[MUSIC PLAYING]
Exploiting a vulnerable FTP server.
In this video, we're going to be exploring
the process of exploiting an FTP server
through the use of a Metasploit framework exploit module.
Now, during the enumeration section of this course,
we explored the process of performing FTP enumeration,
as well as performing a brute force attack.
However, in this video, we are going
to be exploiting an inherent vulnerability within an FTP
service running on Linux.
So now that we've explored the exploitation process
on Windows, we need to turn our attention to the exploitation
process on Linux.
So we are going to be exploring the process of exploiting
services on Linux systems, and we're
going to start off by taking a look at how to exploit
a vulnerable FTP server.
All right, so as mentioned previously,
FTP, also known as the File Transfer Protocol,
is a protocol that utilizes TCP port 21
and is used to facilitate file sharing between server
and client or clients.
It is also frequently used as a means
of transferring files to and from the directory of a web
server.
So as I mentioned, FTP is used to,
again, transfer-- is typically used
to transfer website files to and from a web server,
and FTP can be configured to provide access
to a specific directory.
And in most cases, it's used to provide access
to the actual directory where the website is being hosted,
irregardless of what web server is being utilized.
Now, that's not the only application of FTP,
and again, FTP can be utilized to gain access to a target
system and consequently upload or download
files from that target system.
So in this particular video, we are
going to be exploring the process of exploiting an FTP
service, or an FTP stack or piece of software
called vsftpd.
Now, vsftpd is an FTP server for Unix-like systems,
including Linux systems, and is the default FTP server
for Ubuntu, CentOS, and Fedora.
So again, vsftpd is widely deployed on Linux,
and it's very frequent or you may frequently
run across vsftpd.
Now, the specific version of vsftpd 2.3.4
is vulnerable to a command execution vulnerability that
is facilitated by a malicious backdoor that
was added to the vsftpd download archive
through a supply chain attack.
So in this particular case, what happened
was during the actual release of vsftpd 2.3.4,
an attacker was able to gain access to the vsftpd download
archive, or the actual repository that
hosted the vsftpd binaries and archives
and was able to, again, inject or to set up
a backdoor within vsftpd 2.3.4 and then
uploaded that particular malicious vsftpd package
onto the vsftpd download archive so that legitimate users
were downloading this specific version of vsftpd
with a backdoor.
And again, in this particular case,
the Metasploit framework provides us
with an exploit module that can take advantage of this backdoor
in the specific version of vsftpd, which in this case
is 2.3.4.
So in this lab environment, we're
going to be exploring the process of enumerating
or performing enumeration with Nmap,
discovering the vsftpd service, and then exploiting it
with the Metasploit framework.
So start up the lab environment, and we can get started.
So I'll see you within the lab environment.
All right, so I'm currently within the lab environment.
And as we did previously, the first step
that we need to perform in these lab environments
is, of course, obtain the target IP address.
And in this case, we can type in ifconfig.
And we want to look for the Ethernet 1 interface,
so we copy the IP address here.
And the target IP address is on the same subnet,
except instead of a 2, it's a 3, so it's
going to be the next IP within the subnet.
And of course, in your case, this is going to be different.
All you need to do is copy this IP
and remember to change the 2 to a 3.
That's the target IP.
We then need to make sure that the PostgreSQL Database
Service is started.
So we're going to say service PostgreSQL start.
That's going to start it for us, so
that we can interact with the Metasploit framework database.
We're then going to say MSF console to start up
the Metasploit framework console.
There we are.
So again, we're going to give this a few seconds.
Once that is done, we are going to create a new workspace
and we're just going to call it vsftpd 2.3.4,
because that's the service we're going to be exploiting.
We then want to set up the global variable for the RHOSTS
option, so that we don't need to or don't
have to keep typing in the target IP address.
So again, we change the 2 into a 3,
and that should set up the RHOSTS value in all modules
that we load.
All right, so once that is done, we
can confirm that we're working within the vsftpd 2.3.4
workspace, and we can perform an Nmap scan
with the db_nmap command which can
be used to perform an Nmap scan from within the Metasploit
framework console, and consequently save the Nmap scan
results into the Metasploit framework
database within our current workspace.
So I'm going to perform a SYN scan.
We also want to perform some service detection, as well as
operating system detection, in order
to get an idea of what Linux or what version of Linux
is running on the target.
And then we paste in the IP, so again,
make sure to always change that to a 3, and we hit Enter.
And that is going to begin the Nmap scan,
so we're going to wait for a couple of seconds
to a couple of minutes for this to complete.
All right, so the Nmap scan completes relatively quickly.
And the only service that we have running on the target
is FTP.
And in this case, it's vsftpd 2.3.4.
Again, you can always check back on your scan results
by typing in the services command.
And as you can see, we have it there.
What we can now do is type in the vuln--
or actually list all the vulnerabilities there,
or hit the Analyze or type in the analyze command.
The analyze command may not work in some cases,
as you can see here, and we aren't
able to identify any vulnerabilities like this.
So what we can do is search for vsftpd and hit Enter.
And as you can see, we only have one module for vsftpd,
and that is for version 2.3.4.
And as you can see under the description, that
is the backdoor command execution module,
All right, so we're going to copy that.
And we then going to say use.
So we're going to say use, and that we
provide the module name here.
We can then show the options that we need to specify.
And by default, it'll utilize its own payload.
And again, in this case, we'll be able to test and see
whether that will work.
But the option you need to specify is the RHOSTS option,
and that is done for us because we set up
the global variable for RHOSTS.
And the RPORT is set to port 21, which is the default.
If you want to learn more about this particular exploit module,
you can type in the info command here.
And as you can see under the description,
it says that this module exploits
a malicious backdoor that was added to the vsftpd download
archive.
This backdoor was introduced into the vsftpd-2.3.4.tar.gz,
or the tarball archive, between June the 30th, 2011,
and July the 1st, 2011, according to the most recent
information available.
This backdoor was removed, so it was actually removed
from the download archive.
But again, if any server is running vsftpd 2.3.4,
then this is applicable unless it is patched.
So we can test it by hitting Run.
So we're going to give that a few seconds.
There we are.
It looks like the backdoor service has spawned,
and we get a command shall session opened.
And our current privileges are root,
so that means we have the highest
privileges available on a Linux system, which consequently
means we don't need to perform any privilege
escalation in this case.
So we can hit Enter or type in a command like ls,
and as you can see, that is a command session.
If we want to open up a bash terminal,
we can say /bin/bash -i, and that will open up a bash
terminal on the target system, and now we have access
to the target system through a command shell.
We can also upgrade this command shell to a Meterpreter session
by putting this session into the background.
And that can be done by typing in or utilizing the keyboard
combination Control+Z. That will prompt you to put it
in the background.
We can hit Yes.
And if we list out our sessions now,
you can see that we have the session there.
So we are going to search for the shell_to_meterpreter
module, which will upgrade our current command shell
session to a Meterpreter session,
so we're going to copy that module there
and we're going to paste it in there.
We can show the options here.
As you can see, this is a post-exploitation module,
which again, what that means is it
requires us to already have access to the target system,
and we already or we should already
have an active session on the target system, which we do.
So the options that we need to set,
first and foremost, is going to be the LHOST option, which
is going to be the IP address of the Kali Linux system, which
is the system that we're currently working on.
That is going to be used to receive
the connection from the payload, and then the LPORT,
which is the port that for the payload to actually connect to,
and that has been set to 4433, which is fine.
So let's set the LHOST value, which is the Kali Linux IP.
And we can specify the interface name
instead of looking up the IP address ourselves.
So if we hit an Ethernet 1, you can
see it sets it-- it sets the IP address for the Ethernet 1
interface.
And then we need to set the session ID to session 1,
because if we type in the session--
the actual sessions command, you can see
that the session ID is 1 here.
So we hit Enter, and then we hit Run.
So give that a few seconds.
That's going to start up the handler.
It is then going to send the payload,
and we get a Meterpreter session on the target.
Now, if it gives you this little error here,
don't worry about that.
If we type in sessions, you can see that we still have the--
or we actually have a Meterpreter session opened up
on the session ID 2.
So if I say sessions 2, you can see
that we have a Meterpreter shell on the target,
or a Meterpreter session on the target,
and we can run the various commands that you
can run with Meterpreter.
So the sysinfo command--
the sysinfo command tells us that this
is a Debian system running the Linux kernel 5.4.0,
and we can also get the user ID, which tells us we are currently
the root user, because the user ID is 0,
is in reference to the root user,
so we have root privileges.
So that is how to gain access or how to exploit a vulnerable FTP
server.
And in this case, we've also explored
a post-exploitation module that can
allow us to upgrade our command shell to a Meterpreter
session, which is extremely helpful if you
want a Meterpreter session.
So that is going to conclude the practical demonstration
within this video.
In the next video, we are going to be exploring the process
of exploiting Samba on Linux.
So Samba is the Linux equivalent of SMB,
and it's very important that you know
how to exploit a vulnerable Samba service or a Samba
server, so I'll see you there.