30th National Conference with International Participation "Telecom 2022", October 27 - 28, 2022, Sofia, Bulgaria

Laboratory Penetration Test Studies

Ivan Ivanov Mariyana Dimitrova Aleksandra Ivanov
Information Technology Information Technology Information Technology
University of Telecommunications and University of Telecommunications and University of Telecommunications and
Posts Posts Posts
Sofia, Bulgaria Sofia, Bulgaria Sofia, Bulgaria
[Link]@[Link] mariyana1dimitrova1@[Link] ivanov.aleksandra9@[Link]

Abstract— Penetration testing involves an authorized III. TESTING VARIOUS VULNERABILITIES AND PERFORMING
attempt to gain unauthorized access to a computer system, HACKING ATTACKS ON THE LINUX MACHINE
application, or data. Ethical hacking involves duplicating the "METASPLOITABLE 2"
strategies and actions of malicious attackers. This practice
2022 30th National Conference with International Participation (TELECOM) | 978-1-6654-8212-7/22/$31.00 ©2022 IEEE | DOI: 10.1109/TELECOM56127.2022.10017266

helps identify security vulnerabilities that can be patched When testing a machine it's a good idea to start by
before a malicious attacker has a chance to exploit them. The scanning the network it's connected to and more specifically
article examines and analyzes the penetration tests in what applications or services it hosts. One of the most
laboratory conditions, as well as their practical famous tools - "nmap" - is used for scanning. Nmap is built
implementation. into Kali Linux and has two ways to use it - through a GUI
application or through terminal commands. For the intended
Keywords— penetration testing, hacker, ethical hacking,
purpose, the application is used through the terminal to scan
cracker, hacker attacks
the machine, but before that, in order to be able to scan, its
I. INTRODUCTION IP must be detected. This can be done in many different
ways, but in this case all local network addresses are
It is difficult to predict what will happen in the future, but
it is a fact that in the last 40 years, the world looks scanned because both machines get their IP directly from
completely different thanks to the advance of technology. the local machine's network card and are connected to the
Rapid development has many positive and negative sides. network like any other device.
For example, technology facilitates different forms of To start Nmap and discover the devices on the currently
communication, accelerates the collection, processing and connected network, open a terminal in Kali Linux (circled in
analysis of data, facilitates access to information, but at the red in Fig. 1) and enter the command "nmap –sn
same time, this can lead to a violation of privacy, as a result [Link]/24" (marked with yellow in Fig.1). The name of
of misuse, theft, leakage of information or many other the application is written, then the "-sn" parameter is set,
reasons. and the gateway/subnet mask is added after it. A mask of 24
is selected for the scan, which means that all 256 addresses
II. TESTING VARIOUS VULNERABILITIES BY SIMULATING on the network will be scanned. Thanks to the "sn"
HACKER ATTACKS parameter, the scan will only perform Host Discovery
To carry out hacker attacks, open-source operating without scanning the ports of the discovered hosts. This is
systems and machines prepared specifically for testing are often called a "ping scan" (fig. 1) [3]. Since this is a small
used. The machine from which the attacks are carried out local network, the results will be less and it is easy to guess
uses an open source, Debian-based Linux distribution which machine is targeted, but in a real attack, the hacker
known as "Kali Linux". Kali Linux contains over 600 tools will have to spend a lot of time scanning each of the active
for various tasks related to information security, such as hosts since the organization will use almost all addresses.
Penetration Testing, security research, etc. [1] For this reason, most of the times hackers use phishing to
Two machines with operating systems "Linux" and steal the IP of the targeted machine. The "Metasploitable 2"
"Windows" are used for testing vulnerabilities and test machine is IP: "[Link]".
simulating hacker attacks. These machines are created in the
free-to-distribute virtualization software "Oracle
VirtualBox".
The Linux machine is an open source platform and
custom test environment providing a safe place for security
research and attack simulation and is named "Metasploitable
2". It has no graphical interface and is connected to the
network by connecting the virtual network adapter to the
physical network adapter of the machine ("Bridged
network") [2]
The Windows machine is version “10 Enterprise” and Fig. 1. Scan the local network using Nmap
has a valid license from Microsoft. It also uses the bridge This can be easily confirmed by doing a different scan
configuration to obtain an IP. on the particular machine, using the '-sV' parameter instead
of '-sn'. Along with this one more parameter "p0-" can be
added. The whole command looks like this "nmap –sV

978-1-6654-8212-7/22/$31.00 ©2022 IEEE

Authorized licensed use limited to: Ministry of Higher Education (HQ). Downloaded on December 22,2023 at 12:52:29 UTC from IEEE Xplore. Restrictions apply.
[Link] –p0-" (fig. 2). When using parameters, it is Since this is a whole platform, it has its own language.
important to note that capitalization matters. Example: "-sV" To find out more about the tool language, enter the "help"
is a working parameter, while "-sv" is not. Also, nmap is command (fig. 5). This outputs a result with the various
smart enough to read the parameters regardless of whether commands that can be used for modules, tasks, etc. (fig. 6).
they are placed after the IP address or before it. The interest is on the "search" command, which allows
As seen in Figure 2, the scan was successful and about searching by specific words. After running the “search
30 open ports and the services behind them were detected. vsftpd 2.3.4” command one can see the result depicted in
The other 65506 ports are closed. At the bottom of the fig. 7.
results, under "Service Info" the operating system type is
situated, confirming that this is the targeted Linux machine.

Fig. 5. Entering "help" command

Fig. 6. Results of "help" command.

Fig. 2. Scan the ports of the targeted machine.

IV. TESTING FOR PORT 21 VULNERABILITIES (VSFTPD 2.3.4) Fig. 7. Malware scan for vsftpd 2.3.4
Since hackers are always aware of the latest updates to The result shows a single exploit and that is a Backdoor
applications and operating systems, one of the things that that allows command execution. In order to use this
catches the eye at first glance is outdated versions. Each malicious code, the command "use" must be entered
technology is updated to improve security gaps, improve followed by the name ("Name" column fig. 7) of the exploit
functionality, graphical updates, etc. When updates are not in question. Together it looks like: "use
made, the system becomes outdated and is very prone to exploit/unix/ftp/vsftpd_234_backdoor" (fig. 8).
intrusions by outside unauthorized persons. Vsftpd is
version 2.3.4. This is a reliable file sharing server, but this
version is old, as the vsftpd documentation now shows the
latest version to be 3.0.5. [4] An extensive internet search Fig. 8. Executing a command to use the malicious code.
revealed that vsftpd 2.3.4 contains quite a few
After selecting each exploit, "options" or "parameters"
vulnerabilities, but one of them is that it allows a backdoor
must be set. This most of the time includes basic parameters
to be created in a very easy way. [5] "Backdoors" literally
like victim IP and port and other times different parameters
translated from English - "back doors" are undocumented
like file or command execution path, name and password
ways to access systems without requiring authentication. [6]
etc. To display the options, enter the "show options"
The "Metasploit framework" software will be used to add
command (fig.9). Two options named “RHOSTS” and
the "backdoor". It is the most used testing software in the
“RPORT” are displayed. The full name of RHOSTS is
world [7]. To start Metasploit, enter the command
Remote Host and RPORT is Remote port. In this case, the
"msfconsole" in the terminal (fig. 3).
host will be the IP of the targeted machine and the port will
be 21 because the FTP server uses that port. From the
Fig. 3. Command to open Metasploit. column "Required" - "yes" it is understood that this option is
mandatory. To enter the IP of the victim under RHOSTS,
Then, the tool starts, generates some "image" and the the command "set RHOSTS [Link]" is used (fig. 10).
msf6 console opens. The version (6.1.8-dev) and
information on the number of all types of malicious scripts
and exploits are shown in fig. 4.

Fig. 9. Show options using "show options" command

Fig. 10. Entering the victim's IP.

Confirmation that the IP is set is received via the

message "SET RHOSTS => [Link]". After entering all
Fig. 4. Metasploit tool
mandatory options, proceed to the execution of the "attack".

Authorized licensed use limited to: Ministry of Higher Education (HQ). Downloaded on December 22,2023 at 12:52:29 UTC from IEEE Xplore. Restrictions apply.
This is done by entering the "exploit" or "run" command already known Metasploit Framework and can generate
(fig. 11). "payloads" or "malicious loads" for various platforms such
as Windows, Unix, Android and many others. [9]
To generate the file, open a new terminal and use the
command "msfvenom -p windows/x64/meterpreter/
reverse_tcp --arch x64 --platform Windows LHOST
Fig. 11. Execution of the malicious code against the VSFTPD server. =[Link] LPORT=53 -f exe -o utp_calendar
¬_app.exe" (fig. 13).
Based on the result, it is judged that the attack is
successful and a session is established between the attacking
machine (highlighted in blue in Fig. 11) and the attacked
machine (highlighted in yellow in Fig. 11). This means that
at this stage the attacker has full control of the system Fig. 13. Command to create the malicious file using msfvenom.
because the message "UID: uid=0(root) gid=0(root)" means This command is more complex as it contains more
that the current user in the session is "root" which is the parameters such as [9]:
main administrator account. To make it easier to navigate • -p or --payload // allows specifying the specific
and execute commands, one can enter the command “shell” payload to be used when opening the application.
which will open the familiar linux terminal (fig. 12). • --arch // used to indicate operating system architecture
(x64 or x86 (32 bit))
• --platform // indicates the operating system type
• LHOST // enter the IP of the local host (the attacking
machine)
Fig. 12. Open "shell" and execute commands. • LPORT // enter the desired port to establish
communication
Once the "shell" is open, the usual Linux commands can • -f // to set format (exe, jpg, jpeg…)
be run like "whoami" - to find out who the current user is, • -o // to save the malicious load (payload)
"ls" - to display the contents of the current directory and If the entire command is to be read, it should mean that
basically any other command that is allowed of the specified msfvenom should use a reverse_tcp 'payload', meaning that
operating system (fig. 12). instead of the attacker initializing a connection to the victim,
At this stage, this machine is completely compromised, the victim will open a connection to the attacking machine,
which is a major threat to the organization's security and making access easier as it will not be blocked by the
infrastructure. The attacker has full access to it and can do network wall. [9] The "payload" in question is created for
whatever he wants. This includes changing files, stealing the 64-bit architecture of the "Windows" platform, in "exe"
files, information such as usernames, passwords, files from format and named "utp_calendar_app".
the server, creating an account, uploading malware, or even Once the file is created, open Metasploit via the
completely destroying the machine. msfconsole command and enter the use multi/handler
This attack would not be possible if the file server command. This is a piece of code that handles exploits that
behind port 21 was receiving software updates. The attack are created outside of the platform (fig. 14).
was possible without the need for an account because the
code to verify the username entered has gaps and opens a
listening port 6200 when the ":)" characters known as
smileys are entered. It is important to test a system before it
is part of the Internet to avoid such attacks [8].
V. EXPLOITATION OF A WINDOWS SYSTEM THROUGH A
MALICIOUS FILE Fig. 14. Using multi/handler
In addition to holes in the programming code of software When using multi/handler the payload to be expected
applications, a system can also be compromised through a must also be specified. Figure 14 shows that the
malicious file that is pre-created, sent to the target, and "generic/shell_reverse_tcp" payload is selected. This should
contains malicious code. Most of the time, anti-virus be changed to the same payload used to create the file,
systems catch the "handwriting" of the malicious files and namely - "windows/x64/meterpreter/reverse_tcp". To
manage to quarantine and remove them. When such change the malicious payload, the "set payload
software is not available or is disabled or bypassed for some windows/x64/meterpreter/reverse_tcp" command is used
reason, then the system becomes vulnerable and can easily (fig. 15).
be accessed by an outsider by simply opening a file.
To prove this point, a file that contains malicious code is
created, it is somehow sent to the victim, and once the file is
opened, the machine is completely under the hacker's
control. The malicious file can be created using the
“msfvenom” tool, which is also part of Kali Linux.
Msfvenom is a combination of Msfpayload and Msfencode,
putting both tools in one instance. This tool is part of the Fig. 15. Changing the selected "payload".

Authorized licensed use limited to: Ministry of Higher Education (HQ). Downloaded on December 22,2023 at 12:52:29 UTC from IEEE Xplore. Restrictions apply.
 After setting the correct payload, enter the "show If the command is successful, an "html" file will be created,
options" command (fig. 15) to be able to enter the correct which will open in the browser and broadcast the remote
host and port where the connection will be opened. The computer's screen (fig. 21)
commands "set LHOST=[Link]" and "set LPORT
53" are entered (fig. 16). The same options as previously
explained when creating the malicious payload are used.
After all mandatory fields are filled in correctly, the
"exploit" command is entered. After starting, the message Fig. 21. Broadcast the victim's screen in real time.
"Started reverse TCP handler on [Link]:53" is
displayed, which reports that snooping on port 53 has been Additionally, the "webcam_stream" command can be
successfully started, which means that the attacking used to start a live webcam broadcast. In combination with
machine's port is open and ready to establish a connection if this, the "record_mic" command can be used, which will
another machine initializes one. start recording a recording from the victim's microphone.
If the hacker wants to know more details about the
compromised system, he can use "sysinfo" command
(fig. 22).
Fig. 16. Launching the attack.
Once the port is ready and listening, all that remains is
for the victim to execute the previously created application
"utp_calendar_app.exe". When opening the application, a Fig. 22. Running "sysinfo" command.
window is displayed with the notification that the source of It gives more information about the operating system
the application is not recognized (fig. 17). After opening the such as version, shows the system language, domain,
application, apparently nothing happens. At this point, the architecture, number of users on the system and which
victim will think that something has gone wrong and may "meterpreter" is being used.
delete the app. Even if that happens, she doesn't know that
the hacker already has full access to the machine. CONCLUSION
After successfully executing the attack, it can be
concluded that people should not trust any file, even if it
comes from a known source or person. Sometimes, a system
can be compromised very easily and without the victim's
Fig. 17. Notification of an unknown source, when executing the knowledge if there are no malware scanning and prevention
application. software available. There are countless sites and applications
If the previous window of Figure 16 is opened, it can be on the Internet that at first glance seem harmless, but can
seen that the port already has one session established eventually lead to system exploitation.
between the attacking machine and the attacked machine
(fig. 18). ACKNOWLEDGMENT
Primary funding for the presented work was provided by
the National Science Fund, Ministry of Education and
Science, Republic of Bulgaria under contract № 30-
Fig. 18. Successful attack. Establishing a session between the two 358#3/03.06.2022, research project “Investigations with
machines. penetration testing of applications, networks, systems and
Since the “payload” - windows/x64/meterpreter/ platforms in a laboratory setting”.
reverse_tcp was used, the attacker gets the “Meterpreter REFERENCES
shell”. Meterpreter is a malicious payload or attack that
[1] [Link]
provides an interactive shell through which an attacker can
[2] [Link]
control the machine and execute commands. Meterpreter
[3] Georgia Weidman, Penetration Testing: A Hands-On Introduction to
runs entirely in memory and does not write any data to the Hacking, No Starch Press; 1st edition (June 14, 2016).
hard disk. Thus, it is very difficult to identify the perpetrator [4] Gus Khawaja, Kali Linux Penetration Testing Bible, Wiley; 1st
of the attack. This interactive “shell” uses a slightly different edition (May 14, 2021)..
syntax and therefore the “whoami” command does not [5] Dafydd Stuttard, Marcus Pinto, The Web Application Hacker's
work. Instead, "getuid" can be used, which will show the Handbook: Finding and Exploiting Security Flaws, Wiley; 2nd
user currently using the server, namely - "Admin" (fig. 19). edition (September 27, 2017).
[6] Andress J. The Basics of Information Security, Second Edition:
Understanding the Fundamentals of InfoSec in Theory and Practice
Fig. 19. Command to verify current user. 2nd Edition, Syngress, 2014.
The attacker can execute any command on the victim's [7] Conklin W. A, White G, Cothren C, Davis R, Williams D, Principles
of Computer Security, Fourth Edition (Official Comptia Guide) 4th
machine. This even includes broadcasting the screen in real Edition, McGraw-Hill Education, 2015.
time via the "screenshare" command (fig. 20). [8] Kim D, Solomon M, Fundamentals of Information Systems Security
3rd Edition, Jones & Bartlett Learning, 2016
[9] Ivan Ivanov, Information Security, Avangard Prima, ISBN: 978-619-
239-755-5, 2022.
Fig. 20. Broadcast the victim's screen in real time.

Authorized licensed use limited to: Ministry of Higher Education (HQ). Downloaded on December 22,2023 at 12:52:29 UTC from IEEE Xplore. Restrictions apply.