WEBVTT

1
00:00.000 --> 00:03.130
So in this video, I'd like to take a moment and just do some testing prior to

2
00:03.130 --> 00:03.840
implementing the

3
00:03.840 --> 00:08.720
IDS/IPS policies and rules as part of our extruder firewall. Let's just test a

4
00:08.720 --> 00:09.120
few

5
00:09.120 --> 00:13.920
end map and Metasploit commands and we'll launch them from this VM and we'll

6
00:13.920 --> 00:14.720
try to compromise

7
00:14.720 --> 00:18.810
this VM right here. So here from our Kali Linux box, let's go ahead and open up

8
00:18.810 --> 00:19.840
a few terminal

9
00:19.840 --> 00:24.140
windows that we can play with. There's one and we'll open up another one and we

10
00:24.140 --> 00:24.960
'll open up one more

11
00:24.960 --> 00:27.990
as well. So for the first one, let's go ahead and do an end map and let's do an

12
00:27.990 --> 00:29.920
end map to 10.20.0.1
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

13
00:30.160 --> 00:34.470
to that's the exact IP address of the vulnerable system over there on segment

14
00:34.470 --> 00:35.920
20 and it has shown

15
00:35.920 --> 00:40.820
us right here that by default with that end map scan, it's scanned for 1000

16
00:40.820 --> 00:42.080
ports and 977

17
00:42.080 --> 00:46.640
more closed but the ones that were open are these. So we know that this server

18
00:46.640 --> 00:48.160
is running things like

19
00:48.160 --> 00:54.050
FTP services, SSH services, telnet, domain name services, HTTP, and we scroll

20
00:54.050 --> 00:54.960
down is also

21
00:54.960 --> 01:00.200
supporting MySQL and VNC. They want more detailed information. We can do an end
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

21
00:54.960 --> 01:00.200
supporting MySQL and VNC. They want more detailed information. We can do an end

22
01:00.200 --> 01:01.840
map -A and then that

23
01:01.840 --> 01:05.370
IP address and that's going to take a little bit longer because it's going to

24
01:05.370 --> 01:06.080
be doing more

25
01:06.080 --> 01:10.280
analysis and querying of that target host. So we press enter, it's going to

26
01:10.280 --> 01:11.760
show us our status so

27
01:11.760 --> 01:16.240
it is 82% done and it'll be done here in just a moment. So now that it's done,

28
01:16.240 --> 01:17.920
which took 21 seconds,

29
01:17.920 --> 01:21.590
it's now showing us additional information on those services. So if we scroll

30
01:21.590 --> 01:22.640
to the top here,

31
01:22.640 --> 01:26.530
here it's showing that we have FTP services running. However, it's also showing

32
01:26.530 --> 01:27.840
us the specific version

33
01:27.840 --> 01:34.240
which is VS FTP version 2.3.4 and if we scroll down for MySQL, it's showing us
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

33
01:27.840 --> 01:34.240
which is VS FTP version 2.3.4 and if we scroll down for MySQL, it's showing us

34
01:34.240 --> 01:34.960
the version and

35
01:34.960 --> 01:38.920
flavor of MySQL that's in use. And it's also got another flavor of FTP running

36
01:38.920 --> 01:39.920
right here on port

37
01:39.920 --> 01:45.360
21.21 which is pro FTP. And with end map, there's a ton of options we can issue

38
01:45.360 --> 01:45.920
and one of the

39
01:45.920 --> 01:49.640
really fun tools I like to use is called the then map. It's the graphical user

40
01:49.640 --> 01:50.960
interface cousin

41
01:50.960 --> 01:54.790
of end map. So basically behind the scenes is still using end map, but it makes

42
01:54.790 --> 01:55.920
it a little bit easier

43
01:55.920 --> 02:00.070
to pick and choose exactly what we want to scan. So for example, here in Zen
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

43
01:55.920 --> 02:00.070
to pick and choose exactly what we want to scan. So for example, here in Zen

44
02:00.070 --> 02:01.120
map, if we put in the

45
02:01.120 --> 02:06.370
IP address of our target, which is 10 dot 20 dot 0 dot 182. And then we specify

46
02:06.370 --> 02:07.280
for the profile

47
02:07.280 --> 02:10.460
here the type of scan we want to do from the dropdown, I'm going to go ahead

48
02:10.460 --> 02:11.120
and choose

49
02:11.120 --> 02:15.820
intent scan plus UDP. And then it automatically puts in the end map command and

50
02:15.820 --> 02:17.120
all the appropriate

51
02:17.120 --> 02:20.920
options as shown right here. So let's go ahead and click on scan to launch that

52
02:20.920 --> 02:21.920
. And while that's

53
02:21.920 --> 02:24.800
running, if we want to run another scan, and we can choose either that IP

54
02:24.800 --> 02:25.840
address or a different

55
02:25.840 --> 02:29.380
IP address, and then choose a scan we want to use. So I'm going to go ahead and

56
02:29.380 --> 02:29.920
let's do a

57
02:29.920 --> 02:34.220
ping scan and then click on scan. And that's also going to run. So here for
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

57
02:29.920 --> 02:34.220
ping scan and then click on scan. And that's also going to run. So here for

58
02:34.220 --> 02:34.800
click on scans,

59
02:34.800 --> 02:37.930
it's showing us the current scans that we have running. So this one is already

60
02:37.930 --> 02:38.640
done. It's very,

61
02:38.640 --> 02:42.470
very quick. And this one is still in motion still running. And it'll have the

62
02:42.470 --> 02:42.960
results

63
02:42.960 --> 02:46.550
once it's done that we can see right here at end map output. So with end map

64
02:46.550 --> 02:47.440
output selected,

65
02:47.440 --> 02:50.480
if we choose the scan that we want to select from, they'll go ahead and show us

66
02:50.480 --> 02:51.440
the output. So this

67
02:51.440 --> 02:55.260
one is still running at the moment. It's about eight or nine percent done. So

68
02:55.260 --> 02:55.920
we'll let that

69
02:55.920 --> 02:59.440
continue in the background. And now that we know what so the open ports are and

70
02:59.440 --> 03:00.000
the protocols
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

71
03:00.000 --> 03:03.720
are being used, we could go ahead and use other tools to attempt to compromise

72
03:03.720 --> 03:04.640
those. And one of

73
03:04.640 --> 03:09.220
those is the metasplatable framework. So if we type an MSF console and press

74
03:09.220 --> 03:10.000
enter, and I've

75
03:10.000 --> 03:13.600
already initialized the database behind the MSF console. So that's already done

76
03:13.600 --> 03:14.160
. And if we

77
03:14.160 --> 03:17.860
minimize this right here, there's also in this distribution of Linux, there's

78
03:17.860 --> 03:19.040
an icon right here,

79
03:19.040 --> 03:23.170
which will launch metasploit and also initialize the database in one fell swoop

80
03:23.170 --> 03:24.080
. So let's go back

81
03:24.080 --> 03:27.520
to our metasplatable console. And I always love the little graphics here as

82
03:27.520 --> 03:28.800
well. They're super fun.

83
03:28.800 --> 03:32.600
So now that it's loaded, let's go ahead and let's do a search for scanner based
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

83
03:28.800 --> 03:32.600
So now that it's loaded, let's go ahead and let's do a search for scanner based

84
03:32.600 --> 03:33.360
on the flavor of

85
03:33.360 --> 03:38.640
FTP we saw as the output from the end map. So the flavor they're using for FTP

86
03:38.640 --> 03:39.600
that we saw on

87
03:39.600 --> 03:45.000
port 21 was VS ftpd. So here in the metasplatable framework, we do a search for

88
03:45.000 --> 03:46.160
scanner with that

89
03:46.160 --> 03:51.060
term VS ftpd and press enter, it can show us whether or not it found any. And

90
03:51.060 --> 03:51.840
it didn't. So let's go

91
03:51.840 --> 03:56.110
ahead and do a search scanner for just FTP in general. And let's see if it has

92
03:56.110 --> 03:57.040
a bunch there. So

93
03:57.040 --> 04:00.320
it currently has 19 that we could choose from there. Let's actually put it in
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

93
03:57.040 --> 04:00.320
it currently has 19 that we could choose from there. Let's actually put it in

94
04:00.320 --> 04:01.200
the full name. Let's do

95
04:01.200 --> 04:06.310
a search. And instead of saying scanner, let me just put in VS ftpd and press

96
04:06.310 --> 04:07.600
enter, see if there's

97
04:07.600 --> 04:11.940
anything in the modules and sure enough right here, we've got one for a denial

98
04:11.940 --> 04:13.280
of service attack.

99
04:13.280 --> 04:17.920
And we have one for a backdoor command connection. So effectively, this says

100
04:17.920 --> 04:19.360
that we could potentially

101
04:19.360 --> 04:24.240
open up a communication path and get access to that system just because of

102
04:24.240 --> 04:25.760
their vulnerable FTP

103
04:25.760 --> 04:29.380
system that's running. So to try that, we'll go ahead and do a use one, which

104
04:29.380 --> 04:30.160
is just selecting
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

104
04:29.380 --> 04:30.160
is just selecting

105
04:30.160 --> 04:34.530
option one here and putting this in that module. And let's do a show options,

106
04:34.530 --> 04:35.840
press enter. So for

107
04:35.840 --> 04:40.320
this specific exploit here in the required column, it's requiring us to supply

108
04:40.320 --> 04:41.680
the variable for

109
04:41.680 --> 04:44.860
our host, that's the IP address or addresses or subnets you want to go ahead

110
04:44.860 --> 04:46.080
and attack to.

111
04:46.080 --> 04:50.200
And the our port, one one port 21 is already in place. So let's set the

112
04:50.200 --> 04:51.280
variable for our hosts.

113
04:51.280 --> 04:55.490
So do that right here, you simply type in set our hosts, and you don't have to

114
04:55.490 --> 04:55.920
actually put that

115
04:55.920 --> 05:00.420
number case, it gets it either way. And the remote host we want to use is 10
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

115
04:55.920 --> 05:00.420
number case, it gets it either way. And the remote host we want to use is 10

116
05:00.420 --> 05:02.960
dot 20 dot 0 dot 182,

117
05:02.960 --> 05:06.480
press enter, and it'll do a show options again, just to confirm that it took

118
05:06.480 --> 05:07.280
that. And sure if

119
05:07.280 --> 05:11.070
it has that right there. So if we typed in exploit right here, or you could

120
05:11.070 --> 05:12.640
also type in run, it also

121
05:12.640 --> 05:16.770
works. But if we launch this exploit by typing in exploit or typing and running

122
05:16.770 --> 05:17.840
pressing enter,

123
05:17.840 --> 05:22.730
it's going to reach out and try to build that connection leveraging that FTP

124
05:22.730 --> 05:23.680
service that's

125
05:23.680 --> 05:27.740
running over on that vulnerable, med exploitable system. And there we go. So if

126
05:27.740 --> 05:29.280
we type in PWD

127
05:29.280 --> 05:32.810
and press enter, oh, this is too good to be true. So check it out. Let's go
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

127
05:29.280 --> 05:32.810
and press enter, oh, this is too good to be true. So check it out. Let's go

128
05:32.810 --> 05:34.160
back to a console here

129
05:34.160 --> 05:38.700
for a med exploitable. And here in med exploitable, let's do a PWD. And let's

130
05:38.700 --> 05:40.160
go back to the root of

131
05:40.160 --> 05:45.900
the file system to PWD again, and let's do an LS space dash L and press enter.

132
05:45.900 --> 05:46.560
So there's the

133
05:46.560 --> 05:50.270
file system. So here the backdoor connection, if we did an LS dash L and press

134
05:50.270 --> 05:51.120
enter, that's the

135
05:51.120 --> 05:55.110
same exact information. So if we type in who it shows us who are currently

136
05:55.110 --> 05:55.840
logged on as,

137
05:55.840 --> 06:00.250
we're logged on as root, if we change folders, let's do a PWD. Now we're in the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

137
05:55.840 --> 06:00.250
we're logged on as root, if we change folders, let's do a PWD. Now we're in the

138
06:00.250 --> 06:01.200
Etsy folder. So if

139
06:01.200 --> 06:06.110
we did a cat, or in the current folder, a file called shadow, and press enter.

140
06:06.110 --> 06:06.800
So we have a lot

141
06:06.800 --> 06:10.320
of access right here. And if they've been I have config, again, this is a huge

142
06:10.320 --> 06:11.280
compromise of a

143
06:11.280 --> 06:15.970
system all because of one insecure application that's being compromised by the

144
06:15.970 --> 06:17.280
would be attacker.

145
06:17.280 --> 06:22.240
So again, here's the IP address of 10200182, because that is logically the

146
06:22.240 --> 06:22.960
device that we're

147
06:22.960 --> 06:28.330
connected to via our backdoor connection, taking advantage of a weakness in FTP

148
06:28.330 --> 06:29.680
and specifically

149
06:29.680 --> 06:33.850
the option and the version that they have running on this vulnerable server. So
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

149
06:29.680 --> 06:33.850
the option and the version that they have running on this vulnerable server. So

150
06:33.850 --> 06:34.480
that's one example,

151
06:34.480 --> 06:38.170
let's type in exit there, let's type in back. And here the output from medispl

152
06:38.170 --> 06:38.880
oidable, one of the

153
06:38.880 --> 06:43.320
other services they had running was MySQL, which is right here. So once again,

154
06:43.320 --> 06:44.320
by using the proper

155
06:44.320 --> 06:48.870
attack tools, we could do a brute force or dictionary attack against that SQL

156
06:48.870 --> 06:49.360
server,

157
06:49.360 --> 06:52.710
just cover the password. And then once we connect with that password, we then

158
06:52.710 --> 06:54.240
have access to that

159
06:54.240 --> 07:00.200
information. So back here in medisploid, if we did a search scanner, or MySQL,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

159
06:54.240 --> 07:00.200
information. So back here in medisploid, if we did a search scanner, or MySQL,

160
07:00.200 --> 07:00.800
here they have seven

161
07:00.800 --> 07:05.540
options. So they have one here that can help us in trying to log in with a list

162
07:05.540 --> 07:06.480
of usernames and

163
07:06.480 --> 07:09.420
passwords, we can supply it. Or if we want to verify the version, let's go

164
07:09.420 --> 07:10.640
ahead and use six,

165
07:10.640 --> 07:14.420
that'll put us in that module, let's do a show options. And let's specify the

166
07:14.420 --> 07:15.280
remote host with

167
07:15.280 --> 07:20.990
a set our hosts, and we'll set it to 10.20.0.182 press enter, then we'll type

168
07:20.990 --> 07:21.920
in run. And that's

169
07:21.920 --> 07:25.950
showing us right there what the flavor is of MySQL. So if we use the proper

170
07:25.950 --> 07:26.880
tools, we got the

171
07:26.880 --> 07:31.310
password we can then log in to that MySQL database server and have access to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

171
07:26.880 --> 07:31.310
password we can then log in to that MySQL database server and have access to

172
07:31.310 --> 07:32.000
the tables

173
07:32.000 --> 07:34.940
as part of that database. So as an example of that, let's bring up another

174
07:34.940 --> 07:36.240
command prompt and run

175
07:36.240 --> 07:41.400
MySQL, and we'll log into the host 1020, 0182. Let's imagine we discovered that

176
07:41.400 --> 07:42.320
the root password

177
07:42.320 --> 07:45.610
was missing, there was no password required. So I'm not going to supply a

178
07:45.610 --> 07:46.400
password at all.

179
07:46.400 --> 07:50.240
And also not going to use SSL to log in. And that could also be identified

180
07:50.240 --> 07:50.640
based on what we

181
07:50.640 --> 07:54.720
discovered with our port scan at the host. So if we log in, and there's no

182
07:54.720 --> 07:55.760
password for roots,

183
07:55.760 --> 07:59.550
I'll press enter. And then from here, we do a show databases. And then we can

184
07:59.550 --> 08:00.080
go into one of
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

184
07:59.550 --> 08:00.080
go into one of

185
08:00.080 --> 08:04.310
those databases with command use, and let's go ahead and go into OOSP 10, which

186
08:04.310 --> 08:04.960
of the database

187
08:04.960 --> 08:08.800
uses part of the OOSP top 10 on the intentionally vulnerable, metastable,

188
08:08.800 --> 08:10.080
mobile machine. So the

189
08:10.080 --> 08:13.410
prompt change, we're now focused on that database. And then we did a show

190
08:13.410 --> 08:14.880
tables with a semicolon

191
08:14.880 --> 08:18.150
and press enter. And here is showing us the individual tables. So I'll go ahead

192
08:18.150 --> 08:18.880
and type in

193
08:18.880 --> 08:23.220
exit. So now that we've verified that just with a few simple tools like end map

194
08:23.220 --> 08:23.520
and

195
08:23.520 --> 08:27.920
Metasploit, that we can both discover and then compromise vulnerable services

196
08:27.920 --> 08:29.280
here on this system,

197
08:29.280 --> 08:33.440
our next logical step is to go ahead and train NSX to start looking for that
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

197
08:29.280 --> 08:33.440
our next logical step is to go ahead and train NSX to start looking for that

198
08:33.440 --> 08:34.400
type of traffic,

199
08:34.400 --> 08:37.600
and based on our configuration, prevent it from happening.

200
08:37.600 --> 08:46.660
[BLANK_AUDIO]