Metasploit Framework MSF - Revision history

MelissaLi at 08:19, 31 January 2020

2020-01-31T08:19:03Z

← Older revision		Revision as of 08:19, 31 January 2020
Line 13:		Line 13:
	In order to complete these steps, you must have followed Metasploit Framework, Metasploitable3, PostgreSQL or MySQL Installation Documentation before.		In order to complete these steps, you must have followed Metasploit Framework, Metasploitable3, PostgreSQL or MySQL Installation Documentation before.

	== Description ==		== Description of exploit ==

	This is a short Step by Step guidance to run an exploit against a Windows Server 2008 in a virtual machine. Therefore we chose the Application ElasticSearch prior to Version 1.2.0, which is already installed in the Metasploitable3 virtual machine from Rapid7.		This is a short Step by Step guidance to run an exploit against a Windows Server 2008 in a virtual machine. Therefore we chose the Application ElasticSearch prior to Version 1.2.0, which is already installed in the Metasploitable3 virtual machine from Rapid7.
Line 19:		Line 19:
	The module ''multi/elasticsearch/script_mvel_rce'' exploits a Remote Command Execution (RCE) vulnerability in ElasticSearch. The REST API allows dynamic scripts execution without authentication. The remote attacker is able to execute arbitrary Java Code on the target system.		The module ''multi/elasticsearch/script_mvel_rce'' exploits a Remote Command Execution (RCE) vulnerability in ElasticSearch. The REST API allows dynamic scripts execution without authentication. The remote attacker is able to execute arbitrary Java Code on the target system.

	=== Step 1 ===		=== Step 1: open msf tool ===

	Enter the command in the shell to open the terminal of the framework:		Enter the command in the shell to open the terminal of the framework:
Line 27:		Line 27:
	[[File:msfconsole.png]]		[[File:msfconsole.png]]

	=== Step 2 ===		=== Step 2: nmap scan ===

	Enter the command in the shell to detect the open ports of your virtual machine:		Enter the command in the shell to detect the open ports of your virtual machine:
Line 41:		Line 41:
	[[File:services.png]]		[[File:services.png]]

	=== Step 3 ===		=== Step 3: search module ===

	Enter the command in the shell to search for a exploit module, named elastic:		Enter the command in the shell to search for a exploit module, named elastic:
Line 49:		Line 49:
	[[File:exploitSearchElastic.png]]		[[File:exploitSearchElastic.png]]

	=== Step 4 ===		=== Step 4: use module ===

	Enter the command in the shell to use a exploit module:		Enter the command in the shell to use a exploit module:
Line 63:		Line 63:
	[[File:exploitElasticInfo.png]]		[[File:exploitElasticInfo.png]]

	=== Step 5 ===		=== Step 5: show module options ===

	Enter the command in the shell to show the module options:		Enter the command in the shell to show the module options:
Line 71:		Line 71:
	[[File:exploitElasticOptions.png]]		[[File:exploitElasticOptions.png]]

	=== Step 6 ===		=== Step 6: set module options ===

	Enter the command in the shell to set the options:		Enter the command in the shell to set the options:
Line 91:		Line 91:
	[[File:exploitElasticOptions2.png]]		[[File:exploitElasticOptions2.png]]

	=== Step 7 ===		=== Step 7: vulnerability and exploit ===

	Enter the command in the shell to check the vulnerability of the system:		Enter the command in the shell to check the vulnerability of the system:
Line 107:		Line 107:
	The connection to the meterpreter should be opened to perform post-exploitation. If this is not working, maybe check your firewall configurations.		The connection to the meterpreter should be opened to perform post-exploitation. If this is not working, maybe check your firewall configurations.

	=== Step 8 ===		=== Step 8: meterpreter shell ===

	Enter the command in the shell to open the Command Line Interface CLI of the target host:		Enter the command in the shell to open the Command Line Interface CLI of the target host:

MelissaLi: /* Description */

2020-01-31T08:13:58Z

Description

← Older revision		Revision as of 08:13, 31 January 2020
Line 17:		Line 17:
	This is a short Step by Step guidance to run an exploit against a Windows Server 2008 in a virtual machine. Therefore we chose the Application ElasticSearch prior to Version 1.2.0, which is already installed in the Metasploitable3 virtual machine from Rapid7.		This is a short Step by Step guidance to run an exploit against a Windows Server 2008 in a virtual machine. Therefore we chose the Application ElasticSearch prior to Version 1.2.0, which is already installed in the Metasploitable3 virtual machine from Rapid7.

	The module multi/elasticsearch/script_mvel_rce exploits a Remote Command Execution (RCE) vulnerability in ElasticSearch. The REST API allows dynamic scripts execution without authentication. The remote attacker is able to execute arbitrary Java Code on the target system.		The module ''multi/elasticsearch/script_mvel_rce'' exploits a Remote Command Execution (RCE) vulnerability in ElasticSearch. The REST API allows dynamic scripts execution without authentication. The remote attacker is able to execute arbitrary Java Code on the target system.

	=== Step 1 ===		=== Step 1 ===

MelissaLi: /* Requirements */

2020-01-31T08:13:21Z

Requirements

← Older revision		Revision as of 08:13, 31 January 2020
Line 9:		Line 9:

	* Operating system: Linux, f.e. Kali Linux or Ubuntu 18.04		* Operating system: Linux, f.e. Kali Linux or Ubuntu 18.04
	* Packages: msfconsole git nmap virtualbox		* Packages: msfconsole postgresql git nmap virtualbox

	In order to complete these steps, you must have followed Metasploit Framework, Metasploitable3, PostgreSQL or MySQL Installation Documentation before		In order to complete these steps, you must have followed Metasploit Framework, Metasploitable3, PostgreSQL or MySQL Installation Documentation before.

	== Description ==		== Description ==

MelissaLi: /* References */

2020-01-31T08:12:26Z

References

← Older revision		Revision as of 08:12, 31 January 2020
Line 134:		Line 134:
	* Kali linux by offensive security. https://kali.org/		* Kali linux by offensive security. https://kali.org/
	* David Kennedy. Metasploit: the penetration testers guide. No Starch Press, San Francisco, CA, 2011.		* David Kennedy. Metasploit: the penetration testers guide. No Starch Press, San Francisco, CA, 2011.
	* David Maynor and K. K.. Mookhey. Metasploit toolkit for penetration testing, exploit development, and vulnerability research. Syngress, Burlington		* David Maynor and K. K.. Mookhey. Metasploit toolkit for penetration testing, exploit development, and vulnerability research. Syngress, Burlington (Mass), 2007.
	(Mass), 2007.
	* Metasploit framework. https://wiki.archlinux.org/index.php/Metasploit_Framework		* Metasploit framework. https://wiki.archlinux.org/index.php/Metasploit_Framework
	* Metasploit unleashed. https://www.offensive-security.com/		* Metasploit unleashed. https://www.offensive-security.com/

MelissaLi: /* References */

2020-01-31T08:12:04Z

References

← Older revision		Revision as of 08:12, 31 January 2020
Line 131:		Line 131:
	* https://www.elastic.co/blog/logstash-1-4-3-released		* https://www.elastic.co/blog/logstash-1-4-3-released
	* https://www.elastic.co/community/security/		* https://www.elastic.co/community/security/
			* Elasticsearch dynamic script arbitrary java execution. https://www.rapid7.com/db/modules/exploit/multi/elasticsearch/script_mvel_rce
			* Kali linux by offensive security. https://kali.org/
			* David Kennedy. Metasploit: the penetration testers guide. No Starch Press, San Francisco, CA, 2011.
			* David Maynor and K. K.. Mookhey. Metasploit toolkit for penetration testing, exploit development, and vulnerability research. Syngress, Burlington
			(Mass), 2007.
			* Metasploit framework. https://wiki.archlinux.org/index.php/Metasploit_Framework
			* Metasploit unleashed. https://www.offensive-security.com/
			* Metasploit framework. https://metasploit.help.rapid7.com/docs/msf-overview

	[[Category:Documentation]]		[[Category:Documentation]]

MelissaLi at 08:03, 31 January 2020

2020-01-31T08:03:33Z

← Older revision		Revision as of 08:03, 31 January 2020
Line 128:		Line 128:

	* https://github.com/rapid7/metasploitable3/wiki		* https://github.com/rapid7/metasploitable3/wiki
			* https://www.cvedetails.com/cve/CVE-2014-3120/
			* https://www.elastic.co/blog/logstash-1-4-3-released
			* https://www.elastic.co/community/security/

	[[Category:Documentation]]		[[Category:Documentation]]

MelissaLi: /* Step 8 */

2020-01-31T08:02:10Z

Step 8

← Older revision		Revision as of 08:02, 31 January 2020
Line 118:		Line 118:

	DIR /s C:\WINDOWS\TEMP\xxx.jar		DIR /s C:\WINDOWS\TEMP\xxx.jar

			[[File:meterpreterShellJar.png]]

	== Used Hardware ==		== Used Hardware ==

MelissaLi: /* Step 2 */

2020-01-31T07:57:25Z

Step 2

← Older revision		Revision as of 07:57, 31 January 2020
Line 32:		Line 32:

	db_nmap -Pn 172.28.128.3		db_nmap -Pn 172.28.128.3

	~~Make sure to read:~~

	[[File:dbNmap.png]]		[[File:dbNmap.png]]

MelissaLi: /* Step 8 */

2020-01-31T07:56:38Z

Step 8

← Older revision		Revision as of 07:56, 31 January 2020
Line 113:		Line 113:
	Enter the command in the shell to open the Command Line Interface CLI of the target host:		Enter the command in the shell to open the Command Line Interface CLI of the target host:

	shell		shell

	[[File:meterpreterShell.png]]		[[File:meterpreterShell.png]]
Line 119:		Line 119:
	Enter the command in the shell to check the placement of the xxx.jar file:		Enter the command in the shell to check the placement of the xxx.jar file:

	DIR /s C:\WINDOWS\TEMP\xxx.jar		DIR /s C:\WINDOWS\TEMP\xxx.jar

	== Used Hardware ==		== Used Hardware ==

MelissaLi: /* Step 7 */

2020-01-31T07:56:30Z

Step 7

← Older revision		Revision as of 07:56, 31 January 2020
Line 97:		Line 97:
	Enter the command in the shell to check the vulnerability of the system:		Enter the command in the shell to check the vulnerability of the system:

	check		check

	[[File:exploitElasticCheck.png]]		[[File:exploitElasticCheck.png]]
Line 103:		Line 103:
	Enter the command in the shell to exploit:		Enter the command in the shell to exploit:

	run		run

	[[File:exploitElasticRun.png]]		[[File:exploitElasticRun.png]]