[GLITCHY MUSICAL SOUND EFFECTS]
Port scanning and enumeration.
So welcome to the first section of the first video
within the Windows Black Box Penetration Test.
In this specific video, we're going
to be taking a look at performing
port scanning on the target system, identifying open ports
as well as the respective services that
are running on those ports.
And we'll take a look at how to sort all of this data,
or all of the data that we're getting from the port scans,
and how to import them into the Metasploit framework
for ease of access.
And also, we'll take a look at some basic enumeration.
The objective here is to learn as much information
as possible from the services that are running on the target
system, as well as more information regarding
the exact version of Windows Server 2008 that is running
on the target system.
So as I said, in this entire section of Windows
exploitation, you'll essentially be given access
to one lab environment, or rather
the same lab environment.
So you don't have to start and stop
the lab environment after every video
that I'll be going through.
You can essentially just start up one instance
and then follow along, or you can go through and essentially
try and gain access yourself with everything
that you have learned so far.
So these videos are essentially just going
to be references for you to--
if you're finding something difficult,
then this is where I'll be coming in.
So let's get started.
So all you need to do is just fire up the lab environment.
And I'll also do that.
And I'll switch over to my lab environment,
and we can get started.
All right.
So I'm back within the lab environment.
And as you can see, you're not going
to be provided with access to the target
system via the additional tab at the top.
You're also not going to be provided with the target IP
address.
So again, that is something that we'll have to identify.
Now, given the fact that this lab environment is running
in the cloud, the quickest way of identifying the target IP
address is to check your hosts file, because a URL
that corresponds to the target IP address
has already been added as an actual record there.
So you can just cat out the contents of /etc and hosts.
There we are, /etc/hosts.
And at the bottom, you should have an IP address
assigned to demo.ine.local.
And this URL might change.
But all you need to do is just copy the IP here.
And of course, in your case, it's going to be different.
So do take that into consideration.
So I'm just going to copy that there.
And I'll head over into my desktop.
And we are going to create a new folder here,
and I'm just going to call it Win2k8.
So that's Windows Server 2008.
And I also recommend doing this because again, this
is very important, and you need to keep
your data sorted and organized.
So within this folder is where we're going to create
or where we're going to store all
the relative or necessary files for exploitation and port
scanning, et cetera, all of that.
So we have identified the target IP address.
So what can we do?
Well, firstly, can we actually access it,
or can we actually reach it?
So I'll just perform a quick ping,
and let's see whether it actually responds.
There we are.
We can see that it responds.
So that means we can communicate with it.
So the next obvious step is to perform a simple nmap scan
on the default port range, which is 1,000 of the most commonly
used ports.
And that can be done with nmap.
And we'll just perform a service version detection scan.
And we'll paste in the target IP there.
And let's see what's running on the target, right?
So we're just getting a basic idea of what's running.
We can then modify the scan to identify more information
regarding any other open ports that we might have missed.
Because remember, this default scan
essentially scans 1,000 of the most commonly used ports.
And in order to scan the entire TCP range, which
is about 65,535 ports, we need to specify that explicitly
with the nmap scan, or as part of the nmap scan argument.
So I'll just wait for this to complete.
Right, so the initial nmap scan is done.
And as you can see right over here,
we have been able to identify various services running
on this target system.
And let's take a closer look at them.
So we have ftp running on port 21,
and the actual service itself is Microsoft ftpd.
And it doesn't specify the actual version.
We then have ssh, and more specifically, OpenSSH 7.1.
Now, remember, OpenSSH is running on Windows.
So just keep that in mind.
We also have a web server running on port 80,
and that is the Microsoft IIS httpd
7.5 version of Microsoft IIS.
We then have your standard RPC port, netbios, and SMB.
And SMB tells us that, of course,
it's running Windows Server 2008.
And it could be running Windows Server 2008 or Windows Server
2008 R2.
We also have a MySQL database server
running on the default port, which is 3306.
And we also have an RDP port, which is on 3389.
It looks like we also have another web application that's
running on port 4848.
And this requires an SSL-- or actually has
an SSL certificate.
So that's running Oracle GlassFish Application Server.
On port 7676 it looks like we have the Java Message Service.
On port 8080 we also have GlassFish.
This is the Sun GlassFish Open Source Edition 4.0.
And on port 8181, we also have Oracle GlassFish.
And on port 9200, we aren't able to identify that service.
So again, this is a good start, but this
is by no means the entire list or scope of services
that are running on the target.
So what we can do now is, if we actually go to the bottom here,
we can perform another nmap scan that's much more comprehensive.
So we can say nmap, and I'll set the timing template to T4.
So that's a much faster scan than the default one.
And we'll perform ACK scan, so -PA.
And we'll also perform the default script scan,
as well as service version detection.
And we can set the port range to 1 to 10,000, so 10,000 ports.
I'm not scanning the entire TCP range yet.
And then we paste in the target IP.
And this is something that's very important.
We want to output the scan results, because you always
want to make sure that you output
all of your scan results.
I'm going to output it into an XML format
so that we can import it into the Metasploit framework.
So I'll say -oX, and then I'll provide it with a name.
So I'll just call this nmap 10,000, or 10k.
All right?
So that essentially tells me that this particular scan
is for only 10,000 ports.
So that looks like it's good.
And I can just hit Enter.
And it's going to begin performing the nmap scan.
Now, while it's performing the nmap scan,
we can begin accessing or trying to learn more
about some of the services that can be accessed, maybe
through the web browser.
So let's try and access the web server,
and let's see what web application is
being hosted on there.
So if we click on it, it looks like a very simple web
application.
And there is an image being displayed here.
So we can open the image in a new tab.
As I said, this has been set up to actually tease you,
in many ways.
Because there are going to be various access
vectors or vulnerabilities within quite a few services
that you can actually exploit.
So it's just a simple web application there.
We can also view the page source to learn more about it.
And it just looks like we have some basic HTML, CSS.
And it looks like we have a value here.
I believe that's for the actual image.
And this is encoded in base 64.
So yeah, there we are.
You can actually go through that,
and that's still the actual image code.
And there we go.
Right.
So again, that is all pertinent to the image itself.
So we'll get to that when we get there.
But I am primarily interested in other services
like ftpd, OpenSSH.
We can also target SMB.
And I'm guessing what you're guessing--
we can also target the MySQL database
server through a brute-force attack,
or identify the exact version, which is provided to us here.
And in addition to this, we can also
perform some banner-grabbing to learn more
about a specific service whose version has not
been enumerated with nmap.
So for example, I'll just open up a new terminal window here,
and let me just minimize that there.
And we are targeting the--
let's try port 21, because we weren't
able to get anything conclusive there.
So netcat and -nv.
Paste in the target IP, port 21.
Hit Enter.
And again, it just tells us Microsoft FTP Service.
So again, nothing additional there.
As for the other services, we've got the service versions.
We can try and access some of the other web applications.
So we can try and access, let's see, port 4848.
And let's see what that brings up.
So again, we're just trying to get an idea of what's
running on the target.
So we can say port 4848.
And this requires an SSL certificate,
or has an SSL certificate.
So I'll just say Accept the Risk and Continue.
And this is the GlassFish Server Open Source Edition.
That's on port 4848.
And let's just close this here.
And let's go back to the actual terminal
here, where the nmap results are.
We also have a web server on port 8080.
So let's see what's running on that.
It's telling us that we have GlassFish
running on there, so 8080.
And we'll give this a couple of seconds.
This doesn't have an SSL certificate,
so we can just say HTTP.
There we are.
So it tells us, your server is now running.
So it looks like this is a status
page that actually tells you whether or not
GlassFish is running.
And you can see that this is still the default configuration
because it tells us, to replace this page,
overwrite the file index.html, et cetera, et cetera.
OK.
So we know what's running on port 8080.
And probably we can try and access port 9200.
Let's just see what's on that.
That looks interesting.
So we can try 9200, and it looks like this is an API endpoint.
So we really can't tell or get any additional information
regarding this right now until our advanced nmap scan is done.
And indeed, it looks like it's done.
So you can see that this was the scan options I specified here.
And the default script scan results will also
be shown for each applicable service.
So for example, for FTP, the ftp system script was used,
and it tells us that the target is indeed
running a Windows NT kernel.
For SSH, we just get the SSH host keys for the web server.
We can see that it gives us the HTTP server as well
as the title and the methods that are allowed.
So nothing risky there; the only one is trace.
For port 1617, which I don't believe
we discovered earlier on, which is a good thing,
it looks like we have Java RMI.
That's an endpoint.
Port 3306, we get the default script that's run
is mysql-info.
So this gives us the exact version, the capabilities,
as well as the actual salt and the authentication plugin,
which is mysql_native_password.
We then have RDP, which we already know about.
And it looks like the target name or the host name
is VAGRANT-2008R2, so we've been able to identify
that the system is probably running Windows Server 2008 R2.
We get the NetBIOS domain name, the computer name,
which is pretty much the same.
On port 3700, which we weren't able to identify previously,
we can see we have a CORBA naming service.
4848-- that's Oracle GlassFish.
We also have 5985.
Hmm.
Did we actually access that, or were
you able to identify that previously?
I don't think so.
So 5985-- let's see what's running on that,
because that is inconclusive.
5985-- it says the resource is not found.
OK, interesting.
Interesting.
We also have port 7676.
It looks like it has the Java Message Service.
8080-- we know that's Oracle GlassFish.
We also have 8181, as well as 8484,
which is running Jetty winstone.
And it looks like it has Jenkins installed.
So 8484-- let's try and access that.
That looks interesting.
So we can say 8484.
And yep, it has Jenkins running on that particular port, which
is very, very interesting.
Let's go back to the actual scan here.
We have another web server running on 8585.
And then on 8686, we have Java RMI.
So let's try 8585.
And OK, so we have a WampServer that's running on port 8585.
And it looks like we have--
right over here under our projects,
we have WordPress installed, as well as an uploads directory.
So we click on that.
We have nothing within uploads.
Under WordPress, let's see what this actually tells us here.
So it looks like we have a WordPress installation that's
running on port 8585 on the WampServer
under the WordPress directory.
It looks like it's still being developed.
We also have phpmyadmin.
That's awesome.
And it tells us we don't have permission to access this.
So it looks like external access is blocked,
or specific IPs only are allowed to access phpmyadmin.
We also have sqlbuddy, httpd-dav.
And it looks like we have webgrind as well.
But we don't have permission to access most of them,
except for WordPress.
So we have the Java RMI endpoint.
And then it looks like for port 9200
we have a few other services.
Port 9300, et cetera, right?
And the additional script results
pertinent to the actual host--
for example, the smb-security-mode.
We can see that message-signing is disabled, so that's
quite important.
Does it tell us the exact version of SMB that's running?
I believe it does.
So it's saying the SMB security mode is 2.1;
message signing is enabled, but not required.
For OS discovery, you can see that it tells us
right over here, Windows Server 2008 R2 Standard Build 7601
Service Pack 1.
So that's very, very important information.
The computer name, and of course the NetBIOS computer name
and workgroup are all enumerated there.
So this is very important information.
So again, always make sure to output your scan results
into a file.
In this case the output file is in XML format.
And the reason I did that is so that we
can import it into msfconsole, or into the Metasploit
framework.
Now, before I start it up, I'm just
going to start up the PostgreSQL database service.
Because in order to save or import results
into the Metasploit framework and have them
saved or persisted throughout various sessions or uses,
we need to start up the PostgreSQL database service.
So service postgresql start.
And that's going to start it, and then we
can start up msfconsole.
And we're going to give this a couple of seconds to start up.
There we are.
And what we're going to start off by doing now
is creating a workspace for our current assessment.
So we are targeting one system.
So we'll create a new workspace called Win2k8 as well,
so that we can switch between engagements and systems
without actually messing up the data in the back end.
Once that is done, you can see that I'm currently working
within the Win2k8 workspace.
I can then use the db_import command to import the scan
results, which are stored under /root, under Desktop.
And of course, in your case, you may have changed the directory
where you've stored them.
So in my case it's under Desktop/Win2k8/nmap_10k.
Hit Enter.
That's going to import the scan results.
And now if I type in hosts, you can
see that we have the host added there.
So we have the address.
We also have the name, which is currently set incorrectly.
And we can also access the services performed
with that default nmap scan where we scanned, I think,
10,000 ports.
Now, if you want the operating system
to be highlighted here accordingly,
a quick little trick to do that is to use a--
and this is in the context of Windows--
is to use a module called smb_version.
So I'll search for that there.
You can see that's an auxiliary module.
So I'll say use, and I'll use the auxiliary/scanner/smb/smb
version module.
And we can take a look at the options here.
And we can set the RHOSTS option.
That is the target IP.
And we'll paste in the target IP there.
There we go.
And we can then hit run, and this
will tell us the exact operating system version.
So if we now type in hosts, you can
see that that is highlighted correctly there.
So the name of the computer is VAGRANT-2008R2.
The OS name is Windows Server 2008 R2.
OS flavor is standard.
Service pack, service pack 1.
Purpose, server.
So this is really where the Metasploit framework
starts to shine.
And I personally recommend that you
import all your scan results into the Metasploit framework.
Because again, it provides you with a very, very cool way
of viewing all the hosts that you've scanned
and the services pertinent to that host.
Now, as I said, this only will work well
if you separate your engagements or your hosts
based on the workspace.
So whenever you're performing a new pen test,
just create another workspace so that the data is separated.
OK.
So we have been able to enumerate the services running
on the target system via nmap, and we've
imported the scan results into the Metasploit framework.
We've also identified the exact operating system version.
So again, let me just revisit that again.
So hosts, and services here.
There we go.
And these are all the services.
And I'll be targeting quite a few of them.
And again, the actual videos that
will be covering the exploitation
phases of this particular section of the course
will not involve me exploiting each of these services.
As I said, I'll be exploiting some of the most common ones,
or the low-hanging fruit.
So that will give you an idea of what you should be targeting.
And then, of course, you can go through this yourself
without my help and then use the videos as references.
OK, so we've got a lot of information.
Now, as I said, this is not a comprehensive nmap scan.
So what you can probably do as well
is, if I exit from the Metasploit framework console,
I can also perform a scan on the entire TCP port range.
So instead of just limiting myself to 10,000 ports,
I can scan the entire 65,535 ports.
So 65535.
And that will take a while, trust me.
And then, of course, I can output this into its own file
and say-- instead of nmap_10k, I can say nmap_all.
And you can change the naming to whatever you want.
However, I will not be doing that,
because I really don't need to.
What I will do is--
or what I'll actually show you how to do
is how to scan UDP ports, which you should already
know how to do now.
So we can say nmap, and -sU for UDP,
and then we can say -sV for service version detection
and paste in the target IP.
Now, this system doesn't have any UDP ports.
But this is something that you should also do
during a standard engagement.
Be as comprehensive as possible with your port scans.
I'm not really following through with it because, again, I'm
the one who actually set up this environment,
and I know what services are running on what ports.
And I'll be focusing on specific services
and showing you how a penetration tester would
typically go about it.
With that being said, that is going
to conclude the practical demonstration
side of this video.
As I said, you're free to use any
of the tools, any of the port-scanning tools,
to essentially identify open ports, the service versions,
et cetera.
And yeah, that's going to conclude this session.
And we can move on to the next session
within this particular section of the course.
All right.
So we have just completed the first video
within this particular section.
We have learned a lot about the target system
and what services are running on it.
And the reason it has so many services
is primarily because this is something
that you need to be very competent at as a penetration
tester.
And what I'm referring to is the ability
to identify services that, again, can
be exploited relatively easily.
And again, that doesn't mean that they
can be exploited easily.
It just means that you need to pick your targets as
efficiently as possible and not waste your time with dead ends
or rabbit holes.
So that's why it has a lot of services,
because I want you to be able to develop
the skill or the ability to identify low-hanging fruit
and find the easiest way into a system.
Because efficiency, as you'll see within your career,
is very, very important in the context of a pen test.
Because time is a factor, and the actual deadline
to complete a pen test is something
that will be on your mind as you actually perform a pen test.
So in the next video, we'll actually
begin targeting the first service, which is FTP,
and I'll be walking you through various techniques that
can be used to gain access to the FTP server.
And we'll see what we can do, and whether or not it
provides us with access to the target system.