Metasploitable/Apache - Revision history

Admin: /* Metasploit Apache Modules */

2016-03-28T18:28:05Z

Metasploit Apache Modules

← Older revision		Revision as of 18:28, 28 March 2016
Line 377:		Line 377:

	Fuzzing the phpMyAdmin login page (and attacking vulnerabilities in phpMyAdmin itself) will launch us into a whole new set of tools and concepts, so we'll leave that for the [[Metasploit/phpMyAdmin]] page and others.		Fuzzing the phpMyAdmin login page (and attacking vulnerabilities in phpMyAdmin itself) will launch us into a whole new set of tools and concepts, so we'll leave that for the [[Metasploit/phpMyAdmin]] page and others.

			==Open Proxy Servers==

			<pre>
			msf > use auxiliary/scanner/http/open_proxy
			msf auxiliary(open_proxy) > show info

			Name: HTTP Open Proxy Detection
			Module: auxiliary/scanner/http/open_proxy
			License: Metasploit Framework License (BSD)
			Rank: Normal

			Provided by:
			Matteo Cantoni <goony@nothink.org>

			Basic options:
			Name Current Setting Required Description
			---- --------------- -------- -----------
			LOOKUP_PUBLIC_ADDRESS false no Enable test for retrieve public IP address via RIPE.net
			MULTIPORTS false no Multiple ports will be used : 80, 1080, 3128, 8080, 8123
			RANDOMIZE_PORTS false no Randomize the order the ports are probed
			RHOSTS yes The target address range or CIDR identifier
			RPORT 8080 yes The target port
			SITE www.google.com yes The web site to test via alleged web proxy (default is www.google.com)
			THREADS 1 yes The number of concurrent threads
			UserAgent Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) yes The HTTP User-Agent sent in the request
			VERIFY_CONNECT false no Enable test for CONNECT method
			VERIFY_HEAD false no Enable test for HEAD method
			ValidCode 200,302 no Valid HTTP code for a successfully request
			ValidPattern server: gws no Valid HTTP server header for a successfully request

			Description:
			Checks if an HTTP proxy is open. False positive are avoided verifing
			the HTTP return code and matching a pattern.

			References:
			http://en.wikipedia.org/wiki/Open_proxy
			http://nmap.org/svn/scripts/http-open-proxy.nse
			</pre>

	=Metasploit Apache Modules=		=Metasploit Apache Modules=

Admin: /* Metasploit HTTP Modules */

2016-03-28T18:24:39Z

Metasploit HTTP Modules

@@ Line 23: / Line 23: @@
 * scan servers for webdav, content disclosure via webdav
 * brute-force Wordpress logins
 Whew!

Admin: /* Figuring Out Where to Begin */

2016-03-28T18:23:08Z

Figuring Out Where to Begin

← Older revision		Revision as of 18:23, 28 March 2016
Line 354:		Line 354:
	</pre>		</pre>

	===~~Figuring Out~~ Where to Begin===		===Whaaaat Where to Begin===

	Recommend starting with Nikos, as covered on the [[Metasploitable/Apache/Python]] page.		Recommend starting with Nikos, as covered on the [[Metasploitable/Apache/Python]] page.

Admin at 20:47, 27 March 2016

2016-03-27T20:47:16Z

← Older revision		Revision as of 20:47, 27 March 2016
Line 1:		Line 1:
			Apache vulnerabilities by version: https://httpd.apache.org/security/vulnerabilities_22.html

	=Metasploit HTTP Modules=		=Metasploit HTTP Modules=

Admin: /* Mod Negotiation Brute */

2016-03-27T20:44:28Z

Mod Negotiation Brute

← Older revision		Revision as of 20:44, 27 March 2016
Line 423:		Line 423:
	[*] Auxiliary module execution completed		[*] Auxiliary module execution completed
	</pre>		</pre>

			Okay - in this case, nothing exciting. This confirms what the prior scans had already shown, which is that index.php is the only file available on this Apache server.

	=Flags=		=Flags=

	{{MSFlag}}		{{MSFlag}}

Admin: /* Figuring Out Where to Begin */

2016-03-27T20:31:01Z

Figuring Out Where to Begin

@@ Line 363: / Line 363: @@
 </pre>
-Load the Metasploit module to take advantage of this vunlerability:
+===Mod Negotiation Scanner===
 <pre>
@@ Line 371: / Line 373: @@
 More information from Metasploit documentation website: https://www.rapid7.com/db/modules/auxiliary/scanner/http/mod_negotiation_scanner
 =Flags=
 {{MSFlag}}

Admin: /* Figuring Out Where to Begin */

2016-03-27T20:27:34Z

Figuring Out Where to Begin

← Older revision		Revision as of 20:27, 27 March 2016
Line 359:		Line 359:

	<pre>		<pre>
	+ Apache mod_negotiation is enabled with MultiViews, which allows attackers to easily brute force file names. See http://www.wisec.it/sectou.php?id=4698ebdc59d15. The following alternatives for 'index' were found: index.php		+ Apache mod_negotiation is enabled with MultiViews, which allows attackers to easily brute force file names.
			See http://www.wisec.it/sectou.php?id=4698ebdc59d15. The following alternatives for 'index' were found: index.php
	</pre>		</pre>

Admin: /* Metasploit Apache Modules */

2016-03-27T20:27:23Z

Metasploit Apache Modules

← Older revision		Revision as of 20:27, 27 March 2016
Line 319:		Line 319:
	=Metasploit Apache Modules=		=Metasploit Apache Modules=

	Searching for Apache-specific modules yields more specific exploits:		Searching for Apache-specific modules yields more specific exploits. This is a bit overwhelming, and doesn't help much with figuring out where to begin:

	<pre>		<pre>
Line 351:		Line 351:
	exploit/multi/http/tomcat_mgr_upload 2009-11-09 excellent Apache Tomcat Manager Authenticated Upload Code Execution		exploit/multi/http/tomcat_mgr_upload 2009-11-09 excellent Apache Tomcat Manager Authenticated Upload Code Execution
	</pre>		</pre>

			===Figuring Out Where to Begin===

			Recommend starting with Nikos, as covered on the [[Metasploitable/Apache/Python]] page.

			This reveals the following vulnerability:

			<pre>
			+ Apache mod_negotiation is enabled with MultiViews, which allows attackers to easily brute force file names. See http://www.wisec.it/sectou.php?id=4698ebdc59d15. The following alternatives for 'index' were found: index.php
			</pre>

			Load the Metasploit module to take advantage of this vunlerability:

			<pre>
			msf > use auxiliary/scanner/http/mod_negotiation_scanner
			msf auxiliary(mod_negotiation_scanner) >
			</pre>

			More information from Metasploit documentation website: https://www.rapid7.com/db/modules/auxiliary/scanner/http/mod_negotiation_scanner

	=Flags=		=Flags=

	{{MSFlag}}		{{MSFlag}}

Admin: /* Where to Start? */

2016-03-27T18:49:36Z

Where to Start?

← Older revision		Revision as of 18:49, 27 March 2016
Line 24:		Line 24:
	Whew!		Whew!

	==Where to Start?==		==Where to Start==

	~~Let's~~ start with some ~~basic HTTP scans~~, ~~just~~ to ~~gather some info about~~ the Apache server ~~running on Metasploitable port 80 (~~we'll ~~ignore~~ that ~~Tomcat server for now, and come back to it~~ later.)		This article will cover techniques for exploiting the Metasploitable apache server (running Apache 2.2.8). It will start with some general techniques (working for most web servers), then move to the Apache-specific.

			This will also ignore the Tomcat server - we'll get to that later.

			More routes to attack the Metasploitable machine are over at [[Metasploitable/Apache/Python]]

	==dir listing==		==dir listing==

Admin: /* Fixed Telnet Request */

2016-03-27T18:38:16Z

Fixed Telnet Request

← Older revision		Revision as of 18:38, 27 March 2016
Line 308:		Line 308:
	</pre>		</pre>
	}}		}}

			===Fuzzing?===

			Fuzzing the phpMyAdmin login page (and attacking vulnerabilities in phpMyAdmin itself) will launch us into a whole new set of tools and concepts, so we'll leave that for the [[Metasploit/phpMyAdmin]] page and others.

	=Metasploit Apache Modules=		=Metasploit Apache Modules=