Cyber Lab Environment
The cyber security lab is self-contained within the local Hyper-V environment on the desktop instance that was launched for you. The lab has the following topology:
See the following table for the credentials to access the VM instances. Most times, you will only need to login to the Kali-Linux server for most lab exercises.
VM | Username | Password |
|---|---|---|
Kali-Linux | kali | kali |
Metasploitable | mfsadmin | mfsadmin |
Metasploitable3-ubuntu1404 | vagrant | vagrant |
Metasploitable3-win2k8 | vagrant | vagrant |
Connecting to the Lab Instances
All VMs are configured to start automatically, but you can use the Hyper-V Manager to change the state of any of the Hyper-V instances.
The first step in this lab is to login to the Kali Linux instance by either using the short-cut icons on the left of the desktop, or connecting to the instance from the Hyper-V Manager. After connecting to the Kali-LInux instance, you should see a prompt to select your resolution:
Select a resolution that is appropriate for your screen/window. You will next be connected to the XRDP login screen, use the username kali and the password kali to login to the Kali desktop:
Network Discovery
The first thing we want to do in this lab is discover what network we are on. You can refer to the documentation above, or you can use the CLI tools on Kali to discover the network. To use the CLI tools, run netstat -rn in the terminal. This shows us that the Kali system is connected to the 192.168.0.0/24 network.
Now that we know what network we are on, we can scan the network to see which hosts are on the same network segment. We can do this with the nmap command. In a terminal, run the following nmap command to scan for other hosts on the network: sudo nmap -sS -O 192.168.0.0/24 This nmap scan does a stealth TCP SYN scan of all hosts on the 192.168.0.0/24 network (the -sS option), and we’ve asked nmap to try and identify the OS running on the systems (the -O option).
You should see 5 hosts on the network. The first host, 192.168.0.1, is the Hyper-V Virtual switch NAT gateway and is not part of the lab. The interesting hosts will be the metasploitable instances, and we should see two linux systems of different kernel generations, and one windows OS. The Kali linux system will also show up, but should show limited information due to it being locked down by the local firewall.
Lets start with the first target host we found, 192.168.0.101. We can see from the OS finger printing that we are dealing with a fairly old version of Linux kernel running (version 2.6.x).
Attacking a Service
The first port on the list is FTP. We know that we have an older version of the Linux kernel running, but what about the software version of the FTP server? Knowing the service application and version information will inform our next steps. So, we can use nmap again to try and fingerprint a particular service: sudo nmap -sV -p 21 192.168.0.101. Here we will use the version detection mode of nmap (the -sV option), and limit our probes to just port 21 on 192.168.0.101.
We can see that the FTP daemon running on port 21 is vsftpd with version 2.3.4. Now that we know what we are dealing with, we can use Metasploit to see if there are any known vulnerabilities against this service. Start metasploit by running msfconsole in the terminal.
When metasploit is loaded, you will notice that the command prompt has changed to be the metasploit prompt: msf6 >
In the metasploit console, we can search for any vsftpd vulnerabilities by running search vsftpd.
In the results, we see that there is a vulnerability called exploit/unix/ftp/vsftpd_234_backdoor for the vsftpd version that our target machine is running: v2.3.4.
We’re now going to use this exploit to see if we can exploit the target machine using vsftpd running there. First we load the exploit, by running: use exploit/unix/ftp/vsftpd_234_backdoor HINT: metasploit has built in command completion similar to bash shells. So you can use tab key to help make this less ardous (eg. star typing use ex then hit the tab key to auto-complete 'exploit/').
Now we can see what options are available for this exploit, by running show options:
Here we see that we need to set the RHOSTS option to our target host. Set that value with the command set RHOST 192.168.0.101
Now, we can start our attack on the target system by running the run command. It may take a little while for the exploit to work. If the first run is not successful, wait for about 30 seconds and try again. The command shell should show up for you as active:
Now you can start running commands on the remote target host. Lets verify who we are on the target system and network configuration of the target server:
We can see that we are on host metasploitable as the root user. We verified that the network address of the host belongs to 192.168.0.101
Now, you should be able to explore the other open ports on the metasploitable servers in a similar manner: identify the service running on the port, and version if possible; check the metasploit database for exploits that may match; attempt to run the exploits against the services after setting appropriate options after the exploit is loaded.