Now we're going to set up enumerate and exploit one of the only available intentionally vulnerable Windows
Server 2008 VMS Metis global 3.
First we're going to need to download and install vagrant which is a tool that simplifies the building
and managing a virtual machine environments.
I'm on windows so I'm going to be using that version
go ahead and download
execute DMA MSA file to install
next except next next install
once the download is complete restart your system
now open a command prompt with administrative privileges.
Now we need to create a vagrant file by typing in vagrant in it.
This is going to create a vagrant file in your current directory
now visit this get hub site to grab the vagrant file configuration for medal splitting all three this
U.R.L. and all commands.
As always is attached to this lecture copy this configuration and paste it into the vagrant file that
you just created in the system 32 directory.
Go ahead and open notepad as administrator.
Now go to the vagrant file that you created in system 30 to open
remove all of the text and paste the text that you copied from the Met a supportable 3 configuration
and save.
Now back to your administrative command prompt type in vagrant up
once vagrant is finished we'll have an intentionally vulnerable Windows 2008 VM and a vulnerable to
boot to VM to test on.
We should now be able to open virtual box manager and have them already loaded
at this point.
I suggest that you restart your computer because I had some virtual box errors that were resolved by
rebooting
as you can see we have two new VM is loaded into virtual box manager.
We're going to be focusing on the Windows 2008 VM in this lab but I suggest that you also have the Ubuntu
VM on your own.
Before starting meds relatable 3 let's make some configuration changes
right click the Windows 2008 VM click settings
go to network
change to host only make sure it's the same one you have for Kelly Linux there's two by default.
Just make sure they're both host only go to display now raise the video memory make it at least twenty
seven
go to remote display.
Uncheck enable server click OK.
Start the VM
once it's loaded.
You should see this screen.
Now let's go to Kelly Linux.
First of all let's find the IP address.
Note that net discoverable not work for this particular VM.
So we'll have to use an alternative method for host discovery and math is also a great tool for host
discovery.
So let's use that this command will run a host discovery scan on the host only IP address space
my results show that we have several hosts up here.
Remember that there are two Nicks configured on Mideast foldable three.
So there will be two separate IP addresses.
However they're going to serve the same purpose for our lab if you're unsure which IP is which just
scanned them all until you find the correct one.
Now let's enumerate some of the services and map hive and a IP address.
And that results you a big attack surface.
One thing that sticks out to me is this Apache web server that's running on a non-standard port.
Let's go ahead and visit that in a web browser and see what we get.
So visit the IP address of a supportable in Port eighty three eighty three
we see here that we have a log in page four manage engine desktop Central.
Mine let's see if there's any known vulnerabilities pertaining to this service with search for.
So go to a terminal real quick
type and search.
Floyd manage engine desktop.
Central line
all right.
We get a couple of results here.
So there are several known vulnerabilities but the one that sticks out the most to me is the ruby exploit
which is built into medicinally let's try that first
type in MSF console
now set up the exploit so use exploit for its large windows Ford's slash HDTV Ford slash manage engine
underscore connection Aidid underscore right.
If you're wondering how I found this information just google the string desktop central Meadow spoiled
and you'll get this exploit module on the first result.
That's how I quickly found the module to use here
said our host to the IP address of medicine portable 3.
Remember that there's two IP is configured so if one doesn't work try the other one.
Set the bar port two eighty three eighty three.
Set SSL to true.
Set local host to the IP address of Cally Linux is host only interface.
Run to start the exploit.
Awesome as you can see here we have a return British shell let's run a mature critter command to create
a CMT Daddy XY shell so type and execute type f CMB Daddy XY Ivan Ivan H
all right.
Just run a couple quick commands rom hostname all right.
Who are my
SO as you can see here were logged in as a split all three with the privileges of local service.
So we still need system level privileges in order to own this box.
Let's go back to the mature spirit or shell by pressing control and see
why determinate channel.
Now I want to see what kind of services are running locally that may have been missed by in math for
this goal.
I'll use the Net stat command and return error.
Just typing net stat
top of the results here.
I see the Tomcat is running on port 80 to 82.
Let's go to a web browser and see if we can access it
the IP address of Metro's affordable 3 and the port.
82 82.
OK.
Looks like we can access it.
Let me see this manager application.
OK so we need some credentials to utilize the manager application.
Let's go back to our limited shell and see if there is any insecure Tomcat configurations that will
show us the credentials in their default location.
Just going to execute another command shell here.
All right.
So with knowledge of the default Tomcat configuration location I'm going to change to directory see
changed the program files Apache Software Foundation
changed Tomcat
changed to Apache Tomcat directory here
change in covert directory
OK I see a file named Tomcat users not ex email
try to print the contents of that file so type Tomcat I think users dot excel.
See a username and password here split exploited.
Let's go back to the Web site and see if we can try these newly acquired credentials
click manager app try the user username split and passwords Floyd.
Great.
We're in
I see right away that there is file upload capabilities we should be able to upload a malicious war
file to acquire a remote shell a web application resource or war file is commonly used to distribute
collections of Java server pages and such but there's a well known vulnerability in this version of
Tomcat that can be exploited with menace Floyd let's put that theory to the test first we need to generate
a malicious payload with MSF venom so let's open up a terminal
this command will create a malicious war file which will attempt to connect to our Kelly Linux VM make
sure to change the El host to reflect your host only Kelly Linux VM
once complete switch back to your web browser
click browse
select your malicious war file
click deploy
after successfully deploying your war file go to a terminal and set up metal splits multi handler
type an MSF console
use exploit multi handler said l host to the IP address of Cally linux host only IP address set l port
set up to 4 4 4 5
set payload same payload that we used when we created the malicious Moore file so Java GSP shall reverse
DCP
started listener back to the Web site
now let's execute the malicious war file just click on the location where it was uploaded
as you can see the exploit was successful.
Now we have a remote shell.
Let's go ahead and check our privileges.
Fantastic.
We have system level privileges.
This is just one way to go about hacking let us split all three.
I advise that you take your time and figure out all methods of exploitation on your own.