Metasploitable - Revision history

Admin: /* SSH Keys */

2017-10-26T02:27:21Z

SSH Keys

← Older revision		Revision as of 02:27, 26 October 2017
Line 251:		Line 251:
	==SSH Keys==		==SSH Keys==

	~~Alternatively, if~~ you have WRITE access to the filesystem through an exploit such as the <code>rlogin</code> trick above, or through a PHP shell introduced through a web app vulnerability, or through a netcat payload, you can generate an SSH key for the attacker machine, and add it to the list of trusted hosts on the remote machine. This enables you to login without a password. This method requires WRITE access to the filesystem, so it needs to be coupled with an NFS or other remote shell exploit.		If you have WRITE access to the filesystem through an exploit such as the <code>rlogin</code> trick above, or through a PHP shell introduced through a web app vulnerability, or through a netcat payload, you can generate an SSH key for the attacker machine, and add it to the list of trusted hosts on the remote machine. This enables you to login without a password. This method requires WRITE access to the filesystem, so it needs to be coupled with an NFS or other remote shell exploit.

	[[Metasploitable/SSH/Keys]]		[[Metasploitable/SSH/Keys]]

Admin: /* SSH Brute Force */

2017-10-26T02:26:14Z

SSH Brute Force

← Older revision		Revision as of 02:26, 26 October 2017
Line 246:		Line 246:

	[[Metasploitable/SSH/Brute Force]]		[[Metasploitable/SSH/Brute Force]]

			'''Tools: [[John]] the Ripper, [[Hydra]]'''

	==SSH Keys==		==SSH Keys==

Admin: /* WebDAV */

2016-03-29T23:04:01Z

WebDAV

← Older revision		Revision as of 23:04, 29 March 2016
Line 289:		Line 289:
	Tor's Hammer: [[Metasploitable/TorsHammer]]		Tor's Hammer: [[Metasploitable/TorsHammer]]

	=WebDAV=		==WebDAV==

	Abusing WebDAV: [[Metasploitable/DAV]]		Abusing WebDAV: [[Metasploitable/Apache/DAV]]

	=Flags=		=Flags=

	{{MSFlag}}		{{MSFlag}}

Admin: /* Apache */

2016-03-29T23:03:44Z

Apache

← Older revision		Revision as of 23:03, 29 March 2016
Line 288:		Line 288:

	Tor's Hammer: [[Metasploitable/TorsHammer]]		Tor's Hammer: [[Metasploitable/TorsHammer]]

			=WebDAV=

			Abusing WebDAV: [[Metasploitable/DAV]]

	=Flags=		=Flags=

	{{MSFlag}}		{{MSFlag}}

Admin: /* Apache */

2016-03-29T03:59:26Z

Apache

← Older revision		Revision as of 03:59, 29 March 2016
Line 286:		Line 286:

	Attacking Apache with Python: [[Metasploitable/Apache/Python]]		Attacking Apache with Python: [[Metasploitable/Apache/Python]]

			Tor's Hammer: [[Metasploitable/TorsHammer]]

	=Flags=		=Flags=

	{{MSFlag}}		{{MSFlag}}

Admin: /* DNS Bind */

2016-03-27T22:00:22Z

DNS Bind

← Older revision		Revision as of 22:00, 27 March 2016
Line 280:		Line 280:

	[[Metasploitable/DNS Bind]]		[[Metasploitable/DNS Bind]]

			=Apache=

			Attacking Apache with Metasploit: [[Metasploitable/Apache]]

			Attacking Apache with Python: [[Metasploitable/Apache/Python]]

	=Flags=		=Flags=

	{{MSFlag}}		{{MSFlag}}

Admin: /* Recon */

2016-03-27T07:13:24Z

Recon

← Older revision		Revision as of 07:13, 27 March 2016
Line 1:		Line 1:
	Metasploitable is a virtualbox for pentesting practice.		Metasploitable is a virtualbox for pentesting practice.

			=Services=

			For reference, a list of services running on the metasploitable machine:

			<pre>
			Services
			========

			host port proto name state info
			---- ---- ----- ---- ----- ----
			10.0.0.27 21 tcp ftp open vsftpd 2.3.4
			10.0.0.27 22 tcp ssh open OpenSSH 4.7p1 Debian 8ubuntu1 protocol 2.0
			10.0.0.27 23 tcp telnet open Linux telnetd
			10.0.0.27 25 tcp smtp open Postfix smtpd
			10.0.0.27 53 tcp domain open ISC BIND 9.4.2
			10.0.0.27 80 tcp http open Apache httpd 2.2.8 (Ubuntu) DAV/2
			10.0.0.27 111 tcp rpcbind open 2 RPC #100000
			10.0.0.27 139 tcp netbios-ssn open Samba smbd 3.X workgroup: WORKGROUP
			10.0.0.27 445 tcp netbios-ssn open Samba smbd 3.X workgroup: WORKGROUP
			10.0.0.27 512 tcp exec open netkit-rsh rexecd
			10.0.0.27 513 tcp login open
			10.0.0.27 514 tcp tcpwrapped open
			10.0.0.27 1099 tcp java-rmi open Java RMI Registry
			10.0.0.27 1524 tcp shell open Metasploitable root shell
			10.0.0.27 2049 tcp nfs open 2-4 RPC #100003
			10.0.0.27 2121 tcp ftp open ProFTPD 1.3.1
			10.0.0.27 3306 tcp mysql open MySQL 5.0.51a-3ubuntu5
			10.0.0.27 3632 tcp open
			10.0.0.27 5432 tcp postgresql open PostgreSQL DB 8.3.0 - 8.3.7
			10.0.0.27 5900 tcp vnc open VNC protocol 3.3
			10.0.0.27 6000 tcp x11 open access denied
			10.0.0.27 6667 tcp irc open Unreal ircd
			10.0.0.27 6697 tcp open
			10.0.0.27 8009 tcp ajp13 open Apache Jserv Protocol v1.3
			10.0.0.27 8180 tcp http open Apache Tomcat/Coyote JSP engine 1.1
			10.0.0.27 8787 tcp open
			</pre>


	=Recon=		=Recon=

Admin at 00:00, 27 March 2016

2016-03-27T00:00:33Z

← Older revision		Revision as of 00:00, 27 March 2016
Line 1:		Line 1:
	Metasploitable is a virtualbox fo pentesting practice.		Metasploitable is a virtualbox for pentesting practice.

	=Recon=		=Recon=

Admin: /* SSH Exploits */

2016-03-26T17:50:48Z

SSH Exploits

← Older revision		Revision as of 17:50, 26 March 2016
Line 219:		Line 219:

	More info at [[Metasploitable/SSH/Exploits]]		More info at [[Metasploitable/SSH/Exploits]]

	~~Here is a page with more info on general vulnerabilities in SSH: http://www3.physnet.uni-hamburg.de/physnet/security/vulnerability/SSH_vulnerabilities.html~~

	~~First, a reminder of the information nmap returned about the SSH service after a port scan:~~

	~~<pre>~~
	~~22/tcp open ssh OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)~~
	~~\| ssh-hostkey:~~
	~~\| 1024 60:0f:cf:e1:c0:5f:6a:74:d6:90:24:fa:c4:d5:6c:cd (DSA)~~
	~~\|_ 2048 56:56:24:0f:21:1d:de:a7:2b:ae:61:b1:24:3d:e8:f3 (RSA)~~
	~~</pre>~~

	~~This server isn't using the hopelessly broken 1.0 protocol, so it will be, at a minimum, mildly challenging.~~

	~~https://www.offensive-security.com/metasploit-unleashed/scanner-ssh-auxiliary-modules/~~

	~~We already covered how to brute force the login with Hydra, [[Metasploitable/SSH/Brute Force]]~~

	~~Did you know you can also brute force an SSH login with Metasploitable? Use the <code>auxiliary/scanner/ssh/ssh_login</code> module.~~

	~~<pre>~~
	~~msf > use auxiliary/scanner/ssh/ssh_login~~
	~~msf auxiliary(ssh_login) > show options~~

	~~Module options:~~

	~~Name Current Setting Required Description~~
	~~---- --------------- -------- -----------~~
	~~BLANK_PASSWORDS true yes Try blank passwords for all users~~
	~~BRUTEFORCE_SPEED 5 yes How fast to bruteforce, from 0 to 5~~
	~~PASSWORD no A specific password to authenticate with~~
	~~PASS_FILE no File containing passwords, one per line~~
	~~RHOSTS yes The target address range or CIDR identifier~~
	~~RPORT 22 yes The target port~~
	~~STOP_ON_SUCCESS false yes Stop guessing when a credential works for a host~~
	~~THREADS 1 yes The number of concurrent threads~~
	~~USERNAME no A specific username to authenticate as~~
	~~USERPASS_FILE no File containing users and passwords separated by space, one pair per line~~
	~~USER_FILE no File containing usernames, one per line~~
	~~VERBOSE true yes Whether to print output for all attempts~~
	~~</pre>~~

	~~Set this to run on the Metasploitable virtual box target:~~

	~~<pre>~~
	~~msf auxiliary(ssh_login) > set RHOSTS 10.0.0.27~~
	~~RHOSTS => 10.0.0.27~~
	~~msf auxiliary(ssh_login) > set USERPASS_FILE /usr/share/metasploit-framework/data/wordlists/root_userpass.txt~~
	~~USERPASS_FILE => /usr/share/metasploit-framework/data/wordlists/root_userpass.txt~~
	~~msf auxiliary(ssh_login) > set VERBOSE false~~
	~~VERBOSE => false~~
	~~</pre>~~

	=Shadow File=		=Shadow File=

Admin: /* SSH Exploits */

2016-03-26T17:25:21Z

SSH Exploits

← Older revision		Revision as of 17:25, 26 March 2016
Line 217:		Line 217:

	Old or unpatched versions of SSH, or weak cryptographic settings, can also be exploited.		Old or unpatched versions of SSH, or weak cryptographic settings, can also be exploited.

			More info at [[Metasploitable/SSH/Exploits]]

	Here is a page with more info on general vulnerabilities in SSH: http://www3.physnet.uni-hamburg.de/physnet/security/vulnerability/SSH_vulnerabilities.html		Here is a page with more info on general vulnerabilities in SSH: http://www3.physnet.uni-hamburg.de/physnet/security/vulnerability/SSH_vulnerabilities.html