Fixing exploits.
In this video, we're going to be taking a look
at the process of identifying a vulnerability on a target
system or on a service that is currently running on a target
system, how to utilize such exploit to essentially find
appropriate exploit code that can be used
to exploit the vulnerability.
And more specifically or most importantly,
we're going to be taking a look at how to fix that exploit code
to ensure that it runs.
And I'll actually take you through the process
of how to read and analyze what a particular exploit is doing.
So immediately, we'll just dive straight into it.
This particular video has a lab environment attached to it
that will be used to showcase this entire technique,
so you'll essentially see the synthesis of everything
that we've learned so far and how it essentially
comes into play to the point of exploitation
or gaining access to a target system.
All right?
So I'll see you within the lab environment.
All right, so I'm back within the lab environment.
And you will be provided with the target IP
address of the system that we will be gaining access
to or exploiting.
And of course, in your case, it's going to be different.
So our objective is to first and foremost,
identify the vulnerable service that's
running on the target system.
And then furthermore, we need to identify
a relevant exploit that can be used
to exploit this vulnerability.
And of course, we're going to be doing this manually
with ExploitDB exploits.
Once we've obtained or identified the exploit
that we're going to use, we then need to copy it and modify it
in order to make it work.
All right?
So I'll just copy the target IP address.
And the first step will involve performing
an Nmap scan on the target in order
to identify what services are running.
All right?
So I'll just type in nmap and we can form a service version
detection scan.
And we'll perform a default scan in terms of the ports.
And I'll paste in the target IP and hit Enter.
And I'll give this a couple of seconds.
All right?
So the Nmap scan is complete.
And we have various services associated
with a Windows system.
So it looks like the target is running a version of Windows.
We're not really sure, but we do know
that it is running Windows Server,
although the actual version or edition is unknown to us.
We could perform an operating system
scan in order to identify that.
But in this particular scenario, we don't need to do that.
If we take a look at the service that's running on port 80,
we can see that we have a service called HttpFileServer
version 2.3.
So let's see if we can actually access this.
I'm going to open up my browser.
So I'll open up Firefox here, and we'll
navigate to the target IP.
And that is port 80.
So we can see that this indeed is the HttpFileServer.
And information pertinent to the service
is provided right to VSO server information.
You can see the name of the service is HttpFileServer.
And we really cannot click on this link because we don't have
access to the internet through the lab environment.
And this is a prime example or scenario
where you would essentially need to utilize the exploit code
available to you locally.
What we do know, however, is that the HttpFileServer,
also known as HFS, is developed by a company called Rejetto.
All right?
So we can take that into consideration.
We have the actual service name as well as the service version.
And let's see if we can identify any vulnerabilities or exploits
that can be used to exploit this specific version
of HttpFileServer.
So in order to do that, we are going
to utilize search exploit, right?
And we can essentially type in HTTP File Server.
So let's see what that brings up.
So HTTP File Server.
And we can specify 2.3.
There we are.
So it looks like we were able to identify a few exploits here
pertinent to that specific version of HttpFileServer.
And of course, these are all exploits
for the Rejetto HttpFileServer.
So if we take a look at this one right over here,
this affects version 2.3 and any subversion below that.
This is remote command execution.
And this is a Python exploit, right?
It provides us with the actual path to that exploit locally.
So even though we don't have access to the internet,
we can still exploit this system.
So what I'll do is I'll navigate to the desktop.
And what I'm going to do is I'm going
to utilize searchsploit to make a copy of that
exploit within my current working directory, which
is the desktop.
So I'll just specify the ID there.
So that is 39161.
We don't need to provide the extension.
I'll hit Enter.
And a copy of that exploit has been made.
Now, this is pretty much the most important step, right?
We have the exploit.
We now need to analyze it.
Now, you don't really need to know how to program in Python.
All you need to know is what's going on at a very high level.
And in certain cases or in certain scenarios,
most of the exploits are going to be well-documented
and will actually highlight what each step
or what each function is doing.
So if we open up the exploit with Vim
or any text editor of your choice,
I can just open it up like so.
You can see that this is a Python exploit.
It provides you with information regarding this particular
exploit, like the exploit title, a Google Doc to actually find
vulnerable systems that are running
the version of HttpFileServer when it was made public,
whether or not it's remote, the exploit author, software link,
et cetera.
And it'll then give you a description
as to what this particular version of HFS or what HFS
is used for.
So it says right away, you can use
HFS to send and receive files.
So again, we're learning more about what HFS is.
HFS stands for HttpFileServer.
And HttpFileServer is used to share files, right?
And that is facilitated through a web server.
So instead of sharing files via SMB,
you can also share them with an HttpFileServer.
All right?
Now, in terms of the exploit usage,
you can see that the author has provided those instructions.
So we need to run it with python Exploit.py or the name
of the exploit itself, the target IP address as well
as the target port number.
So you might be thinking to yourself,
well, we can immediately just run this, and it could work.
It probably will work.
So let's actually try that, right?
Let's see what the issue is here.
So what we'll do is we'll say python,
and then we can specify the actual Python file there.
The target IP address, we can obtain
by copying from the text or Notepad here.
So we specify the target IP address.
And we know that HttpFileServer is running on port 80,
so we can type that in and hit Enter.
And we can see that nothing really happens.
Well,
The reason that's happening is because we
haven't read or understood how this exploit works.
So let's revisit the exploit once again.
All right?
So if we take a look at the EDB note
here or the exploit database note, so it tells us
you need to be using a web server
hosting Netcat or the Netcat executable for Windows.
And this is pertinent because the target is indeed
running Windows or has a version of Windows Server set
up or installed, so this makes sense.
And it says that you may need to run it
multiple times for success.
So this is very, very important information.
Now, in terms of what's going on,
we can see that right over here, there
is a variable that stores the IP address and the local port.
Now, this already has an IP specified.
This is our local IP address.
And the way this exploit works is
that once the exploit is launched,
it is then going to connect to a web server
that we will set up locally to host the Netcat executable.
That Netcat executable is then going
to be executed on the target system that's running Windows.
And it is going to be used to connect to our own IP
address or our Kali Linux IP address, which in this case,
we need to specify ourselves.
So that's the first thing that we need to do.
So how do we identify our Kali Linux IP?
We can open up a new terminal here and type in ifconfig.
And we are going to be looking for the interface ethernet 1.
And that is going to be our IP address.
So I'm just going to copy that there.
And we can then change this from the author's IP,
that they'd not essentially gotten rid of or changed.
So we will get rid of that there and paste ours there.
And then the local port, this is going
to be the port that we will be listening on with Netcat.
So we can change this to whatever we want.
You can choose to leave it as is.
That really isn't important at this stage.
I'll change it to 1234 for the purpose of simplicity.
All right?
So let me write the changes.
And then we have additional variables
that contain the actual Visual Basic
script that will be used to execute Netcat
or to download Netcat, and then connect to our Netcat listener.
All right?
So we really don't need to change much on that end.
You can see that really all that's happening here
is as I said, it's downloading the actual Netcat executable
from our server.
It then connects to the Kali Linux IP on the port
that we have specified here on our Netcat listener.
As you can see, this is what this Visual Basic
script is doing here.
And it should then provide us with a command
session on the target system on our Netcat listener.
So in terms of modifying the exploit,
this is pretty much all that is required at this point.
Now, as I said, we have an idea of how this exploit works.
So let's actually test this out.
So I'll write and quit.
And what I'll do is I will just minimize that there.
Let me minimize the browser, and let me get rid of that there.
So we have our first terminal, which
I'll just drag right over here.
And we then have our second terminal.
We'll need a few terminal instances
to do what we're going to do.
So I'll just resize that a little bit there.
And I'll also bring this right over here.
And this is where we're going to be launching the exploit.
Now remember, we still need to get the Netcat executable.
Luckily, for us-- let me just expand that one more time--
luckily for us, Kali Linux already
has the Windows Netcat executable available.
So we'll navigate to the desktop because that's
where I'm going to copy it to.
And the Netcat executable is available under the user shared
directory, so I can just copy the executable.
So /usr/share/windows-resources, and we're looking for binaries.
And nc or netcat.exe, it will copy it
to our current working directory,
which is the desktop.
So I'll hit Enter.
If I list out the contents of the desktop--
there we are-- you can see that we have the Netcat or exe
executable as well as the Python exploit, right?
So we have all of that information specified now.
So I'll just minimize that again.
I just wanted to make sure that you saw what was going on.
And I'll just drag this right over here.
And I think that's fine as it is.
I think I'll resize it a little bit here so that it matches
in terms of the tiles, but I think
that's perfectly fine at this point.
OK, so let me just resize that there.
And we're going to need three Windows.
One of them will be exploiting or will
be running the exploit itself as we did previously.
The next terminal is where we will
be setting up our web server to host the Netcat executable.
All right?
So in order to do this, we will be utilizing the Python module
SimpleHTTPServer.
So I'll say python -m SimpleHTTPServer.
And will host the contents of the desktop directory
on port 80.
And of course, this is going to be available via our Kali Linux
IP.
So I'll hit Enter.
As you can see, it says serving HTTP on the Linux IP
on port 80.
So now that is done, we then need to open up a new terminal
session here.
And this is where our Netcat listener
is going to be running, and this is
where we'll obtain our command shell session.
All right?
So let me just resize that so that it actually
fits in properly with what we'll be doing because it's
very important that you actually see all of these Windows
and what output is being generated.
So I'll just zoom in this window here.
There we are.
Fantastic.
And we can set up our Netcat listener.
So we'll say nc -nvlp 1234.
So remember, the port that we're going
to be listening on, we specified within the exploit file here.
So again, if I just open it up, you
can see we specified the Kali Linux IP here.
And of course, in your case, it's going to be different.
And the port that we're going to be listening on is 1234.
So we can then quit.
I'll just quit from the actual exploit file itself.
And we can set up our listener.
There we go.
And within this terminal, we can now execute or launch
the actual exploit.
So we'll say python.
And we can use the previous command
because we had run it previously.
There we are.
So python, the exploit file itself, the target IP
address, and the port on which HTTP file server is running.
So I'll hit Enter.
And you'll see nothing will happen, but give it
a few seconds.
On the web server that we set up,
you should see a few GET requests that will essentially
download the Netcat executable as you can see there.
So it downloads the Netcat executable.
And we should then receive a reverse shell
on our Netcat listener.
However, in this case, we can see that we don't.
And again, that was something that
was highlighted within the exploit itself,
that we may need to run it more than one time.
All right?
So let's do that again.
And let's see if we get a command shell session.
And indeed, we do.
Right away, you can see connection
from the target system.
And we have a command prompt session on the target.
So again, I can say whoami, for example.
And let's give that a couple of seconds.
There we are.
We can see that we have administrative access
on the target system, which indeed is running Windows.
So again, we can learn more about it by saying systeminfo.
And this command usually takes a while,
so I'll just give this a couple of seconds.
All right, so the output is displayed here.
So let's see what version of Windows
is running on the target system.
I'm just going to scroll to the top
here where the output was displayed.
We can see that the target is running Windows Server 2012 R2
standard.
And again, we've been able to gain access to the target
system through the use of a publicly available piece
of exploit code.
And we did not rely on utilizing the Metasploit framework.
The reason I'm saying that is because there
is a Metasploit module available that
automates this entire process.
But this is very important in the context of a penetration
tester because you should be able to utilize exploit code
that's available online or in this case, available
on Kali Linux.
You should be able to modify it based on your own parameters
and environment.
And in terms of executing it, as you saw,
we needed to run it more than one time.
Again, this is very important because it gives you
a holistic view of exploitation rather than just relying
on an automated exploitation framework like Metasploit.
All right?
So that is going to conclude the practical demonstration
side of this video.
In the next video, we will be exploring the process
of compiling exploits.
And we're going to be taking a look
at how to compile both Windows exploits as well as Linux
exploits.
And the reason for this is primarily
because in certain cases, the actual exploits
available on ExploitDB might be in a language like C that
requires them to be compiled into a binary,
and then executed, as opposed to the example
that we just saw during the practical demonstration, where
the exploit that we used was a Python script.
So again, this is also something that's very important.
And I'll see you in the next video.