In this video, we're going to walk
through our basic demonstration of a penetration test.
We're going to be attacking a virtual machine
from the TryHackMe.com website, which offers vulnerable VMs
for practitioners to sharpen their skills
and really put theory into practice.
In a traditional penetration test,
there are five general phases.
We're thinking about reconnaissance, scanning,
vulnerability assessment, exploitation, and reporting.
But in this demo, we're only going
to focus on the scanning, vulnerability assessment,
and exploitation phases.
We're going to be exploiting an old vulnerability
known as EternalBlue.
Now, here's a little background about it.
EternalBlue is a cyber attack exploit developed
by the US National Security Agency or NSA.
It leverages a vulnerability
in the Microsoft's implementation
of the Server Messaging Block Protocol
to gain unauthorized access
and control of computers running certain versions
of Microsoft Windows.
Now, the tools we're going to use in this test will be Nmap
and Metasploit from the Kali Linux platform as you see here.
And you can think of Nmap, kind of like a treasure map
of the Internet or computer networks.
It helps you find computers and services like websites
and email systems on that network.
It can help you find out what's on the network,
whether it's one computer or thousands,
and you can see the services running,
and of course that will be open.
Metasploit is kind of like a toolbox
for testing computer systems security.
They can check to see if the system has any weak spots
aka vulnerabilities, and even simulate attacks
to see if the system is secure.
And again, it's mostly used for people who really want
to secure the systems or penetration testers as ourselves.
Okay, enough of that.
That's a great overview, now let's get started.
Okay, so let's go to our terminal here.
And now let's break down the Nmap command
that we're going to use.
Now, the first thing we want to do is just type
in the Nmap command by itself to see the available options.
Okay, so when you do this,
of course you can see all the available options
to make it more specific to what you're looking for.
Okay, so that's just something really quick
to keep in mind.
Right, so let's clear this.
Now, what we're going to use is the -sV option
and the -sC option.
Okay? So we're going to start off
with a command like this: nmap -sV
See, we're going to use the script for vulnerabilities,
we're going to use a 10.10.
Okay, so let's break down this command.
So, of course, we have the Nmap command
which starts the actual Nmap scanner and the -sV option.
Now, this switch is used to detect the version.
It allows Nmap to determine what version
of a service is running on a specific port.
And this information can be useful
for identify potential vulnerabilities
and specific versions of services,
because when it comes to vulnerability assessments,
everything really is relative to the version
of the software that's running.
Okay?
Now, the -sC option, that's just a shorthand
for script equals default, meaning that the scripts
that we're going to be running is going
to be the default ones
that's associated with Nmap.
And so we're going to be running the vulnerability script
on 10.10.19.96, which is our target machine.
Okay, let's press this.
We can give it a little time to go through.
Okay, so let's break this down really quick.
Let's scroll up to the top.
Alright, now one thing
to really focus on is the ports,
the state, and the service that's running.
Now, you can see here,
Nmap displays things in a particular format.
So, of course, we see the port
and we're going to be using the TCP protocol,
the state open, meaning that it's accepting requests.
And then we see it has a host
of different services that's running.
So let's look up some of the important parts.
So the host is up,
meaning that it's powered on, accepting request.
Now, let's reference to the port state,
and we're going to identify what the states mean.
So, they're going to typically be in three positions,
either: open, closed, or filtered.
Now, the open state means
that the application on the target machine is listening
for connections packets on that port.
In other words, the service is ready
to accept TCP connections or UDP packets.
If any port is open, it could potentially be a point
of vulnerability if the server is running
on it has a security weakness.
Now, just think of an open port as a window to a house.
That's a possible way
for an intruder to get into the window.
Now, if the port is closed,
like the other state it can be in,
this state indicates
that no application is listening on this port.
Now, how the system identifies this is
because a closed port responds to Nmap's probe packet
with a TCP reset packet
or an ICMP Type 3 Code 3 message for UDP.
Now, this informs the scan
that there's no service listening.
While closed ports are not generally useful for a text
in and of themself, they can help an attacker understand
what services a host does not offer.
Now, if you are using Wireshark or something like that,
you will be able to see this in real-time.
And again, that's how the system understands
if the port is open or closed,
by the response that the system gives,
and this is all standard responses
based off RFC protocols.
Now, a filter state means that the probe packet sent by Nmap
to the port was dropped by some type of filtering system,
typically a firewall, packet filtering, router
or intrusion prevention system.
Nmap cannot determine whether the port is open
because the packet just doesn't make it to the destination.
Filter ports make it a little bit more challenging
for attackers to gain information about the target
as they cannot conclusively determine the state of the port.
Because if you had the correct IP address,
you would be able to access that particular port.
But given that you do not
have the correct source IP address, you will never know.
Now, on this example,
it's not going to actually show the different ports
because it's only going to show the ones that are open.
If you were to do a traditional Nmap scan
and you wanted to see all of them,
whether they're open or closed or filtered,
the system could do that for you.
Okay, let's kind of scroll down here.
Now we see it's vulnerable to multiple types
of attacks, okay?
And this is very useful because remember earlier I described
that we're going to go through the scanning
and vulnerability assessment?
One good thing about Nmap is it combines them into one.
So we scan the system
and we also get a vulnerability assessment as well.
One thing to note,
many systems are vulnerable to many different things,
but not all offer the benefits that you would need.
Now we're going to focus on one particular vulnerability,
and that's going to be here,
the Samba vulnerability MS17-010
So what we're going to do is use the ms17-010,
and we're going to search that
in our Metasploit framework database
and it's going to offer up already pre-crafted payloads
that will exploit that vulnerability.
Okay, let's do that next.
I like to keep things nice and neat,
so I'm going to open up another terminal.
I'm going to minimize this.
Now, to start the Metasploit framework,
we're going to type in the msfconsole.
Okay, we're good to go.
Now what we're going to be attempting
to do is something called a TCP reverse shell.
Now, that's a type of shell
where the targeting machine communicates back
to the attacking machine.
Now, the attacking machine has a listening port
on which it receives the connection.
By using this approach,
it can bypass the firewall restrictions
on the target machine.
Now, let me show you really quick.
Now again, this ms17-010,
that is the security patch update
that you're supposed to apply to your Windows machine
to make it less vulnerable.
So again, there's multiple ways to search these things.
So again, if we wanted to, we could have searched
for the actual exploit, which is EternalBlue,
and we see we get the same thing, right?
So we're going to focus on the EternalBlue portion of it,
and we're going to use that payload.
It's going to be zero,
and we're going to show the options, right?
Let's look at how it's configured.
Now, what I was speaking about earlier is
with this TCP reverse shell,
if you look at the payload options towards the bottom half,
you'll see the local host.
Now, that's something that needs to be configured,
because when you're using a VPN,
your local host is going to be different
from the one that's currently set.
So, we're going to set that really quick.
Set. All right.
Next we want to set our host,
which is going to be the remote host,
so it's going to be 10.10.19.96.
Perfect.
When we're looking at the local host,
that's going to be the listening port
that this TCP reverse shell is going to be listening on.
So, we're going to try
to exploit this particular vulnerability
and we're going to open a shell
or pretty much a command prompt on that machine
and send it out back to us.
Because typically when you're looking at firewalls,
it's easier to have the machine that's internal,
which is considered safe,
connect an outbound connection
versus an external which is not safe,
establish an inbound connection to a shell.
So that's where we're going to use a
TCP reverse shell, right?
So it seems like we have everything configured.
We can show the options again and make sure it's still good.
Okay, now I'm just going to run this.
Typically when you see it says meterpreter,
all the way to the left,
that means we have established this remote shell.
So we can look at, ifconfig command,
and you see here when we see the interface 14,
see the IPv4 Address, 10.10.19.96.
That means that we're in.
Okay.
Now, again, there's multiple things you can do
after this portion of the attack,
but it's going to get very in depth.
So I just wanted to show you the beginning from scanning,
identifying the vulnerability,
and then exploiting it using Metasploit by adding a payload
and getting a reverse TCP shell.
And now from this point,
an attacker can do whatever nefarious purposes
that they're looking for.
They could install a root kit,
they could perform a hash dump and steal passwords.
Now again, with a traditional penetration test,
that's where we're going to do all the reporting.
Now, I hope this short demonstration video
has been insightful for you
and I'll see you in the next one.