Metasploitable3

Description

🔗 Metasploitable3 - rapid7 Github

Metasploitable3 is a VM that is built from the ground up with a large amount of security vulnerabilities. It is intended to be used as a target for testing exploits with Metasploit.

• Vulnerabilities

Credentials

• U: vagrant P: vagrant

• U: leah_organa P: help_me_obiw@n

• U: luke_skywalker P: use_the_f0rce

• U: han_solo P: sh00t-first

• U: artoo_detoo P: beep_b00p

• U: c_three_pio P: pr0t0c0l

• U: ben_kenobi P: thats_no_moon

• U: darth_vader P: d@rk_sid3

• U: anakin_skywalker P: yipp33!!

• U: jarjar_binks P: mesah_p@ssw0rd

• U: lando_calrissian P: b@ckstab

• U: boba_fett P: mandalorian1

• U: jabba_hutt P: not-a-slug12

• U: greedo P: hanShotFirst!

• U: chewbacca P: rwaaaaawr5

• U: kylo_ren P: daddy_issues1

All of the above users are in various user groups of varying levels of privileges.

Installation - Vagrant

• Install 🔗 Vagrant

• Open folder with Powershell.

vagrant plugin install vagrant-reload

mkdir metasploitable3-workspace
cd metasploitable3-workspace
Invoke-WebRequest -Uri "https://raw.githubusercontent.com/rapid7/metasploitable3/master/Vagrantfile" -OutFile "Vagrantfile"

• Whitelist metasploitable3-workspace folder in the Antivirus

Configure Vagrantfile (only for VMware)

📌 With VMware Workstation, Vagrant file needs some additional lines to make it work and show the VMs in the VMware Library

• Open Vagrantfile with a text editor

• Add those lines for both VMs

ub1404.vm.provider "vmware_desktop" do |v|
  v.vmx["displayname"] = "Metasploitable3-ub1404"
  v.memory = 2048
  v.cpus = 2
  v.gui = true
end

win2k8.vm.provider "vmware_desktop" do |v|
  v.vmx["displayname"] = "Metasploitable3-win2k8"
  v.memory = 4096
  v.cpus = 2
  v.gui = true
end

Vagrantfile for VMware

Run the VMs

VMware

• Run vagrant with this commands to download and start the VMs with VMware

vagrant cap provider scrub_forwarded_ports
vagrant up --provider=vmware_desktop

VirtualBox

• Or run vagrant with this command to download and start the VMs with VirtualBox

vagrant up --provider=virtualbox

Win2k8

• To fully disable firewall on the Win2k8 VM, run with CMD ad admin

netsh advfirewall set allprofiles state off

Connection

When both the VMs are ready, they can be opened.

Login default credentials are vagrant:vagrant

ub1404 VM

vagrant-2008r2 VM

Stop the VMs

• To stop the VMs run this command that will attempt graceful shutdown of the VMs

vagrant halt

• If this doesn't work, proceed with manual shutdown of the Virtual Machines inside VMware/VirtualBox.

Vulnerabilities List

GlassFish

Ports

• 4848 - HTTP

• 8080 - HTTP

• 8181 - HTTPS

Credentials

• Username: admin

• Password: sploit

Access

• On Metasploitable3, point your browser to http://localhost:4848.

• Login with the above credentials.

Start/Stop

• Stop: Open task manager and kill the java.exe process running glassfish

• Start: Go to Task Scheduler and find the corresponding task. Right-click and select Run.

Vulnerability IDs

• CVE-2011-0807

Modules

• exploits/multi/http/glassfish_deployer

• auxiliary/scanner/http/glassfish_login

Apache Struts

Ports

• 8282 - HTTP

Credentials

• Apache Tomcat Web Application Manager

  • U: sploit

  • P: sploit

Access

• To access the vulnerable application, point your browser on Metasploitable3 to http://localhost:8282/struts2-rest-showcase

• To access the Apache Tomcat Manager, point your browser on Metasploitable3 to http://localhost:8282. Login with the above credentials.

Start/Stop

• Stop: Open services.msc. Stop the Apache Tomcat 8.0 Tomcat8 service.

• Start: Open services.msc. Start the Apache Tomcat 8.0 Tomcat8 service.

Vulnerability IDs

• CVE-2016-3087

Modules

• exploit/multi/http/struts_dmi_rest_exec

Tomcat

Ports

• 8282 - HTTP

Credentials

• U: sploit

• P: sploit

Access

• To access the Apache Tomcat Manager, point your browser on Metasploitable3 to http://localhost:8282. Login with the above credentials.

Start/Stop

• Stop: Open services.msc. Stop the Apache Tomcat 8.0 Tomcat8 service.

• Start: Open services.msc. Start the Apache Tomcat 8.0 Tomcat8 service.

Vulnerability IDs

• CVE-2009-3843

• CVE-2009-4189

Modules

• auxiliary/scanner/http/tomcat_enum

• auxiliary/scanner/http/tomcat_mgr_login

• exploits/multi/http/tomcat_mgr_deploy

• exploits/multi/http/tomcat_mgr_upload

• post/windows/gather/enum_tomcat

Jenkins

Ports

• 8484 - HTTP

Credentials

• None enabled by default

Access

• Point your browser on Metasploitable3 to http://localhost:8484.

Start/Stop

• Stop: Open services.msc. Stop the jenkins service.

• Start: Open services.msc. Start the jenkins service.

Modules

• exploits/multi/http/jenkins_script_console

• auxiliary/scanner/http/jenkins_enum

IIS - FTP

Ports

• 21 - FTP

Credentials

Windows credentials

Access

Any FTP client should work

Start/Stop

• Stop: net stop msftpsvc

• Start: net start msftpsvc

Modules

• auxiliary/scanner/ftp/ftp_login

IIS - HTTP

Ports

• 80 - HTTP

Credentials

• U: vagrant

• P: vagrant

Access

• Point your browser on Metasploitable3 to http://localhost.

Start/Stop

• Stop: Open services.msc. Stop the World Wide Web Publishing service.

• Start: Open services.msc. Start the World Wide Web Publishing service.

Vulnerability IDs

• CVE-2015-1635

Modules

• auxiliary/dos/http/ms15_034_ulonglongadd

psexec

Ports

• 445 - SMB

• 139 - NetBIOS

Credentials

• Any credentials valid for Metasploitable3 should work. See the list here

Access

• Use the psexec tool to run commands remotely on the target.

Start/Stop

• Enabled by default

Vulnerabilities

• Multiple users with weak passwords exist on the target. Those passwords can be easily cracked and used to run remote code using psexec.

Modules

• exploits/windows/smb/psexec

• exploits/windows/smb/psexec_psh

SSH

Ports

• 22 - SSH

Credentials

• Any credentials valid for Metasploitable3 should work. See the list here

Access

• Use an SSH client to connect and run commands remotely on the target.

Start/Stop

• Enabled by default

Vulnerabilities

• Multiple users with weak passwords exist on the target. Those passwords can be easily cracked. Once a session is opened, remote code can be executed using SSH.

Modules

WinRM

Ports

• 5985 - HTTPS

Credentials

• Any credentials valid for Metasploitable3 should work. See the list here

Access

Start/Stop

• Stop: Open services.msc. Stop the Windows Remote Management service.

• Start: Open services.msc. Start the Windows Remote Management service.

Vulnerabilities

• Multiple users with weak passwords exist on the target. Those passwords can be easily cracked and WinRM can be used to run remote code on the target.

Modules

• auxiliary/scanner/winrm/winrm_cmd

• auxiliary/scanner/winrm/winrm_wql

• auxiliary/scanner/winrm/winrm_login

• auxiliary/scanner/winrm/winrm_auth_methods

• exploits/windows/winrm/winrm_script_exec

chinese caidao

Ports

• 80 - HTTP

Credentials

• Any credentials valid for Metasploitable3 should work. See the list here

Access

• Point your browser on metasploitable3 to http://localhost/caidao.asp

Start/Stop

• Stop: Open services.msc. Stop the World Wide Web Publishing service.

• Start: Open services.msc. Start the World Wide Web Publishing service.

Modules

• auxiliary/scanner/http/caidao_bruteforce_login

ManageEngine

Ports

8020 - HTTP

Credentials

Username: admin Password: admin

Access

On Metasploitable3, point your browser to http://localhost:8020. Login with the above credentials.

Start/Stop

• Stop: In command prompt, do net stop ManageEngine Desktop Central Server

• Start: In command prompt, do net start ManageEngine Desktop Central Server

Vulnerability IDs

• CVE-2015-8249

Modules

• exploit/windows/http/manageengine_connectionid_write

ElasticSearch

Ports

9200 - HTTP

Credentials

No credentials needed

Access

On Metasploitable3, point your browser to http://localhost:9200.

Start/Stop

• Stop: In command prompt, do net stop elasticsearch-service-x64

• Start: In command prompt, do net start elasticsearch-service-x64

Vulnerability IDs

• CVE-2014-3120

Modules

• exploit/multi/elasticsearch/script_mvel_rce

Apache Axis2

Ports

8282 - HTTP

Credentials

No credentials needed

Access

On Metasploitable3, point your browser to http://localhost:8282/axis2.

Start/Stop

Log into Apache Tomcat, and start or stop from the application manager.

Vulnerability IDs

• CVE-2010-0219

Modules

• exploit/multi/http/axis2_deployer

WebDAV

Ports

8585 - HTTP

Credentials

No credentials needed

Access

See the PR here: https://github.com/rapid7/metasploitable3/pull/16

Start/Stop

• Stop: In command prompt, do net stop wampapache

• Start: In command prompt, do net start wampapache

Modules

• auxiliary/scanner/http/http_put (see https://github.com/rapid7/metasploitable3/pull/16)

SNMP

Ports

161 - UDP

Credentials

Community String: public

Access

Load the auxiliary/scanner/snmp/snmp_enum module in Metasploit and to parse the SNMP data.

Start/Stop

• Stop: In command prompt, do net stop snmp

• Start: In command prompt, do net start snmp

Modules

• auxiliary/scanner/snmp/snmp_enum

MySQL

Ports

3306 - TCP

Credentials

U: root P:

Access

Use the mysql client to connect to port 3306 on Metasploitable3.

Start/Stop

• Stop: In command prompt, do net stop wampmysql

• Start: In command prompt, do net start wampmysql

Modules

• windows/mysql/mysql_payload

JMX

Ports

1617 - TCP

Credentials

No credentials needed

Access

Download the connector client and use the instructions found here: http://docs.oracle.com/javase/tutorial/jmx/remote/index.html

Start/Stop

• Stop: In command prompt, do net stop jmx

• Start: In command prompt, do net start jmx

Vulnerability IDs

• CVE-2015-2342

Modules

• multi/misc/java_jmx_server

Wordpress

Ports

8585 - HTTP

Credentials

No credentials needed

Access

On Metasploitable3, point your browser to http://localhost:8585/wordpress.

Start/Stop

• Stop: In command prompt, do net stop wampapache

• Start: In command prompt, do net start wampapache

Vulnerable Plugins

• NinjaForms 2.9.42 - CVE-2016-1209

Modules

• unix/webapp/wp_ninja_forms_unauthenticated_file_upload

Remote Desktop

Ports

3389 - RDP

Credentials

Any Windows credentials

Access

Use a remote desktop client. Either your OS already has one, or download a 3rd party.

Start/Stop

• Stop: net stop rdesktop

• Start: net start rdesktop

Modules

N/A

PHPMyAdmin

Ports

8585 - HTTP

Credentials

U: root P:

Access

On Metasploitable3, point your browser to http://localhost:8585/phpmyadmin.

Start/Stop

• Stop: In command prompt, do net stop wampapache

• Start: In command prompt, do net start wampapache

Vulnerability IDs

• CVE-2013-3238

Modules

• multi/http/phpmyadmin_preg_replace

Ruby on Rails

Ports

• 3000- HTTP

Credentials

N/A

Access

• On Metasploitable3, point your browser to http://localhost:3000.

Start/Stop

• Stop: Open task manager and kill the ruby.exe process

• Start: Go to Task Scheduler and find the corresponding task. Right-click and select Run.

Vulnerability IDs

• CVE-2015-3224

Modules

• exploit/multi/http/rails_web_console_v2_code_exec

---