[MUSIC LOGO]
Transferring files to Linux targets.
In this video, we will be exploring
the process of how to transfer a file to a Linux target
that you have compromised.
And again, this is going to be done in conjunction
with the Python web server that we
were able to set up in the first video of this section.
So again, this video has a lab environment attached to it.
And we're going to start off by exploiting the target system
or gaining access to it, after which we'll actually
cover the process of how you can set up
or how you can transfer a file to the Linux target system
that you have just compromised, through the use
of an in-built Linux utility or command.
So just fire up the lab environment,
and I'll see you there in a couple of seconds.
So I'm back within the lab environment.
And in this lab environment, you will not be provided with a UI,
with graphical user interface, on the Kali Linux system.
You'll be provided with a simple terminal interface.
But that's fine.
So the first step, of course, is to identify the target IP
address.
We can do this by typing in ifconfig.
And if you take a look at the interface, ethernet 1
and the inet value here, all you want to do
is just copy that value.
This is the IP address of the Kali Linux system.
In your case, the subnet will be different.
And in the case of the target system,
the target IP address is going to be the same subnet
but on the IP address 3.
So just copy this and change the 2 at the end here to a 3.
And that's the target IP.
So the next step, of course, will involve gaining access
to the target system.
In order to do that, we're going to firstly need
to perform a quick Nmap service version
detection scan on the target.
So I'll paste in the IP I copied,
and I'll change the 2 to a 3.
And I'll hit Enter.
And let's see what services are running on the target system.
So the Nmap scan is complete.
And we have been able to gain quite a bit of information
in regards to the services.
We can see that on both port 139 and port 445,
we have Samba, the Samba service running.
So Samba is the Linux implementation
of SMB for Linux systems.
And this specific version of Samba
is vulnerable to a specific exploit.
And this exploit is available on the Metasploit framework
in the form of an exploit module.
So again, we're going to be utilizing the Metasploit
framework exploit module to gain access to the target system.
However, we will not be utilizing the meterpreter
session.
We will instead open up the command shell session
and then take a look at file transfers.
Now, before we actually open up msfconsole,
you probably would have realized that this lab environment does
not provide you with the ability to open up
a new tab or a new terminal.
And for that reason, as we will be
needing more than one terminal session,
we are going to be utilizing a command line tool,
more specifically, a Linux command line utility
called tmux.
Tmux is a terminal multiplexer that
allows you to have multiple terminal
sessions within one terminal.
And you can access it by typing in tmux.
And the way it works is your actual terminal sessions
or Windows are highlighted at the bottom.
So they're ordered from 0 all the way to as many terminals
as you open.
And if you want to create a new one,
you can do that by utilizing the keyboard combination Control-B
or you can just type in Control and B or hold the keys there.
So Control-B and C.
So Control-B and C. And that will open up a new terminal
session.
And the current terminal that you're active on
is denoted by the asterisk symbol.
So you can see that I'm currently
in the terminal session 1 here.
If I wanted to go back to terminal session 0,
I can say Control-B and 0.
And you can now see I'm back on that session.
So again, if you want to create a new terminal window, just
Control-B and C. And once you want to exit out of a terminal
session, you just type in exit.
And it'll close it up, and I can go back into terminal 1.
And I can exit from that one as well.
So we're currently within the terminal session 0.
So again, I'll just get the target IP address.
And we can open up msfconsole.
So I'll just copy the inet value there.
And I'll say msfconsole.
And we'll give this a couple of seconds to complete.
There we are.
The Metasploit framework console is now up and running.
We are then going to set the global variable
for the RHOST option.
And we'll set the target IP address.
So I'll just paste in the IP I copied,
and I'll change the 2 to a 3.
And the reason we're setting the RHOST value
globally is so that whenever we open up or load
a particular module, the target IP option
is going to be specified already for us, without us
having to specify it.
So I'll hit Enter.
We can then search for-- we can just say search samba.
And the exploit module that we want to use is--
let me see if I can identify it here.
It should actually show up here.
So it doesn't look like it's shown up here.
So I can just say search, and I can
say pipe is known, because I know that's the module name.
So I'll just say search again.
So samba pipe.
There we are.
And in this case, it doesn't look like that is actually
being displayed.
So we can just say search samba.
And to actually scroll through a list with tmux,
you can't actually use your mouse scroll wheel.
You have to use the Control-B option.
And then you can utilize your Page Up and Page Down keys
on your keyboard.
So again, let me see if I can find it.
There we are.
That's the exploit module there.
So it's exploit Linux Samba is known pipe name.
So there we are.
And that will essentially allow us to load a custom Linux
shared object and then execute it
in order to receive a meterpreter session.
Once you're done scrolling, hit the Q key on your keyboard,
and that will allow you to type into your terminal.
So we'll say use and paste the module name in there.
If we show the options, you can see that the target
IP is already specified.
The target port is set correctly to the default smb, or Samba
port, which is port 445.
And we can type in exploit, and we should receive a meterpreter
session.
So there we are.
We'll give it a couple of seconds.
And in this case, it doesn't provide us
with a meterpreter session, which is great.
This will actually work in our benefit
to showcase how we can transfer files
without the need of a meterpreter session.
So I'll open up a bash session here
because it's opened up the command shell session,
and it is noninteractive.
So I'll say bin/bash -i, and you can
see that our current user is root
and the host name is victim-1.
So ID.
There we are.
And we know it's run, and we can also enumerate the distribution
version.
So I can say cat etc release.
So I'll just say cat/etc and release.
There we are.
And you can see it's running Debian 8 jessie.
So we have a vague idea, or rather, a basic idea of what
is running in terms of the distribution.
But that's really not what we're interested in.
So we're currently within the temp directory,
which again, is great.
And we are going to be transferring
our files to this directory.
So how do we download a file onto the target system
without meterpreter?
Well, this is where the tmux comes into play.
So we're going to open up a new terminal session.
So we just type in Control-B. So I'll just say Control-B and C.
And that will open up a new terminal.
And our previous session is still running.
It's in terminal 0.
So within this terminal, this is where
we'll be setting up our web server with Python.
So we actually need to identify or find a file
that we would like to transfer.
So for example, if I wanted to transfer a shell,
so I can just say--
I'll go under user share web shells.
And let's say I wanted to transfer a PHP web shell,
like so.
So let's say I wanted to download the php-backdoor.php
web shell onto the target.
I've navigated to that directory.
I can then set up the web server with the Python 3 module.
So python3 -m http.server.
And I'll host this on port 80.
But before I do that, I actually need to find my IP address.
So I'll just ifconfig.
And I'll just copy the Kali Linux IP there.
I can then say pythom3 -m http.server, port 80.
Hit Enter.
And that's going to host all the files within the directory
usr/share/webshells/php#.
And in specific, we want to download a file called
php-backdoor.php.
So we'll navigate to the terminal session 0,
and we can do that by saying Control-B and 0.
So I'll just say Control-B and 0.
There we are.
And we're back here.
So how do we transfer the file or how do we download it?
Well, we can download a file onto a Linux target
through the use of the wget utility.
So we can say wget.
We then specify the address of the web server.
So we paste in the Kali Linux IP.
And the file that we want to download is php-backdoor.php.
And once I hit Enter, it should download it.
So there we are.
It'll connect to the web server.
It's going to send an http request.
And it's going to save it as php-backdoor.php.
We can confirm that the file has been downloaded by saying ls,
and you can see we have php-backdoor running
right over there.
So that is how to transfer files onto a Linux target
system using the wget utility.
Of course, we can also take a look at a few other examples.
So I'll say Control B and 1 to navigate
to my terminal session 1.
And I can transfer any other file
that I would like to transfer.
So for example, I could navigate to the root here.
And I can create a new file.
So I'll just say echo this is some test text.
And I'll put that into a file called test.txt,
as we did for Windows.
And if I kept the content of test.txt
you can see it contains that data.
So we can now set up the web server
with Python in this directory to host the test.txt file.
So I'll hit Enter.
And I'll say Control-B and 0.
And we can again utilize the wget utility.
So wget http, and I'll paste in the Kali Linux IP,
and we want to download test.txt from the web server.
I'll hit Enter.
That is done.
I can then get the content of test.txt.
And voila, there we are.
So that is how you can transfer files to a Linux target system
without the need of a meterpreter session.
So that is going to conclude the practical demonstration
side of this video.
So that concludes the file transfer section
of this course.
By the end of this section, which is this video,
you should have an understanding of how to transfer files
onto a Windows target as well as a Linux target
and how to set up a web server with Python to host the files
that you'd like to transfer.
In the next section of this course,
we will be exploring the process of how
to upgrade a standard noninteractive command shell
session into a bash session and how you can essentially
ensure that the terminal session that you want to acquire
is interactive.
So I'll be seeing you in the next video.