Exploiting a Vulnerable HTTP File Server.
Welcome to the Exploitation section
of this course, where we will be exploring
the process of exploiting vulnerable services
on both Windows and Linux systems.
And to start off, we are going to explore
the process of exploiting a vulnerable HTTP File Server.
So first and foremost, what is an HTTP File Server?
Well, an HTTP File Server, also known as an HFS,
is a web server that is designed for file and document sharing.
Now, the difference, or the primary difference
between an HTTP File Server and a typical web server
comes down to the actual features list available.
So the HTTP File Server is specifically
designed to host and share documents
and files for download.
So that's what it's typically designed to do.
And it really doesn't offer much in regards
to other web servers.
So you can't host a website on the HTTP File Server,
you're just hosting files and documents
that you want to share with users around the world
or on the internet.
And they can then again, download those files.
So again, that's the primary difference
between an HTTP File Server and a typical web server.
So a web server can be utilized again
to share files and documents, but it can also
be utilized to host a website.
So that's the key difference that you need to keep in mind.
Other than that, they all operate the same
in regards to the fact that they utilize
the HTTP protocol for the underlying communication.
And HTTP file servers will typically
run on TCP port 80-- that's the quickest way of actually
recognizing one.
And they'll essentially provide you
with a list of files or documents that have been shared
and that can be downloaded.
So they're really very simple in regards to the functionality
that they offer.
Now, when it comes down to HTTP File Servers, what
services or softwares are out there that
actually allow us to, again, set up an HTTP File Server?
For example, in the case of a typical web server,
we have our servers like Apache NGINX,
Microsoft IaaS to name a few.
In the case of HTTP File Servers,
a popular HTTP File Server is the Rejetto HFS or HTTP File
Server.
The Rejetto HFS is a popular free and open source
HTTP File Server that can be set up on both Windows and Linux.
It's extremely simple to set up and it allows you to easily
share files and documents locally on your local network,
as well as online on the internet.
So you can essentially just set it up,
specify the files and documents that you want to share.
And once that is done, they're essentially
shared within that particular directory or URL
and can be accessed by again, entering or heading over
to your browser, typing in the IP address
of the domain of the website.
And then, of course, on port 80 or port 443,
based on whether or not there is an SSL certificate,
you'll get a listing of the files that you can download.
Now, when we talk about the Rejetto HFS,
version 2.3 of Rejetto HFS is vulnerable to a remote code
or remote command execution attack that can essentially
allow attackers to remotely execute arbitrary commands
on the target operating system.
Luckily for us, the Metasploit framework
has an exploit module that we can
utilize to gain access to the target system hosting Rejetto
HFS.
So if the target system is running Rejetto HFS 2.3,
we can utilize the Metasploit framework module
to essentially obtain a Meterpreter session
on the target system.
Now, the exploitation process is going
to be a combination of all the previous sections
that we've explored.
So first and foremost, when we head over
into the lab environment, we are going
to perform some port scanning and enumeration on the target
to identify whether or not there is an HTTP File Server running
on the target.
We are then going to enumerate the actual version of the HTTP
File Server.
And in this case, it should be Rejetto HFS 2.3.
We are then going to again, load or search
for the relevant exploit module, configure it, and then exploit
it.
And we should get a Meterpreter session.
All right, so in order to get started,
just start up your lab environment
and we'll be able to explore the process of exploiting
a vulnerable HTTP File Server.
So I'll see you within the lab environment.
All right, so I'm back in the lab environment.
And the target IP address is conveniently stored
for us-- or actually, displayed here
within the actual target IP address document or TXT file.
So we can copy the target IP address.
Of course, in your case, it's going to be different.
We are then going to open up a terminal.
And I'm just going to maximize that.
And let me just zoom in a little bit here.
So there we are.
And then the first step, of course,
is to ensure that the PostgreSQL database service is started.
So we can do that by typing Service PostgreSQL Start.
That'll ensure that we can communicate with the Metasploit
framework database and create our workspaces.
We're then going to type in MSFConsole
to start up the Metasploit framework console.
Give that a few seconds.
We can then check the status of the database
to ensure that we are connected, and indeed we are.
We are then going to create a workspace called HFS as we are
dealing with HFS exploitation.
So there we are.
As you can see, we are currently working
within the HFS workspace.
The first thing we're going to do
is set up the global variable for the RHOST option
so that we don't need to specify the target IP whenever
we want to load a module.
So that we are.
As you can see, that's going to set RHOST
and it's going to set the target IP for every module
that we load.
The next thing we're going to do is
we're going to perform an Nmap scan and store
the results directly into the Metasploit framework database.
And as we've already explored, this
can be done by using the db_nmap command.
We're going to perform a SYN scan and then
some service version detection, as well as some operating
system detection.
And we're going to paste in the IP there.
And that is going to start the Nmap scan
and it'll actually store the Nmap scan results directly
into the Metasploit framework database
in our current workspace.
So we'll be able to analyze the results directly
from MSFConsole.
So I'm just going to wait for the Nmap scan to complete.
All right, the Nmap scan is complete.
And as you can see, we have the Rejetto HTTP File Server
version 2.3 running on port 80, as well as
a few other services.
From the Nmap scan, we're also able to deduce the target
operating system.
And in this case, we can see it's
running Windows Server 2008 R2, which again,
is very important when we will be specifying the Meterpreter
payload and the platform that we want to utilize
with the Meterpreter payload when again,
utilizing the exploit module.
Now that we have an idea of what HTTP File Server is running
on the target system, as well as the version,
we can search or perform some vulnerability
scanning directly through MSFConsole by saying Search
and then specifying the type of a module.
And the type is going to be an exploit module.
We can then specify the name, which in this case,
is going to be Rejetto.
So we're going to say Rejetto There we are.
Hit Enter.
And as you can see, we get the appropriate exploit module.
And we can again, confirm that by utilizing it.
So I'm just going to copy the module name here.
And we're then going to say Use, paste it in there.
And if we show the options here, you
can see that it allows us to specify the target IP, which
is already done because we set up
the global variable for the RHOST option.
And if you want to learn more about this particular exploit
module, you can type in the Info command.
And as you can see right here under description,
you can see it says Rejetto HTTP File Server, also known as HFS,
is vulnerable to a remote command execution
attack due to a pour rejex in the file ParserLib.pas.
This module exploits the HFS scripting commands
by using the null byte to bypass the filtering.
This module has been tested successfully on HFS 2.3
over Windows XP service pack 3, Windows 7 service pack 1,
and Windows 8.
So this falls within the actual category of operating systems
as a Windows Server 2008 was released
in between the releases of Windows XP and Windows 7.
So in order to execute this particular exploit module,
we can actually specify the target IP and the target port,
which is done.
If we try and access the port 80 within our browser just
to confirm that we indeed have HFS running,
which I'll do right now-- so I'll paste in the IP in Firefox
here--
as you can see, this is running HTTP File Server 2.3,
and it is running on port 80.
What we need to do now is, of course, set our payload.
So the payload that we are going to be utilizing
is the Windows Meterpreter Reverse TCP
payload, as we require a payload because one is not
specified by default. If we try and run
this particular module as is--
give that a few seconds--
you can see that it automatically opens up
a Meterpreter session.
And the reason for that is fairly simple,
and I'll get to that in a second.
But we get a Meterpreter session on the target.
So if I type in sysinfo, you can see
that this is a Windows Server 2012 R2 box,
contrary to the Nmap scan results
that were giving us an option between Windows Server 2008
and Windows Server 2012.
So irregardless of that, we were still
able to obtain a Meterpreter session
without specifying a payload.
The reason that was the case is because, as you can see here,
we have two options that we can specify for this module.
This is the local host to list it on.
This must be an address on the local machine that's used
to deliver the actual payload.
So we can actually change the actual type of payload
that we're utilizing based on the operating system
architecture we want.
So if I terminate this Meterpreter session--
if I say Exit and then set the payload
to windows/x64/meterpreter/reverse
tcp and show the options now, we can then set the LPORT
and the LHOST options.
And the LHOST option is going to be your IP address, your Kali
Linux IP address.
And then you can specify any open port on the Kali Linux IP
to listen for the connection.
We can then hit Run, give that a few seconds to open up
the Meterpreter session.
And if we type in sysinfo, you can now
see we have a 64-bit Meterpreter session as opposed
to previously, when the default payload specified was
the 32-bit Meterpreter payload.
So again, you can always customize
the payload you use for every exploit module based
on the target operating system, as well as the architecture.
All right, so that is how to exploit a vulnerable HTTP File
Server.
And this will conclude the practical demonstration.
In the next video, we are going to be exploring
the process of exploiting the EternalBlue
vulnerability on Windows, which is an SMB exploit.
So I'll see you there.