[THEME MUSIC]
Vulnerability Scanning with Nessus.
In this video, we are going to be
taking a look at how to install and configure
Nessus on Kali Linux, as well as how
to perform a vulnerability scan on a target system,
and consequently, how to export and import the Nessus scan
results into the Metasploit Framework for analysis
and, consequently, exploitation.
So first and foremost, what is Nessus?
Nessus is a proprietary vulnerability scanner
that's developed by Tenable.
And we can utilize Nessus to perform a vulnerability scan
on a target system or a group of systems, after which,
we can then import the necessary results into the Metasploit
Framework, as I said, for analysis and exploitation.
Now the great thing about Nessus is
it automates the process of identifying vulnerabilities
and also provides us with the information
pertinent to a vulnerability like the CVE code,
which we can then use to again perform
research and consequently, identify
the respective Metasploit exploit module that we can use
to exploit said vulnerability.
Now, when it comes down to how Nessus performs vulnerability
scanning, it will start off by performing host discovery.
So it actually discovers the active hosts on a network.
And if we provide a single IP, it
will ping the device or the host to see if it's up.
After it has determined that that particular host is up,
it will then begin performing port scanning
and then grabbing the banners or the service information of all
the services that are currently running on the open ports.
It then utilizes its database.
And this is what again separates a manual vulnerability scanning
from automated vulnerability scanning,
is that pieces of software like Nessus
have a vulnerability database that contains
a list of services and exact versions
and the vulnerabilities or exploits are
pertinent to that specific version of the service.
So it will then perform a check or a cross-reference
between the services that are running
on the target and the services that are currently
within the vulnerability database
and will then discover whether any of these services
are vulnerable to a particular exploit, after which it will
provide us with the CVE and any reference links
that we can use to learn more about the vulnerability.
And if there is a Metasploit module available,
it will also provide us with that information.
Now, when it comes down to installing Nessus
and the version of Nessus we are going to be using,
we are going to be utilizing Nessus Essentials, which
is the free version of Nessus and allows us to scan up
to 16 IPs for free.
So we'll actually take a look at how to install it on Kali
and how we can again use it for vulnerability scanning.
So again, our lab environment is going
to be the same lab environment that we utilized
in the previous video, so we're going to be utilizing
Metasploitable 3.
And again, as I mentioned, you don't
need to download Metasploitable 3 and set it up.
I am primarily going to be focusing on the techniques
here and how you can replicate them in whatever environment
you're working in and whatever target
you're going to be dealing with during the course
of a penetration test.
All right, so let's actually get started
with the practical section of this video now.
All right, so I'm back on the Kali VM.
And in order to download Nessus Essentials, what you want to do
is head over to the following webpage,
which is www.tenable.com, Products, Nessus, right?
So under Products, you'll find the Nessus product here.
So you can just go directly to that particular URL
or you can just search for Nessus Essentials on Google.
And as you can see, this is here.
This is a free download.
It allows you to scan up to 16 IPs.
And again, it's useful for educators, students,
and individuals starting their careers in cybersecurity.
So you can just hit Download.
You'll then be prompted to enter your details for an activation
code.
So you need to enter your first name, last name, and business
email.
And then, once that is done, all you need to do
is type Get Started, and they will
email you an activation code.
So I'm just going to do this and, once I'm done,
I'll then again resume when I'm actually
filled out the information and I've essentially
received my activation code.
All right, so once you've provided your information,
it's going to tell you that you will be receiving an activation
code to the email that you provided.
And, in this case, it allows us to download
the binary or rather the package that we
can use to install Nessus.
So I'm going to click on Download
and again, give that a few seconds.
And now it's going to bring you to the Nessus Downloads page,
where you can essentially download the Nessus
Vulnerability Scanner.
And in this case, we are using Nessus Essentials.
And it has a pre-made binaries for Windows and various
distributions--
Linux distributions.
And in our case, it also has a pre-built binary
for Kali Linux, which I can hopefully
identify here for the exact version of Kali
that we are running.
Hopefully, I can find it.
It should be somewhere here under the Debian.
So, yeah, this is the one here.
So this is Debian 9 and 10, Kali Linux 2017, 18, 19, and 20.
And this is 64-bit so we can just download it.
It's a Debian package.
And I'll take you through the process
of how to get this installed.
So I'll click on that there.
I'm going to agree to the license agreement.
And that is going to download the Debian package.
So I'm just going to save that and wait for that to complete.
All right, the download is completed.
And I'm just going to head over to my terminal.
And I'm going to navigate to my Downloads directory.
So let me just do that right now.
So cd Downloads, and we'll clear that out.
And there is the Debian file.
So we can install this, firstly, by providing it
with executable permissions, which
can be done by typing in chmod + x
and then specifying the package there.
The next thing we need to do is utilize
the dpkg or the Debian Package Management Utility
to install it.
So dpkg-- there we are.
Let me just type that in correctly-- dpkg.
And then, we specify the -i option,
and then specify the package that we want to install,
hit Enter.
It's going to prompt you for your Kali password or your root
password.
And I'll just hit Enter.
All right, so it looks like Nessus has been installed.
In order to utilize Nessus, we need
to start up the Nessus Scanner.
And that can be done through the use of systemctl
and primarily because Kali Linux is based on Debian, which
means the net service or other the utility
we need to utilize to start up a service
is going to be systemd and, consequently, systemctl.
So we'll say sudo systemctl start nessusd.service,
which essentially stands for Nessus Daemon.
So I'll hit Enter, and that has started the service.
And then, it's saying--
Again, it tells us right over here,
go to Kali, or your local host, then port 8834
to configure your scanner.
Before we do that, let's actually check
the status of the service, just to make sure that the Nessus
service has been started.
So Status.
As you can see, it's loaded and active.
So I'm going to head over to my local host on port 8834, right?
And we'll do that right now.
So 127.0.0.1 0.1:8834.
And remember, that is https.
So it's going to ask us to again accept the invalid or rather
the SSL certificate.
So I'm going to hit Advanced and accept the risk and continue.
And there we are.
It's going to say, Welcome to Nessus.
And it's going to ask us to choose
how you want to deploy Nessus so select a product
to get started.
We are working with Nessus Essentials
so I'm going to hit Continue.
We can then skip this process because you should already have
received an activation code.
So I'm going to say, Skip.
It's then going to ask you to paste in your activation code.
So I'm just going to get mine and paste it in.
All right, I have pasted in my activation code.
It's now going to ask you to create an administrator user
account.
In this case, I'm just going to use the default, which is Admin
and then create a password here.
So I'm just going to enter that right now.
Let me just type that in correctly.
There we are.
And then hit Submit.
And I'm going to save that so that I can always
have it handy.
You want to give that a few seconds because Nessus will now
begin the real setup, and then, of course,
it needs to get the Vulnerability Database.
So as you can see, it's going to say Initializing
so please wait while Nessus prepares the files
needed to scan your assets.
It's going to begin downloading the plug-ins and then
of course setting them up, which will involve compiling them.
So the initial setup is going to take a few minutes.
All right, so once the plug-ins have been downloaded,
as you can see, it's going to begin compiling the plug-ins.
This is going to take a few more minutes,
depending on your system resources--
more specifically, your CPU power.
So again, based on your current resources,
this is going to take a few minutes to probably half
an hour.
So again, just give that a few seconds to a few minutes
and grab a cup of coffee, and once you're back,
it should be done.
All right, so the compilation process has completed,
and you will be greeted by this Welcome screen
here, telling you to get started by performing a discovery scan.
However, in our case, we already know what the target IP is.
So we're just going to close this
as we don't need to perform a discovery scan--
and welcome to Nessus.
Now Nessus is a fairly simple tool, or rather vulnerability
scanner, to get accustomed to.
And we can immediately start off by performing a new scan here.
And under your Scan Templates, you
have the Host Discovery template,
which again allows you to perform
a simple scan to discover live hosts and open ports.
However, in our case, we want to head over
to a full system scan, which is suitable for any host.
And again, we will be able to customize
this to actually essentially perform what we want.
So we're just going to provide this with a name,
and we'll just call it MS3.
And we can forward a description if you want.
And here is where we specify the target IP.
So I'm just going to specify the target IP in my case, which
we already know.
We can then move on to the schedule.
However, let me just explain the structure over here.
So the structure of the Nessus Vulnerability Scanner
is very simple to understand, especially when
you're launching a scan.
If you want to launch an authenticated vulnerability
scan, you can provide the credentials here,
and you can also access or specify specific plug-ins
that you want to utilize for your scan.
However, this is beyond the scope of this video
and of this course.
We are primarily going to be taking a look at how to use it
for vulnerability scanning.
So under Discovery, we can specify
the Scan Type to essentially limit it
to the most common ports.
And again, it'll give you an idea of what this does,
so General Settings, Always test the local Nessus host,
Use fast network discovery.
And then, for the Port Scanner Settings,
it's going to scan the common ports.
It'll use netstat if credentials are provided,
and it'll utilize the SYN scanner if necessary.
And it will ping the host using the following protocols-- so
TCP, ARP, and ICMP, and we can then customize this
to all ports or just the common ports
or a custom range of ports.
In our case, let's just stick to the common ports
here under Discovery.
So if I move over to Assessment, this
is where you specify your Scan Type.
In this case, we can scan for known web vulnerabilities.
Again, they have various variations of this.
So again, this will give you an idea of what's going on here.
So the Default Scan Type will avoid potential false alarms,
will disable CGI scanning, and as for web applications,
it will disable web application scanning.
So we will utilize this particular Default Scan Type.
Right, so again, if we just click on that here.
And under Reporting, this is very, very important
because, again, on the processing,
we'll just leave that as the Default. And as for the Output,
we can allow users to edit the scan results.
We don't need to designate hosts by their DNS name.
And again we do not want to display the hosts that
responded to the ping, and we pretty much
don't need to do anything there.
All right, now for the Scan Type, right?
So the Scan Type is essentially where
we specify the performance or the speed of the scan.
And this will again be based on your system resources
as vulnerability scanning can be quite resource-intensive.
So we'll just leave it as the Default here.
And once we are ready to go, we can simply hit Save and Launch.
So I can just hit Save here.
And now, under your Scans, you will
see that you have the MS3 Scan here.
And the Schedule is set to On Demand
because we want to launch it whenever we are ready.
And in order to launch it, you just
need to click on the little play icon here,
which again is the Launch button.
So I'll click on Launch.
It's going to tell you when it was launched.
And then, you can either stop the scan
or wait for it to complete.
And as you can see, this little green status bar
here tells us that is running.
So again, based on the type of scan you're performing,
it's going to take a while.
So I'm just going to wait for the scan to complete.
All right, so the Vulnerability Scan is complete.
That took about 20 minutes.
And once it's done, it'll actually tell you
that it's completed here.
And you can also trash this or delete it when you're done.
However, in our case, we actually
want to explore the actual vulnerabilities that
were detected.
So when we click on the Scan, you
can see that it's going to have various tabs here.
And the one that we're interested in
is the Vulnerabilities tab, right?
And right of here, it's going to sort out and categorize
the Vulnerabilities into, again, the actual--
Firstly, it's going to actually bring up the piece of software
or the service that has the most amount of vulnerabilities,
as you can see here.
And you can change that filter by clicking on the Filter
option here, and then you can then limit it or again specify
your Filter options.
So, for example, if we wanted to see, let's see,
the Metasploit Exploit Framework, I can say
is equal to true and hit Apply.
And as you can see, this is going
to give us a list of vulnerabilities
that can be exploited through the Metasploit Framework.
So if I click on the Microsoft Windows Vulnerabilities here,
you can see we have the various vulnerabilities.
So we have EternalBlue.
We also have BlueKeep.
And it also provides you with the relevant CVE codes.
And I'll take you through the process
of searching for CVEs within the Metasploit Framework
Console in a few seconds.
So if we click on one of these, like this one here,
you can see it'll give you a description of what
this particular vulnerability is.
And it gives you the CVE code.
That is very important.
And then, on the right here, it gives you
the CVSS, which is the Common Vulnerability Scoring System.
And it'll tell you the score.
So 0 being the lowest in terms of the risk factor and 10
being the highest, you can see that this has a 9.8
because of how dangerous it is.
And then, as for the Vulnerability Information--
as you can see, this is a Windows Vulnerability--
it will also tell you where the exploits are available,
the exploit is.
As you can see, it'll tell you, Exploits
are available, which means it's fairly easy to exploit.
And then it'll tell you what it is exploitable with--
and in this case, Metasploit.
So if we go back to our vulnerabilities,
and you can see, we've currently added the filter here.
We also have the Apache Tomcat Vulnerabilities.
And if we click on them here, that's
the one that has the Metasploit module that we can actually
utilize.
And it gives you the name here.
And we'll take a look at that in a few seconds.
If I go back to the Vulnerabilities page,
you can also utilize another filter.
So again, this is entirely up to you.
But what we are primarily interested in
is exporting these results.
So again, we can export them into various formats.
We can either say, Export into Nessus or Nessus DB,
and we'll get to that in a second.
However, we can also take a look at one more filter
that's very, very important.
Let me see if I can actually find that here.
That is the Priority-- rather the Severity,
that's the one that I was interested.
The Severity is equal to High.
This will give you a list of all vulnerabilities
with a high severity.
So if I hit Enter, as you can see,
that gives you a list of all the vulnerabilities
with a high severity.
And, of course, they are sorted based on the service.
So for example, Microsoft Windows Multiple Issues,
I can click on that.
And again, it gives you these vulnerabilities
with a high severity.
So again, you can play around with the filters
and look for exactly what you're interested in.
So I've cleared that out.
So the next step would be to export these,
or to essentially export this report or this particular scan,
and then import it into the Metasploit Framework.
All right, so to export this, we're
just going to click on Export and then Nessus.
As you can see, it's going to process that.
And this is an XML file so we're just going to hit Save.
That should download immediately.
And now, we need to start up the Metasploit Framework Console,
so msfconsole.
Again, ensure that the postgresql database
is started because we'll essentially
be importing the scan results into the database.
So I'm going to hit msfconsole here.
And I will be creating a new workspace
because the previous one had our previous work,
or rather we were essentially performing
a manual vulnerability scanning.
So I'm going to say workspace, -a add,
and we'll just call this one ms--
Sorry, ms3_Nessus, right?
There we are.
And that's the current one we're working with.
So to import the results, we're going to say db_import.
And if we hit Enter, you can see it will give you
an idea of all the tools that you can actually import,
or rather the information from any of these tools.
And in this case, we're interested in the Nessus XML
report.
So we are going to say db_import, and then
specify the location where you saved the report, or rather
the output from Nessus, which, in my case,
is under the Home Directory under kali, under Downloads.
And it is the MS3 Nessus scan.
So I'm going to say MS3, and then hit Enter.
That's going to import all of the Nessus scan results.
So I'm just going to wait for this to complete.
All right, so once the results from Nessus
are imported successfully, we can essentially
confirm that this is the case by saying Hosts.
As you can see, we now have the Target IP
and the correct operating system here.
We also get the operating system service pack and its purpose.
If we type in the Services, you can
see that we have all of these services currently open.
So that's the entire port range.
So we have quite a few services.
And then we also have the names here.
Now when it comes down to vulnerabilities,
and this is very, very important, what we can do
is we can utilize the Vulnerabilities command, which
is the vulns command.
So if we say maybe vulns, like so,
this will give you an idea of all the vulnerabilities
and their Target Port rather.
And this is quite a bit of information here.
So we can go through it in terms of the port and the service.
So if we go back to the Services tab here, and, let's say,
we're looking for smb, which is Port 445--
so smb services and vulnerabilities--
what we can do is limit the vulnerabilities displayed.
So I'm going to say vulns and then
we specify the port and Port 445, hit Enter,
and these are all of the vulnerabilities that
affect this version of SMB that's running on the target.
So the question is, how do we utilize this information
to obtain exploits?
Well, we already know of the EternalBlue exploit, right?
What we can utilize is we can actually
utilize the CVE code for each of these,
and I'll get to that in a second.
So you can see that in this case, it's limited to Port 445.
If we take a look at probably some of the other ports,
like may Port 80, let's see if we have any vulnerabilities
for that-- no, nothing there.
Maybe 8080-- nothing there.
Let's try Port 21 FTP--
no vulnerability.
So let's check--
Let's take a look at all the vulnerabilities
we were able to detect, and we'll go through it
and take a look at the CVE codes because they're very important.
So when it comes down to searching
for Exploit Modules within the Metasploit Framework
with a CVE code, it's fairly simple.
All we need to do is utilize or specify the CVE year.
So if the Exploit was released or rather the Vulnerability
was disclosed in the year 2017, we can copy that,
and we can then say Search, and then we specify CVE,
and then type in 2017.
And then, you need to specify another piece of information,
and this is where the key difference is.
So we can say, maybe, Name is maybe smb, for example.
Hit Enter.
And as you can see now, we get the exact CVE Exploit Module
and essentially provides us with all the available modules
that we can use to exploit that particular CVE, right?
And as you can see, these are all released in the year 2017.
So let's take a look at a few other exploits here
and their CVE codes because that's the best
way of identifying them.
So I will try and identify a few here.
Let's see.
There we are.
Let's try and utilize this particular CVE.
So this is CVE--
the year is 2012.
And it's targeting RDP or Remote Desktop, right?
So what I can do is, again, just take note of that.
And then, we can go back down in here
and say the CVE year is 2012.
And then the name that we're looking for is RDP, hit Enter.
And in this case, it looks like we
don't get any particular exploit module
for that particular vulnerability.
So let's just take a look at some of the other ones here.
And in this case, the RDP value is what we're interested in.
And it looks like it has multiple CVEs.
So we can actually try and search
for the Microsoft Security--
or rather the Microsoft Vulnerability Code.
So if we just say Search, place that in there.
As you can see, we get the exact exploit code.
So you can utilize the CVE code or the Microsoft Vulnerability
Identifier here to get the particular exploit module.
And in this case, it looks like these
are auxiliary modules that essentially
check whether Remote Desktop is enabled.
So again, you can go through this port by port.
And I would recommend exploring all of this as you actually get
or as you actually approach or single out the port
that you want to attack and the service you want to attack.
Now, if you remember in the previous video,
we had a very tough time finding an exploit for ManageEngine
Desktop Central.
So let's try and see whether we can
find the exact exploit module.
So the CVE here is 2015.
So we are just going to say--
We'll just go down in here, and we will say search cve:2015,
right?
And then, we specify the name, which is ManageEngine,
and there you go.
So we immediately get the exploits
pertinent to that particular vulnerability.
And in this case, this is the exploit module here.
So it's the ManageEngine Desktop Central 9 File Upload Servle,
and again, we can copy it.
For example, paste it in there.
There we are.
It's going to set the Default Payload for us.
So Show Options,.
And then, we can specify the Target IP, which again--
if I say Set RHOSTS, because we didn't set the Global
Variable-- so 10.10.10.4, and we then can just hit Run,
and hopefully we'll be able to get a Meterpreter Session
on the Target System.
So again, just give that a few seconds.
There we are-- Executing the stager.
It then sends the Stage and we should receive a Meterpreter
Session.
All right, so after a few seconds,
we get a Meterpreter session.
As you can see, I've interacted with it.
So again this is Info, and there you go.
So again, now you can pretty much
see the power of vulnerability scanning
and how a tool like Nessus can be extremely
useful in identifying the exact exploit module
you should be using, and how we've narrowed down our search,
and we can now be able to detect all of the various exploit
modules to use.
So if I just Exit out of this particular session.
There we are.
And we again take a look at Nessus
here, because that interface is much easier to read,
we can again utilize the filter here
and we can look for the Metasploit Exploit Framework.
There we are.
And we say, equal to true, and hit Apply.
And then, of course, we can use the results here
to identify the various exploits or the exploit
modules we can utilize.
So, for example, if we take a look at this RDP exploit here,
which the CVE code is 2019, so we
can easily find that by, again, going into the Metasploit
Framework Console.
And we go Back, and we can then say Search CVE:2019.
And then, Name is RDP, right?
And hit Enter, and we get the BlueKeep RCE vulnerability
or exploit module here.
And again, it's fairly simple.
It looks like we got another Meterpreter session
from the Target.
Let me just terminate that.
If I list all the sessions, yeah, we've terminated that.
So that's great.
So you can see how important this can be.
And of course, you can do that for any
of these vulnerabilities here.
So this is the BlueKeep RCE, or RDP RCE exploit.
We also have a few others here, like this one here.
And if you can find the exact module name,
you can then again copy it directly from here
as it provides you with the exact module name.
So again, let's take a look at a few others that we can utilize.
So again, if we're trying to explore maybe PHP,
we might have a few PHP exploit modules here.
So we can just copy that, and then
search for that specifically, and then paste that in there.
And we immediately get the module
that we were looking for.
So this is really, really important
when it comes down to penetration testing.
And, really, whenever you're interacting or utilizing
the Metasploit Framework, take advantage
of the various third party tools that
can again be integrated or interpolated
with the Metasploit Framework.
And examples of that are Nessus, Nmap, so on and so forth
because they really are all powerful
when it comes down to the exploitation phase.
So that is going to conclude the practical demonstration.
You should be familiar with how to essentially get
the Nessus Essentials installed on Kali Linux,
and then how to set it up, and how to use it to perform
a vulnerability scan.
And then how to export the results from a vulnerability
scan, and then import them into the Metasploit Framework
database.
And then how to essentially sort through all of that data
and find the vulnerabilities, or how
to find the exploit codes for the specific vulnerabilities.
So again the Metasploit Framework Console
is extremely powerful.
For a list of the services, there you are.
And then, of course, you can go through the vulnerabilities
here.
And it'll give you the CVE codes,
and you can also utilize the Nessus Web Interface
to find the exact Metasploit Framework module
names during exploitation.
So that is going to conclude the practical demonstration.
In the next video, we will be exploring
the process of performing web application vulnerability
scanning, and we will be utilizing
an in-built Metasploit Framework module
called WMAP, which is, again, extremely useful
and will help us automate web application
vulnerability scanning and will make things a whole lot easier
when it comes down to identifying web application
vulnerabilities.
So I'll see you there.