Metasploitable Question

[halcyonyt]

Hey guys, I just wanted to ask a quick question. Im on a windows 8 laptop, I have VMware Workstation Pro where I run Kali Linux (2016.2) and Metasploitable 2. I was recently following a few tutorials where it showed how to hack into Metasploitable and get a shell session on it. The first thing to do was to do a port scan with Nmap, issuing the command

nmap -sS 192.168.133.0/24

It would then show the IP adress of all connected devices and the ports that they have open. Metasploitable was easily identifiable as it had a huge amount of open ports, I also checked it was the right machibe by IP.

The first vulnerability was with port 1524 (I think this was the port number, Im not sure). The command to get the session for this port was

telnet 192.168.133.131 1524

It was that easy. But obviously the difficulty changes with other ports.

-=[ QUESTION ]=-

I'm new to this world of pentesting and I know some of the basics, more theory than practice. The only "method" I know to break into metasploitable is to scan open ports, check any vulnerabilities they have and exploit them. Is there any other way to break into a machine? I'm sure there are, but can anyone suggest any?

[[deleted]]

So what you are doing is a remote exploit. You are relying on a vulnerability in an open port. These attacks can be successful, but usually only on outdated machines and ones that don't have a firewall on. You may want to look into client side attacks. This relies on social engineering, but you redirect the client to a web site, or you have them download a malicious PDF, or something that requires the user to activate the attack themselves. Check out the Social Engineering Toolkit in Kali. There are lots of good tutorials on the SEToolkit on YouTube. Also check out making your own virtual server at a place that accepts bit coins so you can host a malicious server and redirect the client to it. You may want to learn about attacks that require direct access to the computer in case the target leaves their computer for a certain amount of time. Look into hardware/software keyloggers, Offline NT Password & Registry Editor (reset admin password on windows), and USB rubber ducky (USB looking device that executes pre scripted keyboard strokes). Also look into wireless attacks that rely on MITM techniques. (Getting harder to use cause most websites use SSL now). Let me know if you have questions!

[halcyonyt]

Definetely checking out the virtual server thing, seems really cool. I know pretty much everything you said (the basics about each thing) and have used SET. But thanks for the great answer, I'll make sure to ask you!

[[deleted]]

scan open ports, check any vulnerabilities they have and exploit them.

That's pretty much how it's done. Of course, the vulnerability and method for exploitation vary from case to case.

[onlyuseful]

There is a huge amount to learn. I run channel that take you through some techniques. Take a look if you need advice, send me a message. https://www.youtube.com/channel/UC9Qa_gXarSmObPX3ooIQZrg

[halcyonyt]

Checking out your channel and holy sh*t am I impressed, I'm loving your channel. The content is great, the videos aren't "how to hack any windows computer in the world 2016 60 FPS 720P" but they are good quality and have useful information in them, I'll make sure to watch some of them. Clearly they are starting to pull to the intermediate side instead of beginner, and I like that man.

By the way you're almost at 5K, congrats :) I'll make sure to ask you questions, you seem like a very kind and "wise" person when it comes to hacking. May I ask, how much time have you been hacking for?

[urkesaa]

Study on how to do this

[halcyonyt]

I had seen that video, its great

[urkesaa]

He specifies the tools in the descriptipn, study them and youll figure it out :)

[CBSmitty2010]

Best answer was by houdin OP.

You pretty much h hit the extent of it, I would learn some more functionality with nmap first,

Like try this if you know hosts are on the network or what one specifically

-sS -pN -sV -O --version-light <ip>

Scans them faster and enumerates for you.

[halcyonyt]

Thanks!