[ELECTRONIC NOISES]
Pivoting with Meterpreter-- in this video,
we will be exploring the process of performing
pivoting once we have compromised
a host on an internal network.
So let's get an idea or an understanding of what
pivoting is exactly in case you might be a little bit confused.
So pivoting is essentially a post-exploitation technique
that involves utilizing a compromised
host to attack other systems on the compromised host's
private internal network.
So after gaining access to one host,
we can use the compromised host to exploit other hosts
on the same internal network to which we could not
access previously.
So the objective here-- or rather,
the technique involves utilizing our compromised host
on one system to then scan and exploit
other systems within the compromised host's
private network.
So the reason I'm saying private network
is because previously we could not access those other systems
because they were part of an internal, private network,
and the IPs could not be accessed
or the IPs were unknown to us.
Irregardless of that, the primary objective
here is essentially to gain access to other systems
within the compromised host's internal network, which
again is pretty important.
So once we have exploited one system,
we need to move on to other systems.
And, again, this is a pretty standard
within penetration testing.
Once you've gained access to a system on a network,
then you'll also want to gain access
to other systems of the network and make your way up
to other systems that may contain other important data
or business-critical data.
So Meterpreter essentially provides us with the ability
to add a network route to the internal network subnet
and consequently scan and exploit other systems
on the network.
And of course, we will be exploring how this can be done.
It really is very simple.
But you need to actually visualize what pivoting
is in order to understand it.
Now, this diagram here gives you a pretty good idea
of what we are going to be doing.
So first and foremost, this is us right over here.
And disregard the actual IP addresses as well as
the network subnets.
Those are, of course, going to change.
But the principals remain the same.
So this is us right over here, and this is victim 1.
So we can access victim 1 because either it's
a public-facing server or a public-facing target.
Or really, we just have the ability
to access it through its IP.
So you can see that attacker and victim 1
are part of the same network.
And of course, that network could be the internet itself.
So if we have access to victim 1's IP address,
the public IP address, then we can interact with it.
And we can then exploit services that are currently
running on victim 1 in order to gain access to victim 1.
So once we have gained access to victim 1,
we can see that victim 1 is part of another network,
an internal network.
You can see this is the internal IP address of victim 1.
And the internal network is listed over here.
This is the subnet.
As you can see, it's different from the public network subnet.
And then as part of the private internal network,
there's another system on that internal network
called victim 2.
Victim 2, of course, has its own IP address.
And if we try to attack victim 2 from the attacker system,
we would not be able to access it because the IP address is
an internal IP.
The only way we can access victim 2
is through the compromised victim
1 system right over here.
So the objective is to, again, gain access to victim 1
and then utilize our Meterpreter session on victim 1 to access
and exploit victim 2.
So it's really, really very simple.
Now, the lab environment, in this case,
will allow us to actually demonstrate
this, which is great.
So all you need to do is just fire up the lab environment,
and I'm going to do the same.
And I'll see you within the lab environment,
and we can explore how pivoting can be performed.
So I'll see you within the lab environment.
So I'm back in the lab environment.
And as you can see, you will be given two IP addresses.
And of course, in your case, they're
going to be different, but just take note of them.
So you can see we have victim machine 1, which
we can access directly because, again, if we copy this
and we open up a terminal and say--
let me just maximize that there.
And if I say ping and if I try and ping victim 1,
you can see that we get a response from victim 1.
And we can also interact with it as it's part of our network.
Or rather, we can actually access it.
So there we are.
We can see that on port 80 victim 1
is running HFS or the HTTP File Server version 2.3.
Now, if we try and access victim 2 or try and ping victim 2,
which I'll do right now-- let me just copy victim 2's IP
address--
you'll see what I'm talking about.
So I'll just head over back into my terminal.
And I'll say ping.
And you can see that we don't get a response.
So we cannot communicate with victim 2 through our Kali Linux
system or through our Kali system here.
So, again, that's a problem.
Now, of course, that's why we are covering pivoting.
So first and foremost, we'll actually
need to gain access to victim 1.
And then we can then attack victim 2.
So I'm just going to terminate the ping there.
And we are going to set up or start up the PostgreSQL
Database Service.
So I'm going to say service postgresql start.
And we'll also start up MSF console while we're at it.
There we are.
And, again, make sure that you keep these IPs handy
here as they will become or will be very
important during this process.
And of course, make sure you're able to distinguish
between the two.
So now that we've started up MSF console,
we'll create a workspace for all our activity.
And we'll just call it pivoting.
There we are.
We will not set up the global variable for rhosts
because we'll be using two IPs.
So we don't need to set up the actual target IP
because, again, we're dealing with two systems here.
So the first thing we want to do is, of course,
perform an Nmap scan on victim 1 to identify what services
we can actually exploit on it.
And of course, we were able to find that it's running HSF.
But, again, let's just perform it in the event
that we weren't able to do that.
So I'm just going to copy victim 1's IP address here.
And I'll paste that in there, and I'll hit Enter.
And I'm just going to wait for this to complete.
So the Nmap scan is complete.
And of course, we get confirmation that on port 80
we have the HTTP File Server which is, again, the Rejetto
HTTP File Server version 2.3, which we've exploited before.
So we're just going to search for the Rejetto module.
So I'm going to say search rejetto.
There we are.
And we're going to utilize this exploit module here.
So that's the remote command execution module.
So I'm going to say copy and use.
Paste the module name there.
We don't need to change the payload at the moment.
And in our case, we really do not need a 64-bit Meterpreter
session.
So if I show the options, we'll now
have to configure the rhosts value manually.
So let's do that right now.
I'm going to set the IP address of victim 1.
There we go.
So I'm going to say set rhosts and put
in the IP address of victim 1.
You can then configure your payload options.
So you can specify the lhost and lport options.
In this case, we'll leave them as the defaults.
And we don't need to change anything
else because the port has been configured
as well as the target URI.
So we know that HFS is running on the root of the web server,
so we don't need to do anything else here.
We just type in exploit, and we should get our Meterpreter
session on victim 1.
There we go, fantastic.
So we can perform some enumeration
to identify the actual operating system version.
And in this case, we can see it's
running Windows Server 2012 R2, and it's a 64-bit operating
system.
As I said, we really don't need to upgrade our Meterpreter
session.
So we've gained access to this system here, to victim 1.
And we now need to utilize our access on victim 1
to gain access to victim 2.
So what we can do is if I type in the ipconfig command,
this will list out the interfaces available to us.
And we know that victim 2 is part of the same subnet
that victim 1 is on.
So we can copy the actual interface IP here.
And of course, in your case it may be different.
But just look for the one that has the victim 1 IP
address here.
So we can copy that.
And we will then now utilize Meterpreter to add a route.
So, again, to add a route is fairly simple.
We can essentially just say run autoroute.
And we then specify the subnet that we
want to establish a route to.
We paste that in there.
And we're going to change this obviously to a 0.
And the network-- or actually, the subnet range
or the actual range of this network is limited to 20.
And we hit Enter, and that's going
to add a route to that network as you can see here.
You have the netmask specified as well.
And as you can see, it says right over here,
added drought to that particular subnet.
So that means we can now access that subnet with MSF console.
And the reason that is the case is
because we utilize our Meterpreter session
to add the route.
So that way, Meterpreter is very intelligent,
and that means we can utilize other modules to scan
the target, or victim 2.
So we'll put this session in the background.
And what I'll do is if I actually list out
the sessions here, I will say sessions.
And of course, we can always rename it.
So if you want to rename a session, all we need to do
is type in sessions.
And then you can specify the actual name
of your session and then, of course, the actual session ID.
So in this case, what I'm going to do
is I'm going to say sessions name,
and then I'm going to say this is victim 1.
And we're going to set the actual ID to 1.
So that's going to rename session 1 to victim 1
so that we can, again, keep track of all our sessions
and what systems they currently represent.
So in this case, that's victim 1.
Fantastic, so now that we have established our route
or added our route, what we can do
is utilize the port scan module to scan
for open ports on the target system.
Now, of course, remember just because we've
added the route doesn't mean that we can actually utilize
external tools like Nmap.
What I mean by that is you can run
Nmap within the MSF console.
But the route will only be applicable to modules
within the Metasploit framework.
So if we use the port scanner, we can say use,
paste that in there, and we then want
to set up the rhosts option to victim 2
because we've added the route.
That means we can now scan victim 2.
So I'll copy that, and we'll paste it in here.
And we're going to set the port range to maybe 1 to 100.
So that'll save us a little bit of time.
And then we can hit run or exploit.
I'm just going to exploit, and we'll
give that a few seconds to complete
the port scan on victim 2.
As you can see, we've been able to identify that on victim 2
we have port 80 running.
So, again, just to prove to you that this route that we've
added doesn't work externally, I can copy victim 2's IP address
and then utilize Firefox and open that up here.
And if I paste that in there, you can see that we still
cannot access port 80 even though we've added the route.
The route is only applicable to MSF console.
So I just want to make that as clear as possible.
So we can now utilize--
we can probably utilize an auxiliary module
to scan or to obtain the actual banner
or to identify the HTTP version.
But that will not work.
And if we want to perform an Nmap scan,
we'll actually need to forward port 80 on victim 2
to a local port or a port on our local host, which
is the Kali Linux VM or the Kali Linux instance.
And the only way we can do that is we
actually have to head over to sessions 1.
And we can perform the port forwarding.
So we are going to say port forward add, and we then
need to specify the local port that we
want to actually, again, perform the port forwarding on.
So if we want to port forward the port 80 from victim 2
onto our local port, we can specify the port here.
In this case, we'll just run port 80 on victim 2
to port 1234 on the Kali Linux system here.
And we then need to specify the port
that we want to forward on victim 2, which is 80.
And then we specify victim 2's IP address.
So I'll just specify the r option,
and I'll copy victim 2's IP address here.
There we go.
As you can see, local TCP relay created.
So, again, just to explain what's going on, because we
cannot perform an Nmap scan on victim 2 directly we need
to set up port forwarding.
Port forwarding essentially allows us
to forward the remote port 80 to our local port
1234, which will again consequently allow
us to perform a service version enumeration.
So I'll put this session in the background now,
and we can now use Nmap.
So I'll use the db_nmap command to perform the scan
within MSF console.
And I'll then say, I want to perform
a -sV scan, service version detection scan, on port 1234
because, remember, we forwarded port
80 on victim 2 our local host or to our port
1234 on the Kali instance.
So we specified port 1234 locally.
And then because we are performing the scan on the Kali
system, we'll say local host because we
are performing the scan on our IP address,
not victim 1 or victim 2.
So I'll hit Enter, and let me just specify
the db_nmap command or let me type it in correctly.
That is db_nmap.
Hit Enter, and then we'll give this a few seconds.
As you can see, it's successfully
scanned the forwarded port.
So you can see on our Kali Linux IP
on port 1234 it provides us with the service version
here for the actual service that's running on victim 2
on port 80.
The only reason we performed port forwarding
is so that we can identify what service is running on victim 2
on port 80.
So now that we know it's BadBlue, which we have actually
exploited before, we can actually
search for the BadBlue exploit.
So I'm going to search for it here.
I'm going to say search badblue.
And we are going to be utilizing the PassThru Buffer Overflow
module.
There we are.
And I'm going to say use.
And of course, you can also verify
this that is the case by navigating to local hosts.
So if I say 127.0.0.1 and 1234, you
should be able to see that we can access BadBlue.
But in this case, it's not rendering correctly
because it's not running on the target system.
We've just performed some basic port forwarding.
So we do know that is working.
However, that's pretty much it in regards to port forwarding.
We now have all the information we need.
So we'll say use the BadBlue passthru exploit.
And we're going to leave--
we'll actually need to change the actual payload to a bind
TCP Meterpreter payload.
So I'm going to set that first.
So I'm going to say set payload because we will actually
want to bind.
So I'm going to say Windows Meterpreter reverse TCP
as a reverse connection will not be possible.
So I'm going to say set payload Windows Meterpreter.
And we're going to say bind TCP, not reverse TCP, so bind_tcp.
Hit Enter.
And if we show the options, we'll
need to change the lport option as well as the rhosts option.
So what I'm going to do now is we will actually
just get that information.
So you should have the victim's IP address here.
So what we'll say is we will set the actual rhosts value.
So I'm going to copy victim 2's IP address here.
So I'm going to say set rhosts to victim 2's IP.
We are, of course, targeting port 80, not
the actual locally forward port because we have the route added
within MSF console.
So we don't need to do that.
I'm going to set lport to a different port
because we currently have-- or we are currently listening
or we currently have a session that's
established on port 4444.
So I'm going to set that to maybe 4433.
And we can then set the target to BadBlue Enterprise Edition.
Or in this case, we can actually just exploit it
and test it to see whether it will actually work.
So it's going to try target BadBlue EE 2.7
Universal, which is great.
And it sends the stage.
And we get Meterpreter session 2 open.
So if we say sysinfo, you can now
see that session 2 is on Windows 2016 or Windows Server 2016.
So it's a different system altogether.
And if I just put this in the background
and I list out my sessions, you can see we have two sessions.
So I can say sessions name, and I can just call this victim 2.
And that is session ID 2.
So that will rename session 2 to victim 2.
And if we check out session 2, we
can see that this is, of course, different.
So sysinfo, you can see Windows Server 2016.
If I put that in the background and I say sessions 1
and say sysinfo, you can see Windows Server 2012.
So that is how to perform pivoting as well
as port forwarding.
And you can see how useful this is or how useful the auto-route
functionality within Meterpreter is and how it can be used
to essentially provide you with access or allow you to perform
or utilize the various Metasploit modules to exploit
systems that we cannot reach, but we can access through
the compromised host that we compromised first,
or rather victim 1 in this case.
So that is going to conclude the practical demonstration
side of this video.
Now that we've taken a look at how
to perform post-exploitation on Windows systems,
we now need to explore how to perform post-exploitation
on Linux systems.
So the next video will be the beginning of the Linux
post-exploitation section, and then we'll
explore the various post-exploitation modules,
techniques, and utilities that we
can use to essentially elevate our privileges on a Linux
system, enumerate information, so on and so forth.
So I'll see you in the next video.