Original subtitles

Let's talk now about identifying and researching potential vulnerabilities.

So we have our notes here and all I've done is move them off of notepad and into cherry tree because

Cherry Tree is a bit more visual and bigger font for us on video.

And I made two notes I made the main note here of notes and then I made a child node here of vulnerabilities.

So if we recall from our nodes we have 18 4 4 3 and we've identified some findings that we're gonna

write up on a pen test report and those findings are you know a default web page for a poor page was

giving a little bit of information disclosure and the server headers were disclosing some information

as well.

On top of that we've identified some information that we need for research.

Now we've got 80 here and on port 80 we've got this Apache does not SSL in this Open SSL that we could

research and really ran our Nick doe scan we identified something potentially juicy here where mod SSL

2.8 point four falls in line with this which is two point eight and seven or lower which we are are

vulnerable to a remote buffer overflow which may allow a remote shell remote buffer overflow meaning

that we are don't have to be local we can be remote which we are and we can gain access to a remote

shell meaning we can gain access to that machine.

So that's good.

That's really good.

The other one here we see is SMB and we identified Sam aversion version to point two point one a We

also identified a web lies version 2.0 one and we've identified open SDH two point nine P P2 so for

this video we're going to target the low hanging fruit and I put this in order of how I would attack

it.

Now again I always think eighty four for three and one thirty nine four four five are the juiciest To

me this web adviser might be juicy open SSA probably not that juicy so we're gonna do is I'm going to

go ahead and research eighty four for three and we'll research the S&P as well and then I'll leave you

to do a little digging on these just as practice and we can see where we go so from here we're just

going to go out and open up Firefox and we'll go out to Google and on Google we can pick and choose

which one we want to research here.

Now this mod SSL two point point four is probably the juiciest of the items and we might want to start

there.

So let's just say something like mod SSL to point a point for you see the two point eight point seven

exploit showing up by the way.

Will this do you two point eight point four exploit and we'll see what comes up now.

Naughty words naughty words.

We'll just call it open luck OK.

And you could see.

Don't cheat.

Catch tricks is coming up as well but we're gonna go ahead and is openness open this Apache mod and

then we're gonna also open this get hub one and I'll cheat a little bit and tell you why.

Here in a minute so Apache mod SSL two point eight point seven.

Less than twenty point seven.

Scroll through here and it just has the code for us.

Now this is where you have a chance to come through and read the code.

Now it looks like to me that they're just identifying if you've never seen a buffer overflow which you

probably haven't.

There will be one later in the course it's identifying where it's going to have the architecture right.

So the architecture has its own identifier.

So depending on which it looks like this works for quite a bit of different architectures of Linux depending

which Linux you're running is this return address here.

So that's all this is doing.

And then there's going to be code done here I'm guessing for an overflow which you see a bunch of A's

as you're going to see later in the course.

This is this overflow.

So you'll learn to read this over time again like you do not have to code this you do not have to be

you know you don't have to be super good developer but just understanding kind of what's going on and

making sure that you know the code that you download is safe on your computer and it's good to go.

Now this is coming off exploit database so you can.

I wouldn't say assume but you can trust it for the most part that this is safe code.

You have the option here to download the exploit and you actually have the option to download the vulnerable

app as well if you ever want to build out a machine and play on your own.

So we have a little bit information here that just says hey you know this is less than two point eight

point seven open SSL and we've got a remote buffer inflow.

There's nothing else here.

But that's OK.

That's you know this might be good for us.

This is something that we need to note.

So we can copy this and I would put it here and we could just say something like eighty four for three

potentially vulnerable to we'll call it open luck and then we'll just put it here and we'll also we

should also save this open luck and I'll cheat a little bit and tell you guys why is because this open

had the the exploit database form without saying bad words is not going to allow us to work.

It's not going to work.

The the exploit is a little dated and that's why there is a get hub one out there that actually does

work.

So we're going to utilize to get hub one instead when we do get to the exploitation section.

So a little bit of a hint a little bit of a foreshadowing we are going to utilize this exploit.

So we could also go in and research we could say Apache HPD one point three point two zero.

Copy that and come to Google and just say hey I wonder if there's an exploit for that and you would

just search something like this and you could see and hear Apache one point three point two zeros actually

showing up in this vulnerability as well.

So that's good.

And then sometimes we see these Web sites like this see these details these are ok to look at they're

there all right.

Like you come in here and what you want to look for is the score.

Immediately my eyes shift to the score.

I don't care about anything else.

If I see something that's red I get excited but we see no red here.

So I don't think that necessarily this is vulnerable to a remote code execution.

It's got a lot of denial of service but I would want to see like a high score which means a critical.

That's what red is red is critical.

So we've got high moderate and low here but we don't have a critical one.

So this doesn't look like it really probably has anything but it is tied to this which is another wheel

spinning indicator here that hey you know what.

We probably got an X flight here with this thing early something that we should try and that Open SSL

is tied directly to this model ourselves.

We don't really have to research it now let's move on to samba here.

Samba.

Point two point one a Let's copy this.

Let's check for an explain.

So just as simple as is doing this and saying exploit and we've got a few here we've got this samba.

Two point two point eight remote code execution.

We've got samba to point to point X remote buffer overflow and we've got one down here which I love

to see.

This is Rapid 7.

So let's go to rapid 7 First why do I like to see rapid 7.

Well rapid 7 makes Metis Floyd so it looks like this exploit is called samba trance to open and let's

read a little bit about the description.

So it says this explains the buffer overflow found in some versions two point two point zero a two point

two point eight that meets our criteria.

This particular model's Capel explain the fall on x eighty six Linux systems.

That's important to know that do not have the know exact stack options set notes some older versions

read had to not seem to be vulnerable since they apparently do not allow anonymous access to IPC.

So remember we did get anonymous access to IPC earlier when we connected to it via our SMB client.

We never got access to admit.

We could never do anything in IPC we tried to say alas and it said denied but we still logged in.

So we do have anonymous access to IPC.

That's interesting.

And we are potentially running against an next 86 Linux system.

So that's interesting as well.

It looks like we're potentially meeting some of the requirements here.

Now here is where this is great.

You scroll down here and you see module options and look this is Metis boy.

It gives you the module options.

It says hey use exploit Linux samba trans to open and then it tells you hey how to do this.

And then you're good to go.

That's really nice.

I really like that.

So I'm going to copy this one and we'll just come to our notes and we'll say something like one thirty

nine potentially vulnerable to trans to open and we'll lose paste a link here and we could come read

these as well.

So this is the Trans to open overflow here.

This looks like the manual version of the trans to open overflow looks like it is a perl script.

And again it looks like an overflow.

So you'll learn to read these and see what they look like just over time.

But you know you just want to look at the code make sure everything's good to go.

You will need to run this with Perl.

It gives you the options here.

Trans to root Perl what option to select what target type to select your IP address and your target

IP address.

So we'll say this one as well why not

and we'll take a look at the other one and just see what it is

and it looks like it could work for us.

Remote route exploit for samba to point to point X that works against all the Nix distributions samba

that si.

I think this is a possibility as well.

So this is C code here.

We're going to go ahead and just copy this and we'll go ahead and add this to our list as well and we'll

figure it out.

So all we're doing right now is the research OK.

So from here I've showed you the Google way.

Let's say for some reason you want to do this on the fly.

You want to use another tool or you're you know you're in a network and the network has no access you

have no Internet access out you have no research capabilities you can go to the terminal and there's

a great way to research this as well.

So let's go back up to our notes and take a peek.

Now let's take this unique samba to point to point a for example and let's do a tool called search flight.

Now search boy it's going to search for the exploit database.

This whole database here that we're looking through it's brought down onto your machine every time you

update your machine in the database updates it updates down your machine and all those exploits get

downloaded for you already but you could say search point and maybe we search something like samba to

point to point one a let's see what happens no results.

Well OK.

Why is that.

Well let's delete this now.

You can not be too specific with search flight.

The more specific you are the worse off you are because search plate is searching the exact string that

you are using.

Now you see that we search samba and it's searching for samba in a two.

OK.

Now we can start to see some things here.

We see a Linux remote code execution right here and we're going to have to look through these.

Now it's not pretty.

Right.

It's not the prettiest but you see the trends to open does show up.

Now it's not the easiest way.

I do prefer Google.

But if you're in a pinch or you want to look at all the different possibilities and see maybe hey is

there a two point two in here.

So like look samba two point two point zero to two point two point eight OSX.

That's not our operating system but it's called trans to open and we see that over and over and over

again.

So maybe the wheels spin again and it says hey trans to open.

I think that that's potentially what we're looking for here.

And then once we get down to the 3s we know hey we've gone too far this is not our version etc. We could

do the same thing with let's say the mod SSL and we can say something like mod SSL to by type search

but in front of it and do some searching there and we can see OK.

There's denial of service not it.

Two point eight point X potentially.

Right.

And then mod SSL.

Two point eight point seven.

And another thing to look at over here.

Denial of Service denial service remote remote it's huge remote means remote code execution.

So learning to read these as well exploit check Unix.

OK.

We're running on linux.

Check.

Remote code execution check and Apache mod SSL.

Less than two point eight point seven check.

So there's three different versions of this and this is kind of why when I said earlier that you know

they don't really work.

One's been broken.

They've rebuilt it.

I just like the one off get hub.

So we'll play around with that one and just a little bit.

But this is what you're doing.

You're either going out to Google with the information that you find or you're going to search for it.

You're just doing research.

So now we've identified a couple of potential vulnerabilities and we can go from there.

So what I encourage you to do is just do some research on this Web Eliza do some research on open SSD

age see what you can find out just for research sake practice with search boy practice at Google and

then meet me in the next video.

So what I want to do before we get into exploitation I want to give you a quick sneak peek at what your

notes should look like so far.

So you can see what good know keeping is and this is in terms of an assessment.

OK.

Just in terms of an assessment and then from there we're going to practice with some other scanning

tools just to get you familiar with other things than using just an map.

And then finally we'll move into our exploitation.

So I will see you in the next video and we look quickly at our notes.