[MUSIC PLAYING]
Searching for publicly available exploits.
All right, so we've just completed
the vulnerability scanning and detection
section of this course.
And we've taken a look at how to identify and scan
for vulnerabilities on a particular target
or to identify vulnerabilities that affect a service that's
running on a particular target.
Well, what's the next step as a penetration test?
Well, the next step is to find and identify
exploit code that can be used to exploit
these vulnerabilities that we were able to actually identify.
Now, why are we actually making or taking
the time to make an entire video on this--
on the process of searching for exploits?
You might be thinking to yourself,
well, all I need to do is just fire up Google
and type in the name of the service as well
as the keyword exploit, and I'll be
able to find what I'm looking for.
Well, there's a few considerations to take.
And in this video, we're going to be taking a look
at some really good exploit databases or sources where
you can find exploits that have been tested and/or verified.
And we'll actually get--
we'll take a look at why that's important,
as well as we'll also be taking a look at a few quick or really
useful tricks that you can use whenever
you're searching for exploits.
All right, so after identifying a potential vulnerability
within a target or a service that's running on the target,
the next logical step will involve
searching for exploit code that can be used
to exploit the vulnerability.
Now, in terms of exploit code, especially when
you're working as a penetration tester,
there's really two sources or two techniques.
You can look for exploit code online,
or you can use locally-available exploit code.
So for example, if you're utilizing Kali Linux or Parrot
OS, you will have access to a locally-stored exploit database
or repository in the case of SearchSploit
or with the Metasploit framework.
However, in this video, we're going
to be focusing on searching for exploits online.
Now, it's important to note that exploit code can easily
be found online if the actual exploit code was made available
by the exploit developer or the individual who, essentially,
identified an exploited the vulnerability.
However, it is important to note that downloading and running
exploit code against a target can be quite dangerous,
especially when you're downloading it
from unverified sources.
Now, you might be thinking to yourself, well,
why is it dangerous?
I mean, I'm just searching for exploit code,
and I then run it on the target.
And it either works, or it doesn't work.
Well, as we've seen over the last 10, 15, 20 years, given
the fact that anyone can set up a GitHub repository,
for example, and then create a script,
or a Python script, a C file, or a batch script,
they can call it an exploit.
And they can essentially describe the fact
that it exploits a particular vulnerability.
However, in some cases, we have actually
seen exploit code being weaponized.
And you might be asking yourself, in what way?
Well, a lot of individuals have actually
created fake or false exploit code
that really doesn't do what it's supposed
to be doing in regards to exploiting a vulnerability
on a service or on a target.
Instead, what it does is it's been set up
to, essentially, act maliciously in that when a penetration
tester or attacker runs the exploit code locally
on their Linux system or their Kali Linux virtual machine,
it then performs malicious activity,
like, for example, compromising the actual attacker's system,
as well as deleting files or deleting the entire file
system.
So we've actually seen this quite a lot.
So it's very important that you actually
get exploit code from verifiable and vetted sources.
Because you never want to be in a position where
you've downloaded exploit code and you think
that it's going to work and you run it against the target,
and it essentially wipes your entire file system,
or even worse, compromises your system.
So it's very important.
And it is recommended to analyze the exploit code closely
to ensure that it works as intended.
Now, this is something that you will learn and become better
at as you move on or as you progress within your pen
testing career.
And you don't really need to be a programmer
to understand what is happening within a particular exploit,
irregardless of the language.
You just need to understand what's happening from a class
and function perspective.
And that is something that you'll become better at.
So in terms of online exploit resources or databases,
there are a handful of legitimate and vetted exploit
databases that you should, essentially,
be using when searching for exploits online.
And that's exactly what we're going
to be taking a look at during the practical demonstration.
So a few of them that I can state within this slide
are Exploit-DB, or the Exploit Database,
which you should be familiar with, if you've actually been
working within this industry.
If you've not, don't worry.
I'm going to be explaining everything.
And then, we have Rapid7.
So now that we have an idea of what we are going to be doing
and some very important considerations when
it comes down to searching for exploit code,
we can actually take a look at some of these sources
and take a look at a few tricks that we can
use to search for exploit code.
So this video doesn't have a lab environment.
As I said, this is more this is going to be really focused
on searching--
the techniques involved during the search for exploit code,
as opposed to actually exploiting a target.
This information will be very useful during the black box
penetration tests that we will be performing
during the Windows and Linux exploitation sections
respectively.
So I'll switch over to my Kali Linux VM,
and we can take a look at some of these sources,
resources, databases, as well as tools.
So I'll see you there in a couple of seconds.
All right, so I'm back on my Kali Linux VM,
and the first resource or database
that we're going to be taking a look at is Exploit-DB.
So I'm just going to open up my browser, which is Firefox,
and we can search for Exploit-DB.
You can just launch a search, or just type in exploit-db.com
and hit Enter.
So we'll give this a couple of seconds to load up.
And Exploit-DB essentially stands for exploit database.
Now, you might be asking yourself, well,
what is Exploit-DB?
Well, it's exactly what its name suggests it is.
It is an online, really comprehensive database
of free exploits or publicly available exploits.
Right now, a few important things
need to be taken into consideration here.
So when I open up Exploit-DB, you
can see that we have a list of exploits
that have just been submitted.
And you can actually see the date right
over here-- the date of submission.
You have the ability to download the exploit code.
You can also click on it, and you
can see this additional sorting and categorization.
You can essentially sort through the type,
whether it's a web app exploit, a Windows exploit, et cetera.
And that can also be fine-tuned by, again,
taking a look at the actual platform column.
And then, you have the author of the actual exploit code.
And you can see that there's quite a lot of exploits here.
So this is what-- this is the resource that I typically
would recommend that you start with whenever you've identified
a vulnerability or you're trying to look
for exploits that can exploit a particular vulnerability.
So as I said Exploit-DB is really
the most comprehensive source or databases of exploits.
And exploit developers themselves actually
submit exploits to Exploit-DB.
And Exploit-DB is actually maintained
by offensive security-- the developers of Kali Linux.
So again, in terms of verification--
we'll actually get into that in a few seconds.
You can see there is a verification filter here
that allows you to only display exploits
that have been verified.
And that's something that's very, very important.
Now, one of the great things about the Exploit Database
is that whenever a malicious user tries to upload exploit
code that is malicious or that is fake or phony,
that exploit is actually rejected
and/or removed later on until it's actually
tested and vetted.
So let's take a look at some of these filters.
So if we click on filters here, you
can see that we can filter by type.
So we can essentially specify the type of exploit.
So we can say dos, local, remote, web apps.
So if we're trying to exploit a target remotely,
then this would typically-- the remote option
is what we would typically be utilizing
in terms of a search filter.
If we are trying to perform privilege escalation,
then we would typically click on local, et cetera, et cetera.
For platform, you can see it's sorted quite
comprehensively in terms of the target platform.
So you can look for Linux, Windows, Solaris, BSD, Unix,
MacOS.
And in terms of Windows, you have the architecture
specified here, which is an additional help.
So for example, if I was only looking
for exploits pertinent to a 32-bit version of Windows,
I can click on that there.
It's then going to process and sort exploit
based on that criteria.
And I'm just going to clear that out,
because I don't need to actually use that filter.
You can then search for exploits released
by a particular author.
That's only useful if you are trying
to identify whether a particular author has improved or has
released a new exploit or an improved version of an existing
exploit.
As for ports, if you're looking for exploits
pertinent to a particular port, maybe for Port 21 for FTP,
you can sort and filter through the exploits
based on the types of exploits-- so based
on the types of exploits or the actual port
that they are actually targeting.
So as I correctly stated, Port 21 is FTP.
And as a result, it only displays FTP exploits.
And of course, these are sorted based on the actual FTP
version or the actual FTP solution
that they are pertinent to.
You also have the ability to utilize tags.
And tags essentially allow you to specify
the type of vulnerability.
Now, this is very different than this particular type here.
But it allows you to sort based on the type of vulnerability.
So for example, if you are trying
to look for a buffer overflow exploit,
you can specify buffer overflow.
If you're looking for--
let's see if we can find that here.
If we're looking for--
I believe-- there we are--
Metasploit framework.
If you're looking for a Metasploit framework
exploit module, you can click on that there.
And it's then only going to display the actual Metasploit
framework exploit module pertinent to the actual service
or program that's being exploited.
So you can then click on and exploit that interests you.
Or if you know what you're looking for in terms
of the service that you're trying to exploit
as well as the service version, you can launch a direct search.
So an example of this would be if I have identified
a service running on a target and the service is
vsftpd 2.3.4.
Now, this is a vulnerable version of vsftpd,
so I'm just going to use this very basic example.
I can say, vsftpd 2.3.4.
And that is going to give me the results.
And you can see that we have two types of exploits,
and you also have their dates in terms
of when they were released.
And you can see right over here we
have vsftpd 2.3.4 backdoor command execution.
And then you have the Metasploit module available
that essentially does what this exploit does but just automates
the entire exploitation process.
In terms of the type, these are remote exploits,
which means an attacker could potentially
gain remote access to a target through the use
of this particular exploit.
The platform is Unix, and we have two different authors.
One of them, of course, is Metasploit,
which is going to be verified.
Now, again, if you want to make sure
that you're only using verified exploit code,
you can click on verified here.
And in that case, it will only display verified exploit code.
Now, if you take a look at these three columns here,
we have download exploit-- that allows you to directly download
the exploit code.
You then have vulnerable application.
Now, what is this used for?
Well, this is a fantastic piece of functionality
that allows you to download the affected version of software
or the affected service, essentially,
for testing purposes.
So for example, if I wanted to test out this exploit,
it provides me with the actual affected version
of vsftpd, which in this case is 2.3.4, which I can then install
and run the exploit code against to perform
local testing to ensure that this particular exploit does
indeed work.
So I can click on the actual application here.
You can see that vsftpd 2.3.4.
I can then build, and compile it, and install it,
and I can then test the exploit against it.
This is a fantastic resource for beginners and anyone
who is learning about penetration testing.
You can essentially test out all of these exploits
by installing a vulnerable-- the actual affected version
that this exploit targets, run the test, see if it works,
get an understanding of what's going on, modify the exploit,
learn about it, so on and so forth.
And of course, you have the ability to click on Has App
to only display the exploits that
have the actual, available, vulnerable application.
So I can just get rid of that.
And for example, if we were interested
in the manual exploit code here, I can click on it.
And we'll give this a couple of seconds.
And this is the exploit code page.
So it will give you a basic description.
It'll tell you whether it's been verified
by the exploit database.
It also has a unique exploit database ID.
This will come in handy when we will be utilizing SearchSploit
in the next video.
You then have the ability to view the exploit raw
or download it directly.
And again, if it does have a vulnerable application,
it'll also be displayed here.
Now, as you can see, it displays the exploit code here.
And you can pretty much tell that this is a Python exploit,
as you can see the actual environment variable
or the interpreter has been specified there.
It gives you a description right over here
that's pertinent to this particular exploit,
like the CVE, where it's been tested on,
et cetera, et cetera.
So as a penetration tester, given the fact
that this has been verified and we
have the exploit code available to us,
we can click on Download.
And there we are.
It will actually give us--
the actual exploit name will directly
correspond to the exploit database ID.
As I said, that's something very, very important.
So I can then save the file and launch it or run it
against the target.
So that is the Exploit Database.
Now, the Exploit Database is not just limited to exploits alone.
, You can see that if you navigate to the actual sidebar
here you also have your Google Hacking Database,
which contains a series of Google Docs or Google search
filters that allow you to, essentially,
search for affected websites or services that are publicly
exposed.
But we'll not go through this right now.
That is something that we'll cover later on.
You can also take a look at the SearchSploit manual
right over here.
That'll give you an understanding
of how to use the SearchSploit.
You then have the ability to search Exploit Database, which
we've gone through.
And you also have the ability to submit exploits.
And of course, this is something that you'll probably
do once you've actually progressed with your career.
All right, so that is how to search
for exploits on Exploit-DB.
As I said, it's fairly simple to,
essentially, search for and identify
what you're looking for.
One thing that I want to cover is the actual Metasploit
module.
Now, if you are clicking on an exploit that is a Metasploit
module, you can see that it's going to be in the Ruby
programming language.
If it is verified, then you don't
need to download this Ruby file and then
load it into Metasploit.
It is already available within the Metasploit framework.
All you need to do is just search for the affected service
version right over here, and the same exploit will be available.
And of course, in the case of Metasploit,
the Metasploit module essentially
automates the exploitation process,
which makes it much simpler.
OK, so that is Exploit-DB.
The next resource we're are going to be taking a look at
is Rapid7.
All right, so I'm just going to run a Google search for Rapid7
here.
And you can see that it's going to open up the actual--
it's going to give you a description of the company.
Rapid7 is the company that currently owns and maintains
the Metasploit framework-- the Metasploit project, as it were.
So the actual Rapid7 website is their company website.
However, you can see that we have the Vulnerability
and Exploit Database.
So if you click on that, you can see that rapid7.com/db.
This is the Rapid7 Vulnerability and Exploit Database.
You have the ability to search for a particular exploit,
and you can specify whether you're looking for a Metasploit
module or a vulnerability.
So as you can see right over here,
this is a curated repository of vetted computer software
exploits and exploitable vulnerabilities.
Technical details for over 180,000 vulnerabilities
and 4,000 exploits are available for security professionals
and researchers to review.
These vulnerabilities are utilized by our vulnerability
management tool, InsightVM.
The exploits are all included in the Metasploit framework
and utilized by our penetration testing tool, Metasploit Pro.
Our vulnerability and exploit database is updated frequently
and contains the most recent security research.
All right, the key thing to note here
is that these exploits and vulnerabilities
have been vetted.
And again, the reason why I'm recommending or suggesting
Rapid7 is it is probably the best
way to identify Metasploit modules or exploits that
have been ported into Metasploit modules,
essentially, to automate the exploitation process.
So if you're finding it difficult to utilize
a manual exploit, like the Python script
that we just explored previously,
then we can essentially look, or essentially try and find,
whether the exploit has been ported into a Metasploit
module.
So again, we can launch the search vsftpd 2.3.4 here.
We'll give that a couple of seconds.
You can see that it returns no results.
We can fine tune that into a module.
And in this case, you can see that it's not
displaying anything there.
However, if we get rid of the actual service version,
it should display some results.
There we are.
So in some cases, you may need to be
very specific with the actual versioning.
You may need to use the version option there or the version
prefix.
And you can see this will display the actual exploit
here--
so vsftpd 2.3.4 backdoor command execution.
It was disclosed in July- on the third of July, 2011.
And this has a Metasploit module.
So we can click on that there.
And you can see, it gives you a description
of the Metasploit module.
The module exploits a malicious backdoor
that was added to the vsftpd download archive.
This backdoor was introduced into vsftpd 2.3.4--
the actual archive-- between the following dates.
And then, it provides you with the actual module options,
which is extremely helpful.
So if you want to use the Metasploit module,
it gives you the actual module name.
It then gives you additional information
regarding how to configure the Metasploit module.
And right over here, exploit, and that is pretty much it.
As I said, this is not just limited
to this particular exploit.
You can also search for EternalBlue, for example.
There we are.
And you can see it gives you the various Metasploit
modules pertinent to the EternalBlue exploit.
And again, the same thing goes for Exploit Database.
If I was searching for EternalBlue and I hit Enter,
you can see that it gives me the actual EternalBlue
exploits here.
And then I can specify whether I only want the verified exploits
there.
And you can see right over here that these
are all the manual exploits that you
would need to execute manually.
So for example, if I click on this one here,
this is a Python script.
And it gives you documentation regarding
how the exploit works and the affected versions of Windows,
as well as where it's been tested on.
And then, it gives you instructions
on how to generate shellcode, et cetera, et cetera.
So these are great resources for looking for exploits.
Now, as I said, you don't really need
to navigate to the websites themselves.
You can also utilize Google Docs to essentially fine tune
your searches with Google.
So for example, I can essentially run the same search
from Google.
So I can-- what I'll do here is, for example, if I'm
searching for vsftpd 2.3.4, I can hit Enter.
And that's a typical Google search.
And you can see, already these results pertinent to Rapid7.
And this is because I've actually
clicked on those websites.
However, I can also fine tune my results.
And you can go directly and click
on exploit, Exploit-DB, exploit GitHub, which
I don't recommend.
As a penetration tester, you should always
be familiar with search engines and how to essentially make
them work to what you're looking for or make
them work exactly how you want.
And that can be done through the use of Google Docs.
So for example, if I only wanted to limit the results to only
show results or to only display results pertinent
to Exploit-DB, I can use the site search filter and say,
I only want you to show me results pertinent
to exploit-db.com.
I hit Enter, and now it's only going to show me results
pertinent to exploit-db.com, which is fantastic.
So I've now narrowed down my search.
And you can see right at the top,
we have the exploits that we just explored previously.
And of course, this works for really any vulnerability.
So for example, I can say openssh 7.2.
Hit Enter.
And you can see, we have the username
exploit right over here, the username enumeration exploit,
and then a few others, like denial of service,
authenticated xauth command injection.
And this way, I am able to find legitimate, verified exploits
you know that I can immediately jump into or essentially
use to essentially test against the target.
So that is how to use Google Docs.
And of course, I'll not go into all
of these search filters that you can utilize
to fine tune your result. But for example,
if I was looking for--
and I'll just go back a step here.
I can also do the same for Rapid7.
So I can say rapid7.com.
Let me talk that in correctly.
That is rapid7.com.
And make sure I correct that there.
There we are.
We also can see this will only display
results pertinent to Rapid7.
And in this case, you can see that this
is the first time you've probably seen Google run out
of search results.
And that's because there really is only one Metasploit module
pertinent to vsftpd 2.3.4.
OK, so that is how to utilize various Google
Docs to essentially limit your results
to the following resources or exploit databases.
Now, as I said, you can also search for exploits that
have been hosted on GitHub.
So I can say site github.com.
However, in this case, you are essentially
firing a gun in the dark.
Because unless you actually analyze the code yourself,
then you really don't know what it's doing.
So you can see in this case, it's very difficult
to find an actual exploit here.
But for example, if we click on this GitHub repository,
the exploit might be legitimate.
And we can click on the Python script here.
You then need to manually go through it and see what
it's doing in the background--
actually see what this code is doing in order
to verify that this is legitimate.
And GitHub isn't a bad source of exploits,
as you will actually see during this course and courses
in the future.
You just need to be sure of what you're running.
And that's something that I want you to take into consideration
as you move forward.
Now, another website that I will end on is called Packet Storm.
So I can just launch a search for Packet Storm here.
Packet Storm really isn't an exploit database.
It is an information security website
that essentially provides you with the latest information
pertinent to new vulnerabilities, exploits, et
cetera.
So you can see right over here, it's
a fairly old website in terms of its design.
But it's extremely useful, at least, in my experience.
So you can see right over here, the recent files.
These are the latest vulnerabilities.
So you can click on it here, on this one right over here.
You can see that it provides you with information
regarding this vulnerability.
And you can then click on Download, for example.
There we are.
And this is just an advisory or information
pertinent to that vulnerability.
Now, as I said, this is a great place for penetration testers
and security professionals if you
are trying to get the latest news on the latest
vulnerabilities that have just been discovered.
You can also subscribe to the actual RSS feed.
If I click on exploits, you can see that it now
provides you with exploits pertinent
to particular vulnerabilities.
The only issue with this is you really--
the actual search filters are quite vague,
and you really can't fine tune what you're looking for.
One of the great features about this website is the tools.
And the Tools section essentially
provides you with various security tools
that you can utilize for penetration testing.
And then, of course, you have white papers
that explain certain vulnerabilities
or may explain certain exploits, which is, again,
another great place to essentially
search for our white papers that essentially
explain how to exploit a particular vulnerability,
for example.
So I could search for EternalBlue.
And I'm just using these two examples, because they're
fairly simple to understand.
So you can see that-- let's click on this one here.
You can see that if we click on Download--
and I'll just show you what this is.
This is a ZIP file.
In terms of its description, you can
see that the EternalBlueC is the EternalBlue suite
remade in C, which contains or includes the MS17-010
exploit, et cetera.
And it contains all the shellcode.
So this is an exploit here.
Now, let's take a step back here.
And let's see this one right over here, which is a write up.
So you can see that this is for the actual Metasploit module.
And yeah, this is the Metasploit module itself here.
So again, this is another resource
that you can essentially take a look at off if all else fails.
However, again, Exploit-DB and Rapid7
are pretty much the best resources
to get started with as a beginner.
All right, so that is going to conclude
the practical demonstration side of this video.
In the next video, we will be exploring
the process of searching for locally-stored exploits
through the use of the SearchSploit utility.
So I'll see you there.