Targeting Samba.
In this video, we're going to be taking
a look at how to exploit Samba running on the Linux target.
So again, I've already explained what Samba is.
It's essentially the open source implementation
of SMB for Linux, and it works exactly the same
or very similar to how SMB works on Windows.
So in terms of exploiting Samba, again,
what we're going to be taking a look at,
specifically, is the process of identifying vulnerabilities
within or a vulnerability within the specific version of Samba
that's running on the target and how to exploit it in order
to obtain access to the target system via a reverse shell
or even a Meterpreter session.
So I'm going to just switch over to my lab environment,
and we can get started with taking a look at the techniques
that will allow us to essentially exploit
Samba and, consequently, gain access to the target system.
So I'll see you within the lab environment.
All right, so I am back within the lab environment,
and I have performed an Nmap scan on the target system,
more specifically a service version scan on port 445, which
is, again, appropriate for the SMB service or rather Samba
because we're now dealing with a Linux target.
And again, if we take a look at the version information here,
we can see that it tells us it's running Samba smbd version
3.X to 4.X. So it doesn't give us any additional information
regarding the exact version of Samba that's
running on the target.
Now, even if we were to perform some banner grabbing
on the target system on port 445,
we would not be able to get the exact version of Samba.
So let's actually try this out, and let's see what happens.
So when I hit Enter--
and let me just use the nv option
because it's not displaying anything there.
So Netcat nv, as you can see, we connect successfully.
However, we don't get a banner.
So how can we enumerate the exact version of Samba
that's running on the target?
Well, we can do this through the use
of very useful Metasploit framework
module called SMB version.
That is not just applicable to Samba, but also to SMB
on Windows.
So again, this can work both ways.
I, actually, recommend that you run it
whenever you're trying to target SMB on a Windows system
as well.
So I'll search for the module.
It is smb_version.
And we'll say, use.
And we're going to use the module ID, so
use 0, show options.
We only need to set the RHOSTS option, which,
again, is the target IP.
So set RHOSTS.
There we go.
So that's set up, and we can hit run.
And this should tell us the exact version
of SMB running on the target or rather Samba, if you will.
So in this case, you could see it tells us the host could not
be identified.
However, it prints out the exact version of Samba that's
running on the target system.
And in this case, it looks like the target system is running
Samba 3.0.20 So we can perform a quick searchshploit
query to try and identify whether this specific version
of Samba is vulnerable to any exploits, right?
So we'll say, samba--
and the exact version in this case is 3--
I believe it was 3.2.10--
3.0.20.
So 3.0.-- sorry, that is searchshploit, not search.
So searchshploit.
And let me type that in correctly.
For some reason-- here we are.
So searchshploit.
And it looks like we have a few exploits here.
So I'm just going to drag this to the side,
so you can see what's going on.
And I'll just run that again, so that the ASCII output
is printed out correctly.
So as you can see, we have an exploit here that affects
or that is actually specific to the version that's
running on the target.
So you can see Samba 3.0.20 and versions lower than 3.0.25rc3.
This is the 'Username' map script'
Command Execution (Metasploit) module.
So let's actually utilize this module,
and let's see what it does exactly.
Or let's learn more about it.
So we're done with that.
I'm just going to close that there.
And we can say, search samba 3.0.20, right?
So I'll hit Enter.
And the exact module is displayed here.
And the rank is excellent, so it has
a very good chance of success.
So I'll say, use 0.
And we can show the info here.
As you can see, this module exploits a command execution
vulnerability in Samba version 3.0.20 through 3.0.25rc3 when
using the non-default 'Username map script' configuration
option.
By specifying a username containing shell meta
characters, attackers can execute arbitrary commands.
No authentication is needed to exploit this vulnerability
since this option is used to map usernames prior
to authentication.
So this is a very, very serious vulnerability
in the context of Samba.
So the only option we need to set here is the RHOSTS option.
So I'll set that to the target IP,
and it'll provide us with a netcat reverse shell.
If we take a look at the payload here--
let me just show the options--
the default payload is cmd/unix/reverse_netcat.
So we can utilize the actual reverse shell
that we will be provided with.
Alternatively, we can also upgrade that
into a Meterpreter session, which will actually take
a look at in a few seconds.
So I'll type in exploit, and we'll
give this a couple of seconds.
And if successful, we should be able to obtain a reverse shell.
There we are-- Command shell 1 opened.
And I can say ls -al.
There we go.
And we currently have access to the target system,
so I can verify this by saying cat/etc/*issue.
And you can see that this is on Metasploitable2.
And I can also do that for cat/etc/*release.
There we go-- Ubuntu 8.04.
So I'll put this in the background.
And we can now list out our sessions.
And in order to upgrade a session to a Meterpreter
session, we can say, sessions -u 1.
So we specify the session ID.
In this case, the session has an ID of 1.
So I'll hit Enter.
And this should give us a Meterpreter session
on the target system.
There we are.
It sends the stage.
And indeed, we do receive a Meterpreter session.
So if I list out my sessions now,
you can see that on session ID 2, we have an Meterpreter.
And not only that, we also have obtained root access
on the target system.
So if I switch over to session 2--
you can see, if I type in sysinfo info,
it'll be displayed right over there--
Ubuntu 8.04.
And I can say, getuid.
We currently root, so we have root access
on the target system, which means we don't
need to elevate our privileges.
And apart from the actual bind shell listener
that we were able to gain access to
in the first video in this section,
this is the only exploit that has given us root access right
out of the box.
And I wanted to highlight it for that reason,
primarily because you can essentially
go over or skip over the privilege escalation section
if you are essentially able to exploit
the target via this exploit module.
So it is extremely useful.
So we can pretty much do whatever we want now.
So I can list out the users on the system, so cat/etc/passwd.
And you can see we have all these service accounts right
over here, apart from the service account
that we had used previously.
The rest of which are really service accounts.
And now, that we've gotten access,
we can also dump hashes, for example.
So cat/etc/shadow.
There we are.
And we can crack these, as these are in MD5.
And of course, I've covered the process of how
to crack Linux MD5 hashes.
It really is very, very simple.
And yeah, so that is going to conclude
the practical demonstration side of this video.
All right, so that concludes the Linux exploitation section
of this course.
And furthermore, it also concludes the Linux Black Box
penetration test.
And hopefully, you were able to gain access to the target
system without the videos.
If not, that's perfectly fine.
That's why you're here.
You're here to learn.
And again, there's still other services,
other vulnerable services on the target system
that can be exploited, so definitely give it a few goes.
And you should be able to find more than, I think,
more than five services that you can exploit in order
to gain access to the target system.
So hopefully, you enjoyed that.
And hopefully, you learned a lot.
And as I said, you always have to keep on practicing.
So use these videos as reference points,
and take note of what I did in regards to the tools I used,
as well as the techniques that I performed,
and integrate them with your future assessments
or engagements.
With that being said, we're now going
to move over to the next section of the course.
And I'll be seeing you there.