[MUSIC PLAYING]
Vulnerability scanning with Metasploit-- in this video,
we will be exploring the process of performing vulnerability
scanning and detection with the Metasploit Framework,
very similar to what we did with the Nmap Scripting Engine,
the main objective being to essentially
be able to identify services that are running
on open ports on a target system and consequently
identify or detect vulnerabilities
within those services.
Now, I've already explored how to perform
this process in depth within the Metasploit Framework course.
So if you want to learn more about how
to perform vulnerability scanning with Metasploit,
definitely check out that course.
However, in this particular video,
we will be exploring a simple example of how a penetration
tester can utilize the Metasploit Framework to detect
a vulnerability on a target system.
So again, we'll just dive straight
into the actual practical demonstration.
Now, this video doesn't have a lab environment attached to it.
And the reason for that is primarily
because I will be focusing on techniques
as opposed to replication of techniques because, as I said,
I've already covered this.
And all you really need to take note
of is the actual flow or the techniques
that you can use in conjunction with the Metasploit framework
to essentially detect vulnerabilities.
And of course, you are going to be
faced with different types of services
whenever you're performing a penetration test.
So all you really need to know how to do
is to essentially replicate the techniques that I
will be performing.
So I'll switch over to my Kali Linux VM,
and we can get started with the practical demonstration.
All right, I'm back on my Kali VM.
And I'm going to be performing an Nmap scan first and foremost
on the target system.
The target system, we really do not know much about it other
than its IP address.
So we can get started with that.
So what I'll do here is I'll just
perform an Nmap scan to learn as much information as possible
about this particular target.
Right?
So we can perform a SYN scan.
So that is SS.
And we can then perform a Service Version Detection
scan here.
And the target IP, in my case, is 10.10.10.7.
All right, I can also output this into an XML file
so that I can import it into the Metasploit Framework.
But that will really not be applicable at this point
in time.
So, I'll just hit Enter.
And let's see.
The scan will begin, and this is going
to take a few seconds to a couple of minutes.
So I'll just wait for the scan to complete.
All right.
So after a couple of minutes, the Nmap scan is done.
And we can see that it has the typical ports you'd associate
with a Windows system.
And indeed, on the SMB port, which is port 445,
we can see that it prints out the actual operating system
banner, or it gives us a rough idea
as to what operating system is running on the target.
And in this case, we do know that it is Windows.
However, in the case of the SMB banner or the service version,
it really doesn't give us a concrete version of
or edition of Windows.
It just says from Windows 7 to 10.
However, if we take a look at the service info,
we can see that as for the hostname,
the system is called Windows 7-PC.
So we have a good idea of what version of Windows
is running on the target.
Now, how do we utilize this information in conjunction
with the Metasploit Framework?
Well, if we take a look at the vulnerabilities that
affect Windows seven, or maybe older versions of Windows
or Windows versions prior to Windows 7,
we are aware of a vulnerability or exploit called EternalBlue
that essentially targets SMB version 1
and allows an attacker to execute arbitrary code,
which can consequently provide them with remote access.
And of course, we can learn more about this particular exploit
by using the searchsploit utility.
So we can say searchsploit, and we
can launch a search for the EternalBlue exploit.
And if we click on it, we can see that it provides us
with three options here.
You can see we have Microsoft Windows 7 and Windows Server
2008 R2.
And that's exactly where we are.
And it gives you a description as to what
this particular exploit does.
So it's codenamed EternalBlue.
And of course, I've covered the EternalBlue
exploit multiple times.
So you should be fairly familiar with it.
So this is SMB Remote Code Execution.
This is the Microsoft security or vulnerability identifier.
So that is MS17-010.
And it was released or made public in 2017.
And of course, if you take a closer look at the results
here-- and I'm just going to zoom out a little bit here
so you can actually see the actual output displayed much
more clearly--
you can see that, for specific for specific exploits
here, in some cases you may be provided with a Metasploit
option.
Or Metasploit might be highlighted in brackets here.
So what we can do is we can perform the search again,
or we can just say MS17-010, just that
is the Microsoft security identifier.
And we hit Enter.
You can see that we have a Metasploit
module for this particular-- or rather,
we have two Metasploit modules for
this particular vulnerability.
Right?
And of course, I will cover the process
of utilizing searchsploits to essentially fine-tune
your searches.
But for now, the two that we want to take a look at
is this one right over here.
This is the EternalRomance, EternalSynergy, EternalChampion
SMB Remote Code Execution.
That is a Metasploit module.
Or what that indicates is there is
a Metasploit module available for this particular exploit.
And the one that we're interested in here
is the SMB Remote Code Execution Scanner.
All right.
Now why are we interested in the scanner?
Well, remember we're still in the vulnerability scanning
and detection phase of the penetration test.
So before we start throwing exploits at the target system,
we need to verify whether the system is indeed
vulnerable to this particular vulnerability or exploit.
And of course, there is an Nmap script
that can actually be used to verify whether or not
the system is vulnerable to this particular exploit.
But in this case, we're focusing on the Metasploit Framework.
So what we can do is we can open up MSF Console.
So I'm just going to say msfconsole.
And I'll zoom in here so you can see what's going on.
And let me just wait for the Metasploit Framework console
to start up.
There we are.
It's starting up.
And I'll clear up the terminal.
And we can now launch a search for that particular module.
Now remember, vulnerability scanning and detection
isn't exploitation.
We're simply trying to identify whether the target is indeed
vulnerable to a particular exploit.
And in this case, as we were able to deduce
from the searchsploit results, the EternalBlue vulnerability,
or exploit if you will, affects the specific version of Windows
that is running on the target system.
However, we can't be sure completely because, again,
in terms of EternalBlue, it really
doesn't state what build number of Windows it affects.
So this is where the whole aspect of auxiliary modules
comes into play.
So we can launch a search for EternalBlue.
There we are.
And it'll provide us with multiple modules.
Now remember, we're not looking for exploit modules
like this one right over here.
That will only become helpful when we
get to the exploitation phase.
We are looking for the auxiliary module.
Right?
So this is the one here.
So as you can see, auxiliary/scanner/smb/smb ms17
0101.
This performs the RCE detection.
So this will tell us whether the target is indeed vulnerable.
And this is very important to run
or to check before you start throwing exploits at a target.
So we can say use--
paste in the module name there.
I can then show the options that are required.
And in this case, the only option that I need to specify
is the target IP address.
So I can say set RHOSTS.
And in this case, the target IP is 10.10.10.7.
There we are.
And I can then hit run.
Give that a couple of seconds.
As you can see, it'll tell you right over here,
the host is likely vulnerable to MS17-010 Windows.
And then it provides us with the actual specific version
of Windows that's running on the target as well
as the architecture.
So it's running Windows 7 Ultimate, Build 7601,
Service Pack 1, and it is 64-bit.
So now that we've confirmed that this target is indeed
vulnerable, we can now move on to the exploitation phase.
Now as I said, I really don't want to cover exploitation
right now.
But again, just to show you that this does indeed work,
I can utilize the EternalBlue exploit now.
So I'll copy that to there.
And I'll say use-- paste that in there.
And I can set the target IP to RHOSTS 10.10.10.7.
I will not change the default payload because it
is appropriate in this case.
This is the 64-bit meterpreter module.
And I can then hit exploit.
However, before I do that, I would still
need to configure the payload options.
So in this case, the payload options
have been set correctly.
This is the Kali Linux IP address, in my case.
And this is the L port, the default L
port that's been specified.
I will not change that because, again, in my case,
I don't have anything, any service that's
currently utilizing port 4444.
So I can just hit exploit.
We'll give that a couple of seconds.
Again, this particular exploit module
will actually run the auxiliary scanner module
to check and verify whether the target is indeed vulnerable.
If it is not vulnerable, then it will not go forward
or will not go through with the actual exploitation process.
However, it's very important to keep in mind
that most Metasploit exploit modules have not
been designed this well in that they will not
check whether the target is indeed
vulnerable before running the actual exploit.
Now in this case, we can see that the exploitation
was successful.
And we were able to obtain a meterpreter
session on the target system.
So I can say sysinfo.
And indeed, you can confirm that the information obtained
from the auxiliary module was indeed correct.
It is running Windows 7, Build 7601, Service Pack 1.
And it is a 64-bit version of Windows 7.
All right?
So that is going to conclude the practical demonstration
side of this video.
All right.
So that concludes the vulnerability scanning
and detection section of this course.
If you want to learn more about performing vulnerability
scanning with Metasploit, you can take a look
at the Metasploit course, as I did cover it quite in depth
within that particular course.
However, now that we've identified
or we've learned how to identify and detect vulnerabilities
on or within services that are running on a target system,
we can move on to the next section,
which will focus on the process of searching for exploits.
And again, we will not be relying on exploit modules
for the Metasploit Framework.
We'll also take a look at how to identify publicly available
exploit code through various legitimate sources,
and of course, how to utilize the searchsploit utility
to search for exploits pertinent to the actual service that
is running on a target system.
With that being said, I'll see you
in the next section of this course.