Now believe it or not, not all things bad come out of Metasploit.
We can actually use it for a vulnerability assessment, which eventually turns
into
bad because now we know what holds it there.
It's still bad, but bad in a good way.
The one you just want to hug like a cactus.
So what we're going to do is use Metasploit to actually do some more
vulnerability assessments on an actual target.
Now later in this course, you could have run across Nessus and OpenVos and
different ways for us to be able to do reconnaissance and get a bunch of
information on targets within the organization's network that we're
actually authorized to be able to pen test against.
But you can use Metasploit to enhance the results that you get from
vulnerability assessment suites like those and get more information about what
it is that we're actually going to be attacking.
Now, programs and software suites like Nessus and OpenVos are going to come
back and say, I found a vulnerability.
It's rated between zero and 10, low, medium, high.
And this is the CVE that goes with it, et cetera, et cetera.
Now, does it actually give you all the information to be able to potentially
exploit that?
You may find it in some and not in others, whereas the vulnerability scanner
in Metasploit can actually pull down on that one vulnerability that was
reported.
And you could actually go deeper in the weeds on trying to see if there are
any more holes in that Swiss cheese model.
A slight example here for a second.
We have a lab inside of here, a test bed for a website that we're going to be
using throughout this course to be able to leverage some of our exploits.
And there are many vulnerabilities on this system.
You could pick one and find 10 different ways to exploit it.
But when you run the report in Nessus, you're going to see that there's only
one
method of preferred for that potential exploit according to them.
Using Metasploit to be able to go through and run that vulnerability assessment
could open you up to be able to go through and see if there are different ways
to be able to leverage that.
And there are some other neat little things you can do inside of there as well,
which is what we're going to be taking a look at.
Now, inside of our Kelly box here, I'm actually using Metasploit framework
overall.
So I went to the top left went to Metasploit, ran it.
And the first thing that I want to use is a port scan.
Now, generally, we're going to be using 192.168.0.13 as our target.
And it'll be in the code box below.
And because that's where the website is, that's at Windows 10,
bewap that you see there on the right.
And for this, we're just going to say use.
And at this point, we're going to say aux and tab over for auxiliary.
You may have noticed that when you started up Metasploit,
that remember we talked about the 2,529 exploits at 1,302 or 1,302 auxiliary.
Well, all of those scanners and vulnerability assessments
reside within auxiliary.
So if you're used to running exploits like I am,
auxiliary gets a little bit hard to type sometimes.
Now, at this point, we want to say scanner because there's a whole
sub-sec that you could do in here as well and go additionally further into
port scan.
Go port scan and we're going to be scanning TCP specifically.
Now, inside of here, as always, you could always do a show options.
And you can see here that there's required and they're suggested,
but these are all required.
Really, the only one you need to set is the actual host itself.
Simple set space, our host, and then the target, which again is 1,92,
160, 0, dot 13.
Once you do that, instead of exploit, you're just going to run because this
isn't an exploit, this is a task.
And this will take just a second and I'll pause, but it's going to go through
and do a more meticulous port scan using in-map as a backer.
So if you ran the actual packet headers, you'd see it.
And you can see right here that some of the ports are opening up and I'm just
going to go ahead and control see that because you get the general idea.
And you can see that ports inside of our show options ports 1 through 10,000
were on the target.
And you can make change this up.
You can do it different ways.
You can have one or two, you could have a whole pop-up.
And it'll only scan everything you tell us to do.
And you could even set the speed on it in a more granular detail than you can
in-map
if you want to be more stealthy.
So you found your target, you got the ports that you want to see if there's
an SMB versioning on it to do a more finite OS fingerprinting.
And I'm picking on SMB because that's specific to Windows.
There's others out there like SSAH if you want to be able to go to a
POSIX-based system.
But for this, use Auxiliary Scanner SMB, SMB version.
And just hit enter, do our show show options.
There we go.
And only thing we need here is a remote host.
Again, we'll just set remote host at 192.168.0.13 and execute a run.
And you could see here, I just want to point this out specifically.
That came back pretty quick.
And in addition to that, where the green plus sign is,
192.168.0.13, semicolon.
For five host is running version 10.0.19041.
Version Windows 10 version 2004.
That's very specific.
And I'm just curious real quick, if we opened up the 110BWAP system
and do a WinVer.
Yeah, there we go.
WinVer.
Did we get close?
Well, we got close closer than what Nessus and OpenBoss does, not that I
would know into the future or anything like that.
But yes, we did get closer than those two.
So that's good to keep in mind as well.
And this goes even further because that system also has a web server on it.
But we're not actually going to scan that one.
I've always been curious as to what CBT and Daggett's uses on their back
end for their web server platform.
And so we're going to say use auxiliary scanner, HTTP, HTTP.
Again, underscore version, enter, and then we're going to set.
And because I already know what the show options are on this, and I would
definitely encourage you to do show options on this.
Set our host at HTTPS.
WWW.
Did I do all three?
Yeah, it just made it look weird.
CBT nuggets.com.
Yep.
I think I had an action.
I want to make sure I didn't have an extra space in there.
And this one, I want to set the R port because this is SSL.
And you'll see in there, yep, 443.
And I need to specifically, specifically set SSL on here.
Otherwise it will default into regular HTTP.
And that doesn't work here.
So with all the parameter set, and I want to go ahead and run, that was pretty
quick, we can see that right there we are CBT nuggets has two IP addresses at
pourful for three and it's running for sell powered by next.js.
So if you're ever curious what the operate web platform was, that's it right
there.
Now the last one's a fun one.
Definitely optional if you want to use it.
Use auxiliary scanner, HTTP.
Enum underscore way back.
Set domain at HTTPS.
www.cbtnuggets.com and run.
This right here contacts the way back machine at archive.org and tries to
pull back every version of the actual web page itself, just with the links and
everything. And here in a second, it'll start giving us a whole list of
everything that we can actually link to.
And this is just a fun one to use real quick, but can actually come in handy
because you can see different revisions across time.
And you can export this to an actual file if you're ever so curious to do a
compare and contrast between what patches they may have applied between here
and
there.
But this is all important to understand because whenever we get our
necessary or whatever vulnerability scanner, we use a report back, those
vulnerabilities, as we've seen inside the exploits between MSF console and
MSF venom, have correlating CVEs.
And we could actually scan for those CVEs inside of our vulnerability
assessments within the auxiliary usage.
And so this is just something to keep in mind.
It's not necessarily something that should go in the beginning, middle and end.
It's whenever you deem it necessary to try to get more info during the
reconnaissance phase of your pen testing life cycle.
And definitely keep notes of everything going on because systems change over
time.
And you could use this to help vary up your scanning methods to stay a little
bit
more discreet whenever you're trying to attack things.