Ed Moyle: Hello, and welcome to this TechTarget
video. I'm Ed Moyle, and this is a companion video
for the article about using metasploit that you
may have seen up on the site. So I'm just going to
walk through another example of how to use the
medispa framework in a attack context, so how to
utilize an exploit to, to gain remote access to a
machine that that you may want to get access to.
So that that could be a penetration testing
scenario, it could be, you know, testing of a
particular issue that you may encounter kind of in
your, your own environment, you know, may just be
for the purposes of testing just because you want
to educate yourself on the tool for whatever
reason, we're just going to walk through how you
might do that, should you want to. So in order to
get that set up, if you want to follow along, I'll
draw your attention to the fact that the setup for
this is actually pretty simple. It's the same
setup that we had, when you know, for the purposes
of that article. So there's two running virtual
machine instances. So I'm using a hypervisor here
I'm using VMware Workstation, I just happened to
to like that one, but you don't have to, you don't
have to go with with that choice. You can use
VirtualBox, you can use Hyper V, you know, really
you can use whatever kind of hypervisor you want,
you know to emulate this kind of same scenario can
use you know, your the hypervisor of your choice.
Um, so I have two instances running, right. So the
first one is a default, Kali Linux instance, I've
just used the stock virtual appliance that they
have available on their sites. If you go to, you
know, Kali Linux, to the download page of that
site, you'll notice that one of the options that
they have there is virtual appliances. The reason
that I'm using Kali to do this is because of the
fact that it has the meta sploit framework built
into it already. So it just comes with it, you
don't have to do anything. It's just up and ready
to go. So this is completely stock. I haven't even
changed the passwords or usernames as you can or
machine name or anything like that, as you can
tell from from this prompt here. So that's image
number one. The other image is the meta
splittable. To image submit, exploitable, if you
recall from the article is a virtual machine image
that's designed to be vulnerable to a number of
different attacks. So we're actually going to use
that one because of the fact that it the purpose,
its its whole raison d'etre, the reason it exists,
is to be able to be attacked by meta sploit. So
because of that, it's a really good learning tool
for you to become familiar with the meta sploit
framework commands, and what they do and how to
use them. So. So that's what we're using. So so
it's the Kali Linux and meta splittable. Now, of
course, there are, as you can imagine, from the
fact that it's meta splittable to there are other
versions of meta splittable. So if you want to try
a different one, you're certainly welcome to do
that. But in this case, we are just using the meta
splittable to version. So I'm going to zoom us in
here, just so that we can actually get to work. So
the first thing that I'm going to do is I'm going
to use n map. Now in the article, you saw how we
used actually the metta sploit framework itself,
one of the auxiliaries to do port scanning. In
this case, we're just going to do an Nmap. Because
Well, you know, mix things up a little bit. And
I'm just going to put the IP address in there. So
I'm just going to do a basic scan, nothing fancy.
And then let's just kind of pick the first one. So
we notice the FTP service here. Let's see what
kind of FTP service that is. So we'll just use our
handy dandy Netcat. And we'll Netcat over to that,
and see what kind of you know, see if the banner
tells us anything, and it does. So it tells us
that it's vs. FTP, FTP, D. So that's the very
secure FTP daemon. Now, in this case, the very
secure name is a little bit ironic, because this
particular version of vs FTP happens to have a
backdoor that's built into it. So we're actually
going to exploit that. So to do so, we're going to
bring up MSF console, which you may recall from
the article, that's to just enter the medispa
framework console environment that we can use the
to actually enter our commands. So it brings it
up. The very first thing we'll do is we'll start
and see if we'll, we'll use the search command to
see if there is anything matching vs. FTP. And it
turns out that there is, as we suspected there
might be there's a vsftpd tooth version 234 and
you'll notice that up here is It's version 234.
backdoor, so we can actually use that one. So
let's just go ahead and we'll use the use Command
and tell it to use this particular exploit. Now,
we can type the full name, we can use this number
two. In this case, we're going to type the full
name, just because why not be specific. The next
thing that we're going to do is to configure the
payload. Now, normally, with a lot of exploits,
there are a bunch of different options that we
might have for specifically what payload to use.
In this case, though, there's really only one. But
let's pretend that we wanted to see all of what
the compatible payloads are. You'll notice that as
we expected, there's only the one and it's already
set to the default. But let's let's just
explicitly set it anyway, just for for the
purposes of exercising that functionality. So in
this case, again, we can put the full name there,
or we can use the number but we're we'll go ahead
and use the full name. And now we need to know if
there are any other options, configuration options
that we might need to set. So if you remember from
the article, the command for that is the show
command. And then we'll say show options. And
that's going to tell us what all the various
different options are, that are required for this
particular exploit and payload combination. So in
this case, because we picked on purpose, a fairly
simple one, there's only one that's required for
us. And that's this value our hosts. Now, our
hosts that are in that is the remote host, IP
address. So we'll actually set that set our hosts,
and we'll put the IP address of the remote meta
splittable in there. So that is now set for a lot
of exploits that you might exploit payload
combinations that you might want to use, such as
the one that we demoed. in that article, you'll
notice that you'd want to also set the L host and
l port value. You know, and in some other
combinations that can get even more complicated
than that. But we're doing a very simple example
just to get you familiar with the, you know, with
kind of the, the the various commands and the kind
of the normative use are simple you so so so we'll
you know, we'll use this one. That's, that's, you
know, fairly straightforward. So that so we'll
show options, again, helpful if I spelled it
right. And you can see that all of the various
different things that it wants are now complete,
they're now filled in. So in this at this point,
we can actually go ahead and use the exploit
command, which will actually begin our exploiting.
And in this case, it's going to give us a remote
shell on that instance. So you'll see here it says
command shell session one opened. Now, what does
sometimes throw people, particularly if they're
not used to using tools like this or exploit code?
or what have you, is that they wonder where the
prompt is, which is useful to talk about. So in
this case, we don't there's no prompt that's being
shown to us. And the reason for that is because of
the fact that that we're using an exploit. So it's
not an interactive environment that's been
designed for the purpose of providing helpful
information to the user. It's, you know, it's,
it's, it's kind of, you know, a backdoor in,
right. So it's really not anticipated that
somebody would, would be, you know, be in their in
this way. So, in this case, we don't actually have
any kind of prompt, but you'll notice that if we
put a simple command in there, so in this case,
let's say Who am I, we just type that. And it says
that we're root. So that's always a good starting
point. So we'll go ahead and test that theory by
trying to do something like cat, the font, the
shadow file, which turns out that we can do that
too. So, you know, from at this point, we can
pretty much do whatever we want. So if we wanted
to, we could put, you know, a flag file there, if
this is a pen test, and we wanted to demonstrate
that we had writable access to the root filesystem
wouldn't go ahead and do that. And then if we
wanted to, you know, list that value, you could
notice that that flag is right there. So the point
being that we just went through all of the various
different options that you know, and commands, you
know, arguably simple, some certainly simple ones
on purpose that to demonstrate but, but really,
this is at its core, pretty much the majority of
how you would use the mat display framework, at
least for a penetration testing type use case. Now
of course, the hard part as you could probably
tell both from
reading The the article as well as looking at this
demo is not the syntax of using the Metis blade
framework itself. That's actually the easy part.
It's easy in large part because of the fantastic
work of all the folks who work on this tool, who,
you know, have made it easy and made that
interface standard and consistent. But, but the
fact of the matter is, is that, that it is
standard and consistent. So it's not the hard
part, the hard part is actually going to be
finding out for the, for the device that you want
to attack, what is it vulnerable to, and actually,
that is where your reconnaissance comes in. That's
where your vulnerability scanning comes in. That's
where your knowledge of the environment comes in.
So if you're concerned about a particular issue,
say like, you know, MS, you know, the, the eternal
blue, Ms 717, whichever one that was the, the
eternal blue vulnerability, that one, you would,
you know, use that as kind of your starting point
and then utilize the specific exploit within
medispa framework to make use of that and exploit
it and gain access. So that's really kind of it in
a nutshell. So at that with that, you know, I will
thank you for your time and hopefully this was
helpful to you and learning how to use the meta
sploit framework.