Giriş
Metasploitable, hedef sistemlere sızma sırasında yapılan saldırılar için bir deneme, öğrenme ortamı olarak Metasploit tarafından oluşturulmuştur. Sistem bir çok zafiyet barındıran Vmware’de oluşturulmuş Linux bir sanal makinadır. Virtualbox’a da kurulabilir.
Metasploitable 2 linkinden direk olarak ya da Torrent ile indirilebilir.
Kurulum
Vmware ile Open Virtual Machine diyerek indirilen .vmx uzantılı dosya gösterilir. Network adapter’ın NAT veya Host-only olarak ayarlanması güvenlik için önemlidir.
Sisteme kullanıcı adı ve şifre olarak msfadmin yazılarak giriş yapılabilir.
Keşif
İlk olarak nmap ile tarama yapılır. Aynı bloktaki bütün IP’lere bakılarak hangisinin hedef sisteme ait olduğu tespit edilmeye çalışılır.
#nmap -sP 172.16.52.0/24
Starting Nmap 6.00 ( http://nmap.org ) at 2013-07-30 16:00 EEST
Nmap scan report for 172.16.52.1
Host is up (0.00051s latency).
Nmap scan report for 172.16.52.133
Host is up (0.00084s latency).
Nmap done: 256 IP addresses (2 hosts up) scanned in 2.69 seconds
Hedef sistemin IP’si demek ki 172.16.52.133 müş. Şimdi hedefe yönelik detaylı bilgi alabileceğimiz, sadece açık portların gösterildiği ve çıktısının /meta.txt ye alındığı nmap komutu çalıştırılır. Burada aynı işlem Nessus ile de yapılabilir. Nessus zafiyetler hakkında detaylı bilgi verir ve zamandan kazandırır.
#nmap -v -A -oN /meta.txt –open 172.16.52.133
Scanning 172.16.52.133 [1000 ports]
Discovered open port 445/tcp on 172.16.52.133
Discovered open port 23/tcp on 172.16.52.133
Discovered open port 22/tcp on 172.16.52.133
Discovered open port 80/tcp on 172.16.52.133
Discovered open port 139/tcp on 172.16.52.133
…
Discovered open port 8180/tcp on 172.16.52.133
Scanning 23 services on 172.16.52.133
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 2.3.4
|_ftp-anon: Anonymous FTP login allowed (FTP code 230)
22/tcp open ssh OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)
| ssh-hostkey: 1024 60:0f:cf:e1:c0:5f:6a:74:d6:90:24:fa:c4:d5:6c:cd (DSA)
|_2048 56:56:24:0f:21:1d:de:a7:2b:ae:61:b1:24:3d:e8:f3 (RSA)
23/tcp open telnet Linux telnetd
25/tcp open smtp Postfix smtpd
|_smtp-commands: metasploitable.localdomain, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN,
| ssl-cert: Subject: commonName=ubuntu804-base.localdomain/organizationName=OCOSA/stateOrProvinceName=There is no such thing outside US/countryName=XX
| Issuer: commonName=ubuntu804-base.localdomain/organizationName=OCOSA/stateOrProvinceName=There is no such thing outside US/countryName=XX
| Public Key type: rsa
| Public Key bits: 1024
| Not valid before: 2010-03-17 14:07:45
| Not valid after: 2010-04-16 14:07:45
| MD5: dcd9 ad90 6c8f 2f73 74af 383b 2540 8828
|_SHA-1: ed09 3088 7066 03bf d5dc 2373 99b4 98da 2d4d 31c6
53/tcp open domain ISC BIND 9.4.2
| dns-nsid:
|_ bind.version: 9.4.2
80/tcp open http Apache httpd 2.2.8 ((Ubuntu) DAV/2)
|_http-methods: No Allow or Public header in OPTIONS response (status code 200)
|_http-title: Metasploitable2 – Linux
111/tcp open rpcbind (rpcbind V2) 2 (rpc #100000)
| rpcinfo:
| program version port/proto service
| 100000 2 111/tcp rpcbind
| 100024 1 40645/udp status
|_ 100024 1 50276/tcp status
139/tcp open netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP)
445/tcp open netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP)
512/tcp open exec netkit-rsh rexecd
513/tcp open login
514/tcp open tcpwrapped
1099/tcp open java-rmi Java RMI Registry
1524/tcp open ingreslock?
2049/tcp open nfs (nfs V2-4) 2-4 (rpc #100003)
2121/tcp open ftp ProFTPD 1.3.1
3306/tcp open mysql MySQL 5.0.51a-3ubuntu5
| mysql-info: Protocol: 10
| Version: 5.0.51a-3ubuntu5
| Thread ID: 19
| Some Capabilities: Connect with DB, Compress, SSL, Transactions, Secure Connection
| Status: Autocommit
|_Salt: tJTFD_3}@cU_^9@tKWV*
5432/tcp open postgresql PostgreSQL DB 8.3.0 – 8.3.7
5900/tcp open vnc VNC (protocol 3.3)
| vnc-info:
| Protocol version: 3.3
| Security types:
|_ Unknown security type (33554432)
6000/tcp open X11 (access denied)
6667/tcp open irc Unreal ircd
| irc-info: Server: irc.Metasploitable.LAN
| Version: Unreal3.2.8.1. irc.Metasploitable.LAN
| Lservers/Lusers: 0/1
| Uptime: 0 days, 0:44:56
| Source host: B7AA5616.5799F1B7.168799A3.IP
|_Source ident: OK nmap
8009/tcp open ajp13 Apache Jserv (Protocol v1.3)
8180/tcp open http Apache Tomcat/Coyote JSP engine 1.1
|_http-methods: No Allow or Public header in OPTIONS response (status code 200)
|_http-title: Apache Tomcat/5.5
|_http-favicon: Apache Tomcat
Service Info: Hosts: metasploitable.localdomain, localhost, irc.Metasploitable.LAN; OSs: Unix, Linux; CPE: cpe:/o:linux:kernel
Host script results:
| nbstat:
| NetBIOS name: METASPLOITABLE, NetBIOS user: <unknown>, NetBIOS MAC: <unknown>
| Names
| METASPLOITABLE<00> Flags: <unique><active>
| METASPLOITABLE<03> Flags: <unique><active>
| METASPLOITABLE<20> Flags: <unique><active>
| \x01\x02__MSBROWSE__\x02<01> Flags: <group><active>
| WORKGROUP<00> Flags: <group><active>
| WORKGROUP<1d> Flags: <unique><active>
|_ WORKGROUP<1e> Flags: <group><active>
| smb-os-discovery:
| OS: Unix (Samba 3.0.20-Debian)
| NetBIOS computer name:
| Workgroup: WORKGROUP
|_ System time: 2013-07-30 16:07:17 UTC-4
Daha az detaylı temiz bir görüntü için
#nmap -n -sV -oN /meta.txt –open -p 0-65535 172.16.52.133
Nmap scan report for 172.16.52.133
Host is up (0.0024s latency).
Not shown: 65506 closed ports
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 2.3.4
22/tcp open ssh OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)
23/tcp open telnet Linux telnetd
25/tcp open smtp Postfix smtpd
53/tcp open domain ISC BIND 9.4.2
80/tcp open http Apache httpd 2.2.8 ((Ubuntu) DAV/2)
111/tcp open rpcbind (rpcbind V2) 2 (rpc #100000)
139/tcp open netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP)
445/tcp open netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP)
512/tcp open exec netkit-rsh rexecd
513/tcp open login
514/tcp open tcpwrapped
1099/tcp open rmiregistry GNU Classpath grmiregistry
1524/tcp open ingreslock?
2049/tcp open nfs (nfs V2-4) 2-4 (rpc #100003)
2121/tcp open ftp ProFTPD 1.3.1
…
57379/tcp open unknown
58373/tcp open nlockmgr (nlockmgr V1-4) 1-4 (rpc #100021)
MAC Address: 00:0C:29:66:E3:9F (VMware)
Service Info: Hosts: metasploitable.localdomain, localhost, irc.Metasploitable.LAN; OSs: Unix, Linux; CPE: cpe:/o:linux:kernel
…
Şeklinde devam eden bir sonuç verdi. Bu karışık karakterler bilinmeyen 2 servisten alınan verilerden oluşuyor.
