Exploiting Metasploitable 2 with Metasploit in KaliLinux 2016 By Shain Amzovski Metasploitable Intentionally vulnerable Linux Virtual Machine This VM can be used to conduct security training test security tools and practice common penetration testing techniques ID: 764131
Download Presentation The PPT/PDF document "Exploiting Metasploitable 2 with" is the property of its rightful owner. Permission is granted to download and print the materials on this web site for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.
Exploiting Metasploitable 2 with Metasploit in Kali-Linux 2016 By Shain Amzovski
Metasploitable Intentionally vulnerable Linux Virtual Machine. This VM can be used to conduct security training, test security tools, and practice common penetration testing techniques.
NMAP scan Ran nmap from Metasploit in Kali-Linux 2016. Detected which ports were open in Metasploitable 2. Looked for exploits to attack the Metasploitable VM.
IRC Server Port 7194 Exploit First, I ran a command execution that exploits a malicious backdoor that was added to the Unreal IRCD 3.2.8.1 download archive. Checks if an IRC server is back doored by running a time-based command (ping) and checking how long it takes to respond. Command = exploit/ unix / irc /unreal_ircd_3281_backdoor Exploit gives hacker access to all directories.
FTP Exploit on Port 21 This command exploits a malicious backdoor that was added to the VSFTPD download archive. This backdoor was introduced into the vsftpd-2.3.4.tar.gz archive between June 30th 2011 and July 1st 2011 according to the most recent information available. This backdoor was removed on July 3rd 2011. Command = exploit/ unix /ftp/vsftpd_234_backdoor Gives you access to root.
PHP Exploit Port 80 When run as a CGI, PHP up to version 5.3.12 and 5.4.2 is vulnerable to an argument injection vulnerability. This vulnerability leaks the source code of the application and allows remote code execution. This module can also be used to exploit the plesk 0day disclosed by kingcope and exploited in the wild on June 2013. Command = exploit/multi/http/ php_cgi_arg_injection
TCP/UDP Exploit This command exploits remote code execution vulnerabilities in dRuby .Command = exploit/linux / misc / drb_remote_codeexec Exploit allows for root access.