And as you can see, this can be very helpful
when trying to limit your search for exploits
or to perform vulnerability scanning with the Metasploit
framework.
So again, you can also limit the port
to maybe something like port 21.
We know we have FTP running on the target.
But again, you can utilize this however you want.
It's an extremely useful module or other plugin that can again
save you a lot of time.
Now what we can do finally is we can make
use of the analyze command.
Now the analyze command will essentially
analyze the contents of the Metasploit framework
database, so your hosts and services,
and then will provide you with a list of vulnerabilities
that those particular services suffer from
or that can be exploited.
So I'm going to hit analyze.
And as you can see, it tells us analysis for the host
10.10.10.4, it provides us with the following exploits that are
ready for testing.
And then it also tells us what is
required in the event we want to use this particular one.
So it says credentials are required for this one.
But EternalBlue and another one that we
weren't able to identify, which is the doublepulsar_rce
exploit.
So I didn't know about that.
So now if we type in vulnc, you can see that it's essentially
been able to detect a vulnerability for SMB,
and it provides us with the description here, the Microsoft
security or vulnerability code and the type of exploit,
and then it provides us with the various CVE
links and the reference links that you
can utilize to learn more about this particular vulnerability
or this particular exploit.
So again, this is how to perform vulnerability scanning
with the Metasploit framework and how
to utilize the various auxiliary and exploit modules
to test whether a particular service is
vulnerable to an exploit or not.
And of course, we've also explored the process
of utilizing searchsploit in order
to identify or find vulnerabilities
for specific services.
So it's really very, very simple when
it comes down to utilizing it.
So for example, if I again search for services
and I maybe want to target this particular version of Apache
Tomcat, again I just open up searchsploit
and I can then add this within double quotation marks
and I'll paste that in there, hit Enter,
you can see it doesn't give us anything there.
So if we get rid of this here, let's see
whether we get any exploits or any matches.
As you can see, it provides us with a list
of exploits for Apache Tomcat, and then, of course,
you can limit it to the Metasploit modules,
and then, of course, again, utilize that particular module
or test that particular module to see
whether you can actually exploit that particular target service.
All right, so that is going to conclude
the practical demonstration.
In the next video, we are going to be taking a look at how
to import scan results, vulnerability scan
results from Nessus into the Metasploit framework.
And again, how these results can be
used to identify potentially useful
exploit modules that can be used to exploit
these vulnerable services.
So I'll see you there.