All right.
Let's get back to our noses and MAP results and put together an attack plan.
Take some notes devise a plan and see how we're going to break into the target.
And more than one way.
So let me go back to the filter and I'm going to again filter by exploit available just to make sure
that I'm looking at vulnerabilities that I know have an available exploit.
And here they are.
If we start with the first one the SSL multiple issues.
We know that there are a couple.
We've seen one of them already.
Let's double check the first one.
And again similar to the second.
This is only exploitable by court impact.
For now we're going to believe what the networks report says.
And we're going to assume this is correct information and we're going to leave these possibilities alone
because we don't have the core impact tool.
So let's go back to the vulnerabilities and I'm going to look at the second one the NFL to exploit a
chip.
So this is a shared drive on Linux that is being exposed.
It doesn't look like it gives us more chill.
But let's double check Andrew that he does anyway.
So here we are.
It says there's a share that if you can mount it remotely you'll be able to read its content and that
you are actually able to connect to it remotely.
All right.
Let's leave this be.
Let's move onto the third one.
Unreal.
I see these backdoor detection.
Now this tells me that there is a remote server that is running and that is vulnerable and exploitable
with met exploit.
And notice that NASA's gives you the exact name that you can find and Metis Floyd the exploit name that
is.
So keep that in mind.
Now let me go back to the map results as a matter of fact.
You know what.
Let me know down what I've been telling you.
So let's go ahead and write down what we're just discussing.
I'm going to copy that.
The unrated back to early detection and I'm going to put it in my notepad and next to it I'm going to
write met this plot.
Just to remind myself that this is exploitable by metal split.
No let me go back to the map results.
I'll start from the top the first thing that we see is FTB server running on Port 21 that is called
the S F TBD.
So I'm going to copy that and add it to my list of notes I did mention very briefly in previous videos
something called vulnerability mapping and vulnerability mapping is when you try and find vulnerabilities
that affect a very specific version of a software and you map it to that software so you can later try
and exploit it.
And this is what I'm going to be doing now.
And it can be as simple as searching for exploit.
And the name and the version of the server affected so if we look at the results here.
The second one you can see is a Web site called exploit D.B..
And the people behind this Web site are the same people that are behind at this point.
This is basically a database of exploits available that you can find online for free.
And as soon as you open this exploit you'll notice straight away that it says that this file is part
of the method upload framework.
In other words this exploit code that you see here is already integrated with MIT exploit.
Why is this so important to us.
Because before that was meant exploit what we had to do is go and look around on the Internet and find
exploits that people have written so that we can take and customize to our need.
So if you would have found an exploit laying it out on the Internet chances are that it wouldn't have
worked.
You would need to understand the code behind the exploit and you would need to be able to change bits
and pieces of the code for example the targeted IP address.
What kind of action you want your exploit to do.
You wanted to create a more child you wanted to add a user so you can log in.
What is it that you wanted to do and a lot of other parameters that could have broken the exploit if
not successfully configured.
So if you could enter and exploit code or you didn't know how to code you'd on exploit you wouldn't
have been able to use exploits that were lying around on the Internet and what method employed did is
that it came and collected most of these exploits and put them in a unified framework and made it very
easy for us to customize these exploits.
In other words instead of me digging and sifting through the code of the exploit to be able to manually
change the IP address of the target and manually change the port number and so on I can do that through
methods ploys and methods both will go ahead and change that on my behalf so that I can just run the
exploit.
And it would be as easy as one two three.
And this is here the name of the exploit that I will be able to find and met Floyd.
So I'm going to go ahead and keep another note saying that this is the name of the exploit and that
it is also available and met a split
let me go back to my map results.
I'll scroll down
and I told you already.
Keep note of this.
The summer assembly the version three point zero point two zero.
So just keep that in your notes and let let's move on to another one which is the pro FTD version one
point three point one.
I'm going to do the same thing that I did with the ESF TPD.
I'm going to look for an exploit for this.
Now NASA's doesn't mention anything about it so I'm just going to do my own research and this is the
process of trying to find an exploit to your vulnerability now the first thing that I see is a pro FTD
IAC version one point three point x x means it could be any number it could be point one point two point
nine whatever it is.
But when I opened the exploit it does not look like it's an exploit for metal split.
So unless you knew how to read this code and you knew how to tailor or edit this code chances are it's
not going to work.
So I'm going to leave this for now and I'm going to try and find something that I can use through might
exploit.
So let me try pro FTB.
1 2 3 1 meter split and see if I can find anything.
By having a quick look it doesn't look like there is much going on in that regards.
I can see an exploit that affects version one point three point three but that's not the version of
my server that I'm trying to target.
So this isn't going to work.
All right.
Let me go back now and pick a target.
I'm going to go with the v s FTD version two point three point four because with a little bit of research
I know that this is a vulnerable target.
I know that there is an exploit and a method deployed that that will allow me to take advantage of this
weakness to look for this exploit and might exploit.
All I have to do is type search and V.S. FTD the search functionality and a method deployed accepts
any keywords so you can type BSF TBD you can type windows you can type a CV e number you can type whatever
it is that you want and us both will go and search for that and present you with any results that it
finds in our case that is only one exploit that affects v s FTD.
And it looks like it's exactly what we want the V.S. FTD version 2.0 3.0 forward backdoor command execution
so now I need to tell my dad deployed that I want to use this exploit and it's as easy as saying use
and the path or the name to the exploit.
Now here you'll notice that the words are popping up very quickly.
That's not because I'm a super fast Tyler.
No that's because I'm using the auto complete functionality which you can do using the tab.
So just type a few letters for example e XP and type tab and Mateus Floyd will auto complete it for
you once you hit enter.
You'll see that the prompt has changed.
Notice that from M.S. 5 it changed to MSF 5 exploit and the red color the name of the exploit.
Meaning now you're operating from within the code of the exploit.
Let me try and clear the screen
hope that doesn't look like it's work.
Sorry.
I'm used to the Cali Linux version and that usually works.
Never mind.
Let's carry on anyway.
Now what I want to do is I want to set up the options of this exploit.
Remember what I told you we would have in the past needed to do this manually set up the IP address
that we're targeting set up the port number that we're targeting and other parameters now and methods
Floyd.
We can do this from within the framework to be able to see what are the options that I need to configure.
All I have to do is type options and hit enter and look at these columns here.
The column that says required yes means that I need to fill these gaps.
So this one is already filled.
This test port 21 and let me go and double check that.
This is actually running on Port 21.
Yes it is.
This is according to and map.
So the only missing piece is the odd hosts the set the odd hosts.
All I need to do is type a set of host or hosts and the IP address of my target.
Now let me double check that it is a set of type options again.
And here we go.
You can see the IP address set next to the hosts.
Now in Metis Floyd we do have the option to try and check the vulnerability is actually exploitable
or not.
Before we run the full exploit and this is useful to make sure that the service we're trying to break
into is actually 100 percent exploitable before we run the exploit and risk caching the service because
running an expert.
Unfortunately sometimes could end up crashing the server.
So we have to be very careful with that.
Now in this module it doesn't look like check is supported.
There is no check option.
So I'm going to have to just go ahead and run the exploit and hope for the best site type run and hit
enter
and it looks like the exploit is running.
And the second you start seeing these green plus signs.
This is usually a very good sign.
And here we go.
We have a Comanche session open.
Now it doesn't look like much is happening but that's absolutely fine.
The commercial is open but you just do not see a prompt.
You can still type commands and you will get the output.
So let's do the idea command that we already saw in previous videos.
I type I.D. and it tells me that I managed to break and as the user route which is great news.
I have the ultimate power over the system now.
So now I have a remote command shell and I have access as the root user.
Let me try to run the other command that we saw which is the less that lists the contents of the directory.
And here we go.
We have the contents of the directory listed now similar to what we saw with telnet if I want to exit
this prompt all I have to do is type exit and I'll go back to the method deployed prompt to get out
of the configuration of this particular exploit and go back to the main menu.
All I have to do is type back hit enter and I'm back to the original prompt.
Perfect.
So this is the first exploit that through it we managed to break into the target's system and compromise
it as the root user.