[MUSIC PLAYING]
Linux Post Exploitation Modules--
welcome to the Linux post exploitation
section of this course.
Now that we've covered the process of performing post
exploitation on Windows systems, we
can begin exploring the various post exploitation
techniques that we can perform on Linux systems.
And first and foremost, we're going
to start off by taking a look at the various post
exploitation modules available for the Linux operating system,
or rather, the Linux kernel, right?
So first and foremost, what are we trying to do here?
What's the objective with these modules?
Well, similarly to the Windows video,
what we're trying to do here is to enumerate
as much information as possible from the Linux target system.
And of course, we're not really performing service enumeration
before exploitation.
When we obtain access to a target system,
and in this case, a Linux target,
we can utilize that access to enumerate more information
about the target that we otherwise couldn't.
So we can enumerate the users that
are on the system, the groups.
We can identify the kernel version, the distribution
release version, et cetera.
And we can utilize the various Linux post exploitation modules
afforded to us by the Metasploit Framework
to enumerate the system configuration,
to enumerate environment variables,
enumerate the network configuration
on the Linux system.
We can also check as to whether the target system is indeed
a virtual machine.
And we can also enumerate the user history for the user
that we currently have access to.
And of course, that just involves downloading the bash
history file.
And we can get an idea of what commands
the user accounts on the system have been typing in.
So again, there's a lot that we can do.
And as I said, this is fairly similar to the Windows video
with a few exceptions, of course,
because Linux is slightly or quite a bit different
in terms of the way it's developed and its architecture.
So again, that's what we're going
to be exploring in this video.
So all you need to do is just fire up the lab environment.
And I'll see you within the lab environment,
and then we can get started.
All right, so I'm back within the lab environment.
And the first step in this case is
to identify the target IP address
because we need to gain access to the Linux target.
So we're going to type in ifconfig.
There we are.
And we'll head over to the Ethernet 1 interface.
And the target IP address is going
to be on the same subnet on the next IP address.
So again, in your case, the subnet will be different.
And again, all you need to do is just copy this IP.
And of course, the target IP address
will be on the third IP address.
So you just copy the subnet or this IP address
here and change the last value to a 3.
All right, I'm now going to start up
the PostgreSQL Database Service as well as msfconsole.
So I'm going to say service Postgresql start
and msfconsole.
That will save us a little bit of time.
There we are.
And the reason we're starting the PostgreSQL Database Service
is so that we can interact with the Metasploit Framework
database and consequently save data within our workspace
and within the Metasploit Framework database.
All right, now that we're within msfconsole,
we can create a workspace.
And I'm just going to call this workspace Linux,
or we can just call it-- yeah, we'll
call it Linux post exploitation.
So Linux_PE, there we are.
And we'll then set the global variable for the RHOSTS option
to the value or to the IP address of the target.
So again, just paste in the IP and change the 2 to a 3
and hit Enter.
All right, now that is done, we actually
need to perform an Nmap scan on the target system
to identify what services are running
and consequently what vulnerable services
we can actually exploit in order to gain initial access.
All right, so I'm just going to use the db_nmap command
to perform the Nmap scan from within msfconsole
and consequently save the Nmap scan results in the Metasploit
Framework database.
So I'll perform some service version detection.
And I'll just paste in the IP address of the target.
There we are.
And I'll hit Enter, and I will give this
a couple of seconds to a couple of minutes to complete.
All right, the Nmap scan is complete.
And as you can see, we have SMB running on the Linux target.
And it's running SMB version 3.
And of course, we've explored how
to exploit Samba in the previous sections
where we were covering Linux exploitation.
So it's fairly simple to exploit.
In this case, we will be utilizing
a Samba exploit module.
I'm just going to say search, and we
can specify the type of module or limit the results to exploit
modules and then say samba.
And we'll be utilizing the is_known_pipename exploit
module.
There we are.
Let me just zoom out here so you can see that.
So we're going to be utilizing this module here.
And I'm just going to say use.
Paste that in there.
And we really don't need to configure much.
The only option you need to configure
is the target IP address, which should be set because we set up
the global variable for RHOSTS, and we set it to the target IP.
And we then have RPORT.
We don't need to change the payload.
It'll probably give us a command PowerShell session.
So again, we can upgrade that to a meterpreter
session in a few seconds.
So I'm just going to type in exploit.
All right, so we get a command shell session,
as you can see here.
And we can type in a command like pwd
to print our working directory.
And as you can see, we actually are in the temp directory.
So I'll put this in the background using the Control
and Z keyboard combination.
There we are, background session.
If I list out the sessions, you can see that we have session 1.
And that is a command shell session.
There we are.
So we want to upgrade this to a meterpreter session.
So we'll use the sessions command.
And we'll say -u to upgrade.
And we specify the session ID, which is 1.
And that's going to give us a meterpreter
session on the target system.
So we'll give that a couple of seconds to complete.
There we are, meterpreter session 2 opened.
If we list out our sessions, we can see it right over here.
So we have a meterpreter session on the target.
So if we say sessions 2, there we are.
And we now have access to the target system via meterpreter,
right?
So we can, firstly, start off with some local enumeration
using the meterpreter session as well as a native shell session
on the target system.
So again, we've explored the fundamentals
of using meterpreter.
So we can type in sysinfo to get some basic system information
like the target IP address or the host name
as well as the operating system.
In this case, the target is running Debian 8,
and the kernel is 5.4.0.
The architecture is 64-bit, and our meterpreter session
is 32-bit, which, again, is fine in this case.
All right, we can also get our current user
ID or the current user that we have access to.
And in this case, it says the user ID
is 0, which on Linux means that we are the root user.
So again, that's some basic enumeration with meterpreter.
Now, we can perform most of the local enumeration on a Linux
system by typing in shell to give us
a native terminal on the system.
And in this case, we can spawn a bash session by typing
in /bin/bash -i.
There we are.
So we get a bash session.
And as you can see, we have root privileges.
So in this case, we don't need to elevate our privileges.
But again, we'll be covering that when we get there.
So you can type in whoami to identify the user that you
currently have access to.
And again, in this case, it tells us its root.
If you want to list out the other user accounts
on the system, that can be done by typing in cat /etc/passwd.
There we are.
As you can see, we have various user accounts on the system,
like for example, let's see--
in terms of user accounts, we have only the root user.
The rest of them look like service accounts
apart from maybe a few.
But yeah, they all look like service accounts
with no home directory.
So the service accounts are primarily
used to manage services like the web server,
as you can see, for www-data, et cetera, et cetera, right?
So that's how to enumerate the actual users on the Linux
system.
You can find out what groups your current user
is a part of by typing groups and then the name of the user.
So in this case, we can see that the user root
is part of the root group, which, again, makes sense
because the root group is used to assign
administrative privileges to members of that group.
And in this case, we don't have any other users.
Now, if we want to enumerate the actual distribution release
version, we can type in cat /etc/*issue.
Make sure you specify the asterisk there.
And in this case, it says Debian 8.
There we are.
And if you want to get the kernel version,
we can say uname -r.
And as you can see, it'll say 5.4.0.
We can also uname -a command to get additional information
like the host name, the kernel version,
as well as some additional information
like the architecture there.
All right, now, if you want to perform some network
enumeration, you can type in ifconfig.
In this case, it'll tell you that ifconfig is not found.
So we can use the ip a s command.
And that will list out all the interfaces
on the target system.
And as you can see, this is the primary network interface here.
So that's Ethernet 0, right?
So you can get the actual subnet here
if you're performing pivoting.
So that's how to do it.
We can also list out the various services that are currently
listening on open ports.
There we are, so netstat -antp, and in this case,
it says that netstat is not found.
So again, in this case, because we cannot utilize netstat,
we'll have to skip through that.
If we want to list all the processes on the system,
we can use the ps aux command.
And these are all the processes on the system.
As you can see, it sorts them based on the user, the process
ID, CPU and memory consumption, as well as the actual start
time and the command or the binary that's been executed.
We can also enumerate the environment variables
by typing in env for this particular user.
And as you can see, these are all the environment variables
for the root user.
So it tells us the actual path that it
will use to look for binaries, in this case.
And then the working directory is
set to the temp directory for some reason.
The home directory is set to root,
which makes sense, et cetera, et cetera, right?
OK, so that's some local enumeration
within a Linux terminal.
Right now, let's take a look at the various Linux post
exploitation modules that we can use.
So I'm going to terminate this channel.
And I will then--
as you can see, the meterpreter session
closed here for some reason.
So I'm just going to upgrade our session once again.
So I'll just say sessions upgrade 1
to get another meterpreter session.
All right, so we get another meterpreter session.
So now it is the session 3.
OK, so that's fine.
So let's explore the various Linux post exploitation modules
that we can use.
The first post exploitation model we can check out
is the enum configs module.
So I'm just going to say search and enum_configs.
There we are.
And I should have spaced that out there.
So I'm just going to say search and enum_configs.
There we are.
So this is a Linux post exploitation module.
And this will gather all the Linux configurations.
So we'll say use and then paste that in there.
Show options.
And we can set this session.
In this case, we'll set the session to session 3
because that's the session ID for the meterpreter session.
And then we'll hit Run.
As you can see, this will get all the Linux configuration
files.
Now, of course, if it fails, that
means that configuration file probably doesn't exist.
So in this case, it enumerates the actual shells
available on the system as well as the authority
certificates, access.conf.
We also have ldap.conf and sysctl.conf,
or system control.conf.
And it then provides you with the actual directory
under which or where you can find this information.
And they're stored in text files.
So again, if you're utilizing the Metasploit Framework
database within your workspace, you can type in loot.
And that will tell you where all of this information is saved.
So if I wanted to identify the shells that are currently
on the system, I can copy the name or the path
to the actual file.
And I can just say cat.
Paste it in there.
And as you can see, these are the shells on the system.
So it looks like we have a Bourne shell, dash, bash,
rbash, et cetera.
And you can do that for the rest of the other configuration
files that have been found and stored.
So that's one of the great things about the Metasploit
Framework database and workspaces
is that it allows you to save your data.
And all of this data will remain even after you shut down
your msfconsole session.
All right, so that is how to gather or enumerate
the configuration files from a Linux system.
Now let's take a look at the Environment Variable Module.
So in this case, I'm just going to say search.
And we'll say env.
And the platform is going to be Linux.
And the module that we are looking for here is
the post/multi/gather/env.
So this will perform--
it will essentially gather the operating system environment
settings or the environment variables, right?
So we'll say use.
Paste that in there.
Show the options.
And again, we'll set the session to 3.
There we are.
And hit Run.
And as you can see, in this case,
it only tells us the actual version of Debian
that's running as well as the kernel
version, so nothing that we haven't
been able to gather so far.
Now, because we couldn't enumerate the network
information, we can actually utilize a module
to do that for us or to automate that for us.
So we can search for the enum_network module.
And of course, that is a Linux post exploitation module
that's used to gather network information.
So we can say use.
Paste that in there.
Show the options.
We can set the session to session 3 and hit Run.
All right, so it's going to begin
collecting all the information.
So it'll essentially try and open up the SSH configuration
file.
That says that the operation failed,
unable to get the data for the network configuration
as well as the routing table.
It gets the firewall configuration, the DNS
configuration, the HOSTS file, the SSH keys,
as well as ifup and ifdown.
So again, if we type in the loot command here,
we can, again, get all of this information.
So this will tell us where the file is stored.
So if we want to enumerate the firewall configuration,
we can just copy the path to the file and say cat and hit Enter.
And as you can see, it tells us that it
tried to open up iptables.
And in this case, it says iptables cannot initialize.
All right, so nothing useful there,
let's try the DNS configuration just
to see what it actually found.
So I'll say cat.
Paste that in there.
And in this case, it says that the actual primary DNS server
is members.linode.com, which means
that this particular target system is being
hosted on Linode, which is quite a bit of important information.
So we get the cloud service provider.
As opposed to AWS, we now know it's running on Linode.
All right, so that's how to utilize the enum network
module.
We can also check for the various protection
systems that have been put in place on the Linux system.
Now, when I'm referring to the protection systems,
I'm simply referring to the various security
features or modules that may have
been enabled, like SELinux, iptables, et
cetera, et cetera, right?
So we can search for the module by saying
search enum_protections.
And I'll type that in correctly.
There we are.
And that's the module there.
So we'll say copy and use.
And if we show the information for this model,
you can see that this module checks whether popular system
hardening mechanisms are in place, such as SMEP, SMAP,
SELinux, PaX, and grsecurity, right?
So this is very important if you are
trying to identify whether the system has been hardened
or whether any system hardening mechanisms are in place, right?
So we can set the session to 3 and then hit Run.
All right, so we can see on this particular system,
it actually has quite a few security mechanisms
in place, like ASLR, SMEP, SMAP, Yama,
iptables for the firewall, tcpdump for traffic sniffing,
as well as Wireshark.
And all of this is going to be saved to your notes.
So you can open up your notes by typing in notes.
And that, again, is where all your important notes will
be stored in regards to information
gathered from post exploitation modules, right?
So whenever a module tells you that the actual information has
been stored in notes, you can access that by typing in notes.
And of course, this is stored within the Metasploit Framework
database.
All right, so that is the actual protections or enum protections
module.
Let's take a look at some system enumeration, right?
And in order to do that, we can search for a module called
enum_system.
And there we are.
That's the actual module there.
So this performs or gathers system and user information,
which can be very useful.
So again, show options.
And if you want to learn more about the module, just
type in info.
As you can see, this module gathers system information.
We collect installed packages, installed services,
mount information, the user list, the user bash history,
and cron jobs.
So this is a very comprehensive module
in regards to the information that it will actually give us.
So we'll set the session to 3.
And we'll then hit Run.
There we are.
So we'll give that a couple of seconds to complete.
All right, so first and foremost,
it gives us the distribution release version as well as
the host name and the kernel version.
And then it tells us that the module
is running as the root user because we
have root privileges.
It then says that the Linux version is stored,
and it provides you with that information.
And it also tells us the user accounts, installed packages,
which may be something interesting.
So let's open up our loot here.
And let's try and take a look at the installed packages
because we weren't able to enumerate that previously,
right?
So we can copy that, and we can say cat.
Display that.
And you can see this will display all of the installed
packages on the Linux system.
And of course, on Linux, you're going to have way more packages
than a typical Windows system.
So again, if we list out the actual loot here,
let's take a look at some of the other information like the disk
information here.
There we go.
Let's cat that out as well.
This should be fairly minimal.
And as you can see here, it actually lists out
the disk information.
And it's sorted.
You can take a look at your storage devices
and the space used and the space available,
et cetera, et cetera, right?
So you can get a lot of information
with this particular post exploitation module.
All right, so that is how to enumerate or perform
system enumeration.
We can also check whether we are currently a VM or a container,
right?
So in many cases, a Linux system or a Linux target
may be a container, a Docker container,
or a Virtual Machine.
So we can check for both of these things.
First and foremost, we can start off
by checking whether this is a container by searching
for the checkcontainer module.
There we are.
That's a Linux module there.
And if we are in a container, then we could possibly
utilize that information to perform a container
breakout, which is an advanced you know exploitation
technique, but it is viable.
So if we show the options here, we can set the session to 3.
There we go.
Session is set to 3.
And we can then hit Run.
As you can see, this appears to be a Docker container.
All right, so that's very, very important, because as I said,
there are many privilege, escalation,
and container breakout exploits or techniques
that you can utilize to essentially break out
of the container and gain access to the host system that is
hosting the Docker containers.
So that can be very useful if you are staging further attacks
on the system.
We can then search for the checkvm module, which we
utilized in the Windows video.
So we utilized this one here.
But now we are using the Linux module.
So I'll copy that.
And we'll say use.
Paste that in there.
Show options.
And we can set the session to 3.
Hit Run.
As you can see here, it looks like that
failed for some reason.
And we weren't able to gather that.
But we do know that the target system is a Docker container,
right?
So we are fairly comfortable there
in understanding what type of system we're dealing with.
Right now, let's take a look at how
to enumerate the user's history, right?
And this can be done by searching for a module called
enum_users_history.
There we are.
And that's the module there.
So this will gather the user history for all the user
accounts on the system.
And in this case, we only have the root user account.
So if we show the options here, we
can set the session to session 3 and hit Run.
And in this case, as you can see,
it's going to try and get the bash history
file or the history file for all these service accounts as well
as the root account.
So you can see it's going through all the history files
here.
And it, first of all, gets the history file
for the root account.
So the history file on Linux essentially
stores a list of command, or it essentially
just stores a log of commands that
have been typed in by the user.
So again, it can be very useful.
And we can again take a look at all of this by saying loot
or by typing in the loot command.
And we can say bash history for root there.
That's the actual file.
So I'm going to cat the content of this file.
There we are.
So we can see what commands the root user typed in.
And as you can see, these are all the commands
that we typed in.
So this module does work.
Now, if the root user had typed in any commands previously,
then we would see them here.
So sometimes, users may paste in or type in passwords.
And you can check the history file to actually identify
those passwords in clear text.
So again, the history file just gives you
a rundown of all the commands that have been
typed in sequentially, right?
All right, so that's how to enumerate the user account
history.
And in regards to post exploitation
and the various post exploitation
modules available for Linux, that's pretty much it.
There are a few others that are used to essentially perform
credential dumping.
But we'll be exploring them in the next set of videos
once we get there.
And yeah, that is going to conclude the practical section
of this video.
In the next video, we will be exploring
the process of elevating our privileges on a Linux system.
So I'll see you there.