METASPLOIT FRAMEWORK

USE TO  AUXILIARY MODULE FROM METASPLOIT

First of all, I have used the auxiliary modules from Metasploit-Framework which could allow me Scanning, see ports, SO version, vulnerability in applications etc, where you can see at the bottom of the picture if  I use this module whose name is:

• auxiliary/scanner/discovery/arp_sweep (To verify the IPs listening in the network)

Now, we can observe that when I have selected in the auxiliary module I have had to do this set up  that we can observe in the second page below:

• INTERFACE: This I've set up the network interface that in my case is the eth0 interface.
• RHOSTS:This I've set up the IP Address which I am finding out that in my case is 192.168.100.0/24 (all the IP Address from network that could be possible which I am analyzing).
• THREADS: Are the threads; it's the fast  that I want to analyze the IP Addresses but in my case there are 15 threads because I want to analize as fast as possible.  

 In the picture below, we can observe that the scan has been successful because I have discovered 4 Ips:

• 192.168.100.210 (ROUTERBOARD)
• 192.168.100.237(CADMUS COMPUTER SYSTEM)
• 192.168.100.238(REALTEK SEMICONDUCTOR CORP.)
• 192.168.100.253 (UNKNOWN)

  In addition, we can see I've discovered 3 Ip addresses but 1 IP Address it's unknown so I'm going to focus on 3 IP Addresses that you can in the picture below.

SCANNER PORTSCAN TCP

In addition, as I have chosen the IP Addresses which I must scan, this is the time by use the new module whose name is: auxiliary/portscan/tcp, and I will be able to see the open ports over the different IP Addresses that you can observe in the picture bellow wherever there is this set up:

1.  RHOSTS: This is the Ip Address which I have to analize because I want to know if there are some open ports, in  case are: 192.168.100.210, 192.-168.100.237, 192.168.100.238.
2. RPORT: This is the port which I want to analyze but I can write a port or a range of ports such as: (1-200)o 22 o (49,90,45.80,21) etc.
3. THREADS: In this paragraph  there are  the threads because I need to obtain the open port as fast as possible.

“IMPORTANT: THIS CONFIGURATION HAS BEEN REALIZED WITH THE SET COMMAND SUCH AS FOR EXAMPLE: SET RHOST 192.168.100.237 AND IF YOU WANT TO EXECUTE, YOU HAVE TO WRITE RUN AND PRESS THE BUTTON”

 In the picture below, we can see the set up that has been realized by me with different options:

• RPORT: The ports or range of ports I would like to analyze.
• RHOSTS: The IP Address I'd like to analyze.
• THREADS: The threads will give me the analyze most sophisticated in this part.

 

In the next picture below, we can see as the scan has been successful.

In my case, I want to focus on the port from FTP which  correspond to  21 number.

SCANNER FTP VERSION

In this paragraph, as I've chosen the port which I want to intent attack, I have selected other module whose name is auxiliary called scanner/ftp/ftp_version, where I want to intent obtain the service FTP version  which is open and listening.

In the picture bellow, after I had written the command called  options  in which  I will be able to see the different options from  exploit ,module or  if I want to try to configure it. Also, we can observe that only I need to ingress the IP Address from machine which I want to do the scan, in my case is this IP; 192.168.100.237, I use the set command + the IP (set 192.168.100.237) and finally, we have to execute the run command because  we want to start the scanning.

To sum up,  we can observe that the scanning has been successful, but the most striking it's the scan has had a banner grabbing (where we can see such for example the version of operative sistems, the operative sistems open ports etc.), in my case is a ftp called  vsFTPd  whose version is 2.3.4.

    

SCAN FROM THE VVERSION vsFTPd 2.3.4

NMAP

Now, through the nmap tool it's one of the greatest tools for the scan and vulnerability analysis , I'm going to verify if the version isn't a false-positive because after I want trying to explote the vulnerability from FTP service. For it, I have to use the different options from nmap tools:

1. -n: To prevent me from getting DNS resolutions in reverse, i.e. in the wrong way, I can wrong.
2. -Pn: To prevent me if the 21 port it's open and the ports which I've scanned with the  auxiliary module  auxiliary/portscan/tcp to verify me.
3. -sV: To try to me the possible versions of Operative Sistems of the machine.
4. -A:  To try select the personality scripts which hast nmap and obtain the exact versions of the Operative Sistem with the version of Operative Sistems.
5. -vvv: To try give  all step by step of IP Address scanning.

In the picture at the top we can see how the scan has obtained the same version and application that may be vulnerable in the port  with the  same version called vsFTPd 2.3.4.

 METHOD “VULN” 

Right now, in this paragraph I'm going to use a that is so useful if I want to discover vulnerabilities (security flaws) in the operative sistems whose name is “vuln”, where the nmap command will be:

• nmap -n -Pn 192.168.100.237 --script “vuln” -vvv

To sum up, I have discovered with the vuln param a vulnerability (flaw/security hole), which has been created both in exploit-db such as Metasploit it's in the second picture bellow, whose module is:

• exploit/unix/ftp/vsftpd_234_backdoor.rb

 VULNERABILITY EXPLOTATION

Firstly, to explote the vulnearbility that is created with Ruby was discovered in the year 2011.  I've used the search commands that you can find out since Metasploit: 

• search type:exploit name:vsftpd_2.3.4

In the picture bellow, you can see that I've discovered the exploit that I'll execute just after.

Although, we can enter to both way:

1. Using the way easiest which is the use command and with the identify number that is 0, we can see at the top of the picture.
2. Using the most common where we can write the full exploit:

•  use exploit/unix/ftp/vsftpd_234_backdoor  that we can see in the picture below.

Finally, to finish exploiting the vulnerability found above, we simply have to configure the RHOSTS parameter which is the IP of the victim machine which in my case is 192.168.100.237 and finally, we will use exploit to obtain the Shell, and we can see that we have obtained access to the remote machine in the images below.

    

Thank you very much for reading the article 

I hope you  liked it and learned something new 

Good hack