All language subtitles for 3. Gaining Root with Metasploit

Well I am excited.

And let me tell you how excited I am.

This is not the first time ever recorded this video.

This is actually the second time recording this video because the first time I forgot to hit the record

button.

So now it's blinking red right in front of me.

Guaranteed recording and I'm still as excited even the second time walking through this I'm so excited

because this is what we've been building up for.

This is everything we've been doing the scanning the enumeration even the Linux and the python.

This is all building up to this and now we're ready to explain.

We're going to get our first shell we're going to pop our first shell today and I'm so excited for both

of us.

So what we're gonna do is we're going to run Metis flight for this one and Metis but it's a little bit

automated but that's OK in the next video we're gonna go ahead and cover it manually.

So what we're going to do is we're going to attack SMB here and with SMB what we're gonna do is if you

don't remember search like samba to point to.

We found samba to point to point one a we searched around we went out to the inter webs we did search

boy and we kept seeing this trans to open show up like here and here here here all down here right repeatedly

and it meets the criteria everything seems to make sense.

It had that IPC anonymous connection as well.

So I think I think this is a winner and we're gonna go ahead and give it a try.

So I'm going to copy this and we're going to go ahead and type an MSF console and load up medicinally

once medicinally it loads we're gonna go ahead and just search for this guy and see if we can't find

it now we know it exists because we did find that handy dandy rapid seven Web site that said it did.

So we're going to search it here and we're given four options now these are all operating systems here

but we have been good enumerators and good investigators researchers information gatherers etc. We could

have willy nilly just saw one thirty nine said hey I'm going to try to find exploits against it and

never looked at any other ports but that's thought us we went out to port 80.

We saw that it was running red hat we discovered Linux on the machine.

So we know we're going to pick the Linux module so we're gonna say use one as that corresponds to this

module here and then we're gonna type in options and all we have to do is set a our host.

So remember our host stands for remote host or the victim that we're attacking.

So we're going to say set our hosts and 1 9 2 1 6 8 5 7 1 30 for and we're going to say options one

more time make sure that that actually set in there and it did.

Now one thing I'd like to do is type and show targets.

Now there are no targets here but as you're going to see later on in the course there are often targets

that we have to pick from.

Not always is the first choice that's auto selected right for us.

But in this instance there's only one choice.

So it's the right choice.

So now we have two options.

Both are going to do the same thing for us like you type in run or we could type and exploit if we want

to be cool.

I want to be cool it's open next play so we're gonna run this and it's going to start this brute force

attack here and it's going to start opening shells and closing shells what is going on.

So let's control see if yours is doing this.

Go ahead and control C interrupt this.

Let's talk about what's happening.

So you see it's trying this brute force attack.

It's trying different different return addresses here.

And finally it lands the one that works and it says hey I'm going to send this stage.

This is always a good sign.

By the way sending the stage.

Then it says hey I've got this maternity session open because our payload has worked.

And then this mature operator session closed reason died.

That's not good.

So it keeps going through over and over and over and over.

And it is dying.

What is going on.

Well we've talked about this let's go into options again now.

You don't see this the first time you do it but you see it the second time because metabolite says hey

if you're pale it's not working.

Maybe the payload is the issue and I'm going to give you payload options this time around.

Now we see payload options here in the middle.

That wasn't there before.

We can see that we're running Linux X 86 interpreter forward slash reverse underscore CCP.

What does that mean.

Well that means that we are running a stage payload.

Couple of other things to note while we're in here we see El host that is the opposite of our host El

host is us.

We are the listening hosts.

So we sit here and we have our IP address sometimes it's auto selects correctly.

Sometimes it doesn't.

In this case it did.

And then we have the airport which is by default all floors.

So that's fine for now.

It's fine for these lessons when you get into actually running this in the wild.

All fours is probably going to get you picked up pretty quick because this is a default interpreter

port.

So some connection sees a or some antivirus or detection software sees 4 4 4 4 open up.

This is going to trigger an alarm here.

But anyway for this course you're not going need to worry about too much right now.

We're going to go ahead and set a payload.

We're going to say set payload.

And how do we know what payload to pick.

Let's just start typing out Linux and hit tab in the auto tabs out the x 86 part for us and those just

hit double tab.

All right.

Now a double tab.

That's great.

Look at the payload options we have.

We've got a bunch now we've got a bunch of interpreters but unfortunately they're all stage payloads

here.

I love a good interpreter shell.

And you guys will understand why as we move forward.

But as of right now it doesn't look we're gonna be able to use one.

We come over to this right column here you can see that we've got other shells as well and we come down

and finally down here.

We've got a few options that are non staged so let's go ahead and try this shell reverse underscore

T C P right here and you could just start typing that out and that should auto tab complete for you

go ahead and hit enter.

Hit options will more time to make sure that this actually works.

You can see here that it actually picked up and now let's go ahead and try to run this and let's see

if it happens fingers crossed a look at that.

So we've got a shell now and this is Command shell session of five.

Let's try my route hostname captures level one.

We have successfully routed this machine route is the commander of the system we cannot go any deeper

than this.

We own this machine.

Hands down it's our machine.

So congratulations.

You have made it this far.

This is your first routed machine.

You should be very proud.

Pat yourself on the back.

You're awesome.

So from here we're going to go ahead and we're going to focus on port 80 and 4 4 3 in how we can exploit

those manually and then we'll move on to some other exploitation techniques.

But for now congratulate yourself.

You have your first shell.

I'm very excited for you.

So I'll catch you over in the next video as you start some manual exploitation.