[ELECTRONIC NOISES]
Exploiting a vulnerable SMTP server-- in this video,
we're going to be taking a look at how
to exploit a vulnerable SMTP server running on a Linux host.
And of course, this is going to be
facilitated through the use of a Metasploit framework
exploit module.
Now, we already explored SMTP as a protocol
in the enumeration section.
However, I'll give you a brief introduction
if you're not familiar with SMTP yet.
So SMTP stands for the Simple Mail Transfer Protocol.
It is a communication protocol that
is used for the transmission of emails,
so for the sending of emails.
Now, SMTP utilizes TCP port 25 by default.
However, it can also be configured to run on TCP port
465 and 587.
So you may come across SMTP servers that are running
on both port 465 or 587.
So you need to be cognizant of that,
that you may again run across or come
across SMTP servers configured to run
on the other ports, namely 465 and 587.
However, in most cases SMTP is going to be running on port 25.
Now in this video, we are going to be
taking a look at how to exploit the Haraka SMTP server.
"Haraka" is a Kiswahili word that essentially means "fast."
And in this case, it actually makes a lot of sense
because Haraka is an open-source, high-performance
SMTP server that's developed in Node.js.
Now the Haraka SMTP server comes with a plug-in for processing
attachments, and the Haraka versions prior to 4.8.9
are vulnerable to command injection.
So we can utilize a Metasploit framework
exploit module to take advantage of this vulnerability.
And of course, in this case, the target
needs to be running Haraka SMTP, more specifically the version
or any version prior to version 2.8.9.
So let's take a look at how this can be done within the lab
environment.
So you can spin up the lab environment.
And, again, we'll be able to take
a look at how we can go about exploiting a vulnerable SMTP
server.
So I'll spin up my lab environment,
and I'll see you within the lab environment.
So I'm currently within the lab environment.
And the first step, of course, will
involve identifying the target IP address or the IP
address of the target server.
So you can do you can identify the target IP
address by typing in ifconfig and then heading over
to the interface ethernet 1.
And of course, right over here we
get our current Kali Linux IP address.
So the target IP address is going to be on the same subnet.
And instead of 2, it's going to be 3.
So in your case, the subnet is going to be different.
However, all you need to do is just change the 2 to a 3.
And that's the IP address that the target server
is going to be running on.
So we're going to copy that.
And then we want to make sure that the PostgreSQL Database
Service and server is started so that we
can interact with the Metasploit framework database.
So we're going to start that up.
And then we're going to start up the Metasploit framework
console.
So we're going to give that a few seconds.
That started up.
We can now create a new workspace.
And we are just going to call it "haraka"
because we're targeting the Haraka SMTP server.
So we're going to Enter.
I'm now going to set up the global variables
for the rhost option.
So I'm going to set that to the target IP.
So we'll switch the 2 to a 3.
And we'll also set the global variable for the rhost option.
So we're going to say rhost, paste in the IP address
and, of course, change that to a 3, hit Enter.
And now we need to actually perform
an Nmap scan on the target server
to identify where the SMTP is currently running.
And consequently, we also need to verify
that the correct version or the vulnerable version of Haraka
SMTP is running on the target server.
So we'll do this by running an Nmap
scan from within the Metasploit framework console.
This can be facilitated through the use of the DB Nmap command.
And, again, in this case, we are just
going to perform a service detection scan as well
as an operating system detection scan.
We paste in the target IP, change that to a 3,
and we hit Enter.
And the DB Nmap scan or the DB Nmap command
will essentially save all of the Nmap scan results
into the Metasploit framework database, which
again will allow us to analyze the scan results whenever
we want to.
So as you can see, the target is running SMTP on port 252.
And the actual service version is Haraka SMTPD 2.8.8,
which as we falls within the parameters
that we specified earlier in the slide.
So anything prior to 2.8.9 is vulnerable.
So now that we've identified that we can actually clear out
the terminal, and we can search for the exploit module that
can allow us to take advantage of the vulnerability.
So we are going to search for the Haraka module.
And in this case, we're going to again specify
the type as exploit.
And then the name can be haraka.
There we are.
That's the actual exploit module there.
As you can see, the rank is excellent,
and the description tells us that this
is the Haraka SMTP command injection exploit module.
So we're going to copy that and say use.
We now want to show the options here.
As for the options, we need to specify a few important options
like the server host and the server port
as well as the email too.
So, again, this is just going to be a sample or a test email
to send to.
And we need to specify the actual test email send address.
And of course, this must be accepted by the server.
In our case, we already have one,
and I'm going to, again, tell you what it is.
You can see that the rhost option is specified here
because we set the global variable.
And the rport option is also specified correctly
as the default SMTP port, which is port 25.
We now need to set a few options.
The first option that we want to set
is the server port, which we will set to port 9898
because, again, we are going to need that port.
So we're going to say set, and we're
going to set the server port to port 9898.
Once that is done, we want to set the email_to value
or the email_to option.
And the email that you want to use in this case
is root@attackdefense.test.
We hit Enter.
We then want to set the payload that we want to utilize
or the payload that we essentially
want executed on the target system once the exploit is run.
And in this case because the target system is a Linux
target, we are going to utilize the payload
linux/x64/meterpreter.
And instead of using a staged payload,
we are going to be utilizing a non-staged payload.
So we're going to say reverse, and we can use the reverse_http
payload.
We then need to set up the rhost option, which
we have done already.
And we then need to, of course, set the LHOST option, which
is going to be our IP.
So if I say show options, the payload
requires the LHOST option.
And the reason we changed the server port to 9898
is because this payload will require the port 8080.
So we'll set the LHOST IP address here
to the ethernet 1 interface IP, which we've done.
There we are.
We specify ethernet 1, and it sets the IP address
automatically for us.
And all we need to do now is just type in run
and give that a few seconds.
As you can see the exploit, completed successfully,
and we get a Meterpreter session.
And of course, this is a non-staged payload,
or a stateless payload.
So we should be able to get the Meterpreter
session in a few seconds.
So we get the Meterpreter session.
So we can type in sysinfo and give that a few seconds.
There we are.
As you can see, this is an Ubuntu 16.04 Linux system,
and the kernel version is 5.4.0.
We can get our current privileges by typing in getuid,
and that will enumerate our current permissions
on the target system.
And as you can see, we get the user ID of 0.
Or the user ID value is 0, which means
we have root access which essentially means that we have
the highest privileges available on the Linux target which
consequently means we do not need to elevate our privileges
or perform privilege escalation.
So that is how to exploit an SMTP server.
And in this case, we have explored
the process of exploiting the Haraka SMTP server.
So that is going to conclude the practical section
of this video.
So as I said, that's how to exploit a vulnerable SMTP
server.
We have now concluded or completed
the exploitation section of this course.
So we have explored the process of exploiting services
on both Windows and Linux and can now
move on to the post-exploitation section.
We will be taking a look at how to utilize Meterpreter
as well as exploring the various post-exploitation techniques
that we can utilize on both Windows and Linux systems.
So I'll see you there.