Attacking Metasploitable - Apache Tomcat - Metasploit Tutorial

Hello guys,
Here's my second Metasploitable-Attacking video. Today we will exploit Apache Tomcat in Metasploitable use Metasploit of course.

Attack description:

1. We did a full nmap port scan, and I detected tomcat installed in the server on port 8180
2. Search for tomcat in Metasploit console "msfconsole" command to find any kind of auxiliary, and or an exploit available for it
3. We found a good exploit which allows command execution, but it needed the USERNAME and PASSWORD of the target server
4. I executed an auxiliary that tried the default tomcat Login details on the target server (This is good when the server admin uses bad passwords)
5. We found the login details, That made the code execution exploit possible to use now
6. We execute the code execution exploit, and we get shell access (You can change the payload, but you don't really need to)
7. After we get the shell access, as we search in /root directory, we find /root/.ssh/authorized_keys
8. As I saw in a post by g0tmi1k about the same attack, those keys have weakness (READ MORE HERE)
9. We download "rsa" weak keys to kind of crack the key, the file can be found on exploitdb search "/pentest/exploits/exploitdb/searchsploit" search for the term "OpenSSL"
10. Download, and extract the file, using "grep -lr KEY *.pub" we will find the right one.
11. Connect to the server using the key, (you will find a file in the previous step with NUMBER.pub take the number) then run the command:

ssh -i NUMBER root@IP

And you're done, root access granted ^_^

Video Demo:

Video Available in HD, just change the Quality!

Read More

Attacking Metasploitable - Samba Sever - Metasploit Tutorial

Hello guys,
Here is the first video of my Metasploitable attacking videos!
In this attack we exploited Samba server (which is vulnerable).

First thing I did was scanning the target IP with nmap, it will a slow and almost complete scan.
I got the IP from Metasploitable it self by running "ifconfig"

Then after detecting samba server in the target, launch Metasploit, search for the keyword "samba"
A list of exploits will show, all you have to do is type:

use exploit/path/to/exploit

After you use that command, type "show options" to see what that exploit needs, and see the options you have.

when you set your hosts, and ports; type "exploit" And that will run the exploit.

After we exploited the target, we got root access, which is exactly what I needed!

Video:

Vimeo Link: https://vimeo.com/65082563

Read More