Next, we will go through an example of how vulnerabilities can be identified from scanned targets. First, perform the same mapping steps as in the previous module. Start the lab and follow along.

@exercise 33e12568c6aa

## Mapping phase

The next step is similar to the previous module and consists of the following commands.

```sh
# Database preparation
service postgresql start
msfdb init

# Starting Metasploit
msfconsole

# Scanning (we use -p- which tells us to scan all ports)
db_nmap -p- <IP>
db_nmap -A -p- <IP>
```

Afterwards, we can verify that we have visibility of the target's open ports and the services listening on them.

```sh
msf6 > services
Services
========

host port proto name state info
---- ---- ----- ---- ---- ---- ----
10.0.2.51 22 tcp ssh open OpenSSH 4.7p1 Debian 8ubuntu1 protocol 2.0
10.0.2.51 25 tcp smtp open Postfix smtpd
10.0.2.51 53 tcp tcpwrapped open
10.0.2.51 111 tcp rpcbind open 2 RPC #100000
10.0.2.51 139 tcp netbios-ssn open Samba smbd 3.X - 4.X workgroup: WORKGROUP
10.0.2.51 445 tcp 0����)��u open Samba smbd 3.0.20-Debian workgroup: WORKGROUP
10.0.2.51 2121 tcp ftp open ProFTPD 1.3.1
10.0.2.51 3306 tcp mysql open MySQL 5.0.51a-3ubuntu5
10.0.2.51 3632 tcp distccd open distccd v1 (GNU) 4.2.4 (Ubuntu 4.2.4-1ubuntu4)

```

---

## Vulnerability Detection

Now we can start identifying potential vulnerabilities. This process often includes using public sources, such as the [Exploit-DB](https://exploit-db.com) website. The idea is to compare detected services to known vulnerabilities and search for correlations between them. Simply put, we compare scanned services and their versions to known vulnerabilities. However, there are also automatic approaches, such as nmap vulnerability scripts, which search for known vulnerabilities in these services. The accuracy of these varies, but it is a good way to start mapping vulnerabilities.

Performing a vulnerability scan on an open port 3632 which has a distcc service.

```sh
db_nmap -p3632 --script vuln <IP>
```

From the output, we can see that the service in question has a serious public vulnerability that allows for the execution of commands by an attacker.

```sh
[*] Nmap: Starting Nmap 7.94 ( https://nmap.org ) at 2023-10-08 15:24 UTC
[*] Nmap: Nmap scan report for 10.0.2.51
[*] Nmap: Host is up (0.00018s latency).
[*] Nmap: PORT STATE SERVICE
[*] Nmap: 3632/tcp open distccd
[*] Nmap: | distcc-cve2004-2687:
[*] Nmap: | VULNERABLE:
[*] Nmap: | distcc Daemon Command Execution
[*] Nmap: | State: VULNERABLE (Exploitable)
[*] Nmap: | IDs: CVE:CVE-2004-2687
[*] Nmap: | Risk factor: High CVSSv2: 9.3 (HIGH) (AV:N/AC:M/Au:N/C:C/I:C/A:C)
[*] Nmap: | Allows execution of arbitrary commands on systems running distccd 3.1 and
[*] Nmap: | earlier. Vulnerability is the consequence of weak service configuration.
[*] Nmap: |
[*] Nmap: | Disclosure date: 2002-02-01
[*] Nmap: | Extra information:
[*] Nmap: |
[*] Nmap: | uid=1(daemon) gid=1(daemon) groups=1(daemon)
[*] Nmap: |
[*] Nmap: | References:
[*] Nmap: | https://distcc.github.io/security.html
[*] Nmap: | https://nvd.nist.gov/vuln/detail/CVE-2004-2687
[*] Nmap: |_ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2687
[*] Nmap: Nmap done: 1 IP address (1 host up) scanned in 10.36 seconds
```

We can search for ready-made attack modules (exploits) in Metasploit to exploit vulnerability.

```sh
msf6 > search Exploit distcc

Matching Modules
================

   # Name Disclosure Date Rank Check Description
   - ---- --------------- ---- ----- -----------
   0 exploit/unix/misc/distcc_exec 2002-02-01 excellent Yes DistCC Daemon Command Execution

```

We can also read more information about the module in question using the *info* command.

```sh
msf6 > info exploit/unix/misc/distcc_exec

       Name: DistCC Daemon Command Execution
     Module: exploit/unix/misc/distcc_exec
   Platform: Unix
       Arch: cmd
 Privileged: Well
    License: Metasploit Framework License (BSD)
       Rank: Excellent
  Disclosed: 2002-02-01

Provided by:
  [MISSION]

Available targets:
      Id Name
      -- ----
  => 0 Automatic Target

Check supported:
  Yes

Basic options:
  Name Current Setting Required Description
  ---- -------------- -------- -----------
  RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
  RPORT 3632 yes The target port (TCP)

Payload information:
  Space: 1024

Description:
  This module uses a documented security weakness to execute
  arbitrary commands on any system running distccd.

References:
  https://nvd.nist.gov/vuln/detail/CVE-2004-2687
  OSVDB (13378)
  http://distcc.samba.org/security.html

View the full module info with the info -d command.
```

You can try to exploit the vulnerability using Metasploit and see if you can gain control of the target machine. It is important to remember that not every vulnerability can be found in Metasploit and that automated approaches are not always perfect. If you want to have the most reliable information, it is wise to use Google and search for information about possible vulnerabilities that may exist in services. This is especially true if it concerns less known services or very new vulnerabilities. Later in the course, we will go through how to add new modules to Metasploit that are not included by default.

@exercise 45cbfc8bb78b


In this lab, there are several different vulnerable web services that you can search for with Metasploit.

Metasploit Practice

Identifying vulnerabilities

Metasploit is a popular attack framework that helps professionals identify and exploit security holes. In this course, you will go through the use of Metasploit and learn how it can be used to carry out attacks and find security holes.

Metasploit, the Swiss Army Knife of Penetration Testing

Welcome to the wonderful world of Metasploit! Metasploit is a penetration testing framework used by cybersecurity professionals throughout the world.

In this context, a framework refers to a codebase. More specifically, it refers to a stack of reusable Ruby code that makes it convenient to create more Ruby code that does cyber stuff. Particularly, the framework is designed for penetration testing.

You don't need to know how to code in Ruby to use Metasploit. In the course, we will also explore customization and building our own modules, but Metasploit already has thousands of these modules ready for you to get started. Besides, Metasploit now also supports Python extensions.

Module is a Ruby file in the Metasploit directory that serves a specific purpose.

There are different types of modules for different purposes. For example, the 

 modules (located in the exploits directory) are attacks that exploit a vulnerability and typically open a command channel to the compromised device, such as a server.

Modules are not used directly from files, but with tools of the Metasploit framework such as 

The flagship command-line tool of Metasploit is 

. With the tool, it is easy to search for and use Metasploit modules.

In the course, you progress step by step and practice using various techniques using Metasploit in the Hakatemian lab environment. After that, you will move on to exercises where you will no longer receive assistance, you only know the target's IP address, and you have access to Nmap and Metasploit, as well as the goal of breaking into the server by applying the skills you have learned in the course.

Identifying vulnerabilities

Learn to hack — start here