(Mutillidae: Lesson 17)

{ Using nikto.pl }

• What is Mutillidae?
  • OWASP Mutillidae II is a free, open source, deliberately vulnerable web-application providing a target for web-security enthusiast.
  
  
• What is Nikto?
  • Nikto is an Open Source (GPL) web server scanner which performs comprehensive tests against web servers for multiple items, including over 6400 potentially dangerous files/CGIs, checks for outdated versions of over 1200 servers, and version specific problems on over 270 servers
   
• Pre-Requisite Lab
  1. Mutillidae: Lesson 1: How to Install Mutillidae in Fedora 14
     • Note: Remote database access has been turned on to provide an additional vulnerability.
  2. BackTrack: Lesson 1: Installing BackTrack 5 R1
     • Note: This is not absolutely necessary, but if you are a computer security student or professional, you should have a BackTrack VM.
  
  
• Lab Notes
  • In this lab we will do the following:
    1. We will use nikto.pl to scan the Mutillidae website for vulnerabilities.
    2. We will conduct some server reconnaissance using the HTTP Methods HEAD.
    3. We will exploit the PHP-Nuke Rocket Vulnerability.
    4. We will investigate the OSVBD-3233: /phpinfo.php warning.
    5. We will investigate the OSVDB-3268: Directory Indexing warning.

• Legal Disclaimer
  • As a condition of your use of this Web site, you warrant to computersecuritystudent.com that you will not use this Web site for any purpose that is unlawful or that is prohibited by these terms, conditions, and notices.
  • In accordance with UCC § 2-316, this product is provided with "no warranties, either express or implied." The information contained is provided "as-is", with "no guarantee of merchantability."
  • In addition, this is a teaching website that does not condone malicious behavior of any kind.
  • You are on notice, that continuing and/or using this lab outside your "own" test environment is considered malicious and is against the law.
  • © 2013 No content replication of any kind is allowed without express written permission.

   

1. Start VMware Player
   • Instructions
     1. For Windows 7
        1. Click Start Button
        2. Search for "vmware player"
        3. Click VMware Player
     2. For Windows XP
        • Starts --> Programs --> VMware Player
   • 

    

2. Edit Fedora Mutillidae Virtual Machine Settings
   • Instructions:
     1. Highlight fedora14
     2. Click Edit virtual machine settings
   • 

    

3. Edit Network Adapter
• Instructions:
  1. Highlight Network Adapter
  2. Select Bridged
  3. Click the OK Button
• 

1. Start Fedora14 VM Instance
   • Instructions:
     1. Start Up VMWare Player
     2. Select Fedora14 - Mutillidae
     3. Play virtual machine
   • 

    

2. Login to Fedora14 - Mutillidae
   • Instructions:
     1. Login: student
     2. Password: <whatever you set it to>.
   • 

1. Start a Terminal Console
   • Instructions:
     1. Applications --> Terminal
   • 

    

2. Switch user to root
   • Instructions:
     1. su - root
     2. <Whatever you set the root password to>
   • 

    

3. Get IP Address
   • Instructions:
     1. ifconfig -a
   • Notes (FYI):
     • As indicated below, my IP address is 192.168.1.111.
     • Please record your IP address.
   • 

1. Start VMware Player
   • Instructions
     1. For Windows 7
        1. Click Start Button
        2. Search for "vmware player"
        3. Click VMware Player
     2. For Windows XP
        • Starts --> Programs --> VMware Player
   • 

    

2. Edit the BackTrack5R1 VM
   • Instructions:
     1. Select BackTrack5R1 VM
     2. Click Edit virtual machine settings
   • 

    

3. Edit Virtual Machine Settings
   • Instructions:
     1. Click on Network Adapter
     2. Click on the Bridged Radio button
     3. Click on the OK Button
   • 

1. Play the BackTrack5R1 VM
   • Instructions:
     1. Click on the BackTrack5R1 VM
     2. Click on Play virtual machine
   • 

    

2. Login to BackTrack
   • Instructions:
     1. Login: root
     2. Password: toor or <whatever you changed it to>.
   • 

    

3. Bring up the GNOME
   • Instructions:
     1. Type startx
   • 

1. On BackTrack, Start up a terminal window
   • Instructions:
     1. Click on the Terminal Window
   • 

    

2. Obtain the IP Address
   • Instructions:
     1. ifconfig -a
   • Note(FYI):
     • My IP address 192.168.1.112.
     • In your case, it will probably be different.
     • This is the machine that will be use to attack the victim machine (Mutillidae).
   • 

    

1. On BackTrack, Open Firefox
   • Instructions:
     1. Click on the Firefox Icon
   • Notes (FYI):
     • If FireFox Icon does not exist in the Menu Bar Tray, then go to Applications --> Internet --> Firefox Web Browser
   • 

    

2. Open Mutillidae
   • Notes (FYI):
     1. Replace 192.168.1.111 in the following URL --> http://192.168.1.111/mutillidae, with your Mutillidae's IP Address obtained from (Section 3, Step 3)
   • Instructions:
     1. Place the following URL in the Address Bar
        • http://192.168.1.111/mutillidae/
   • 

    

1. Navigate to nikto.pl
   • Instructions:
     1. cd /pentest/web/nikto
     2. ls -l
   • 

    

2. Update nikto
   • Instructions:
     1. ./nikto.pl -update
   • 

    

3. Show Options
   • Instructions:
     1. ./nikto.pl -help
   • 

    

4. Scan with nikto
   • Note(FYI):
     • Replace 192.168.1.111 with your mutilldae IP Address obtained from (Section 3, Step 3)
   • Instructions:
     1. ./nikto.pl -host http://192.168.1.111/mutillidae | tee mutillidae.txt
   • 

    

5. View nikto Scan Results
   • Note(FYI):
     1. Right away Nikto identifies the Apache Web Server Version (2.2.17) and the Operating System (Fedora).
     2. In addition, Nikto indicates that the Apache Web Server is running an outdated version.
     3. Immediately, Nikto has uncovered a PHP-Nuke Vulnerability
   • 

1. Allowed HTTP Methods: GET, HEAD, POST, OPTIONS, TRACE
   • Note(FYI):
     1. Replace 192.168.1.111 with your mutilldae IP Address obtained from (Section 3, Step 3)
     2. Netcat is a computer networking service for reading from and writing to network connections using TCP or UDP.
     3. The HEAD method is identical to GET except that the server MUST NOT return a message-body in the response.  This method is often used for testing hypertext links for validity, accessibility, and recent modification.
   • Instructions:
     1. netcat  192.168.1.111 80
     2. HEAD /mutillidae/index.php HTTP/1.1
     3. Host: 192.168.1.111
     4. <Press Enter>
     5. <Press Enter>
   • 

1. Test PHP-Nuke Rocket Vulnerability
   • Note(FYI):
     1. Replace 192.168.1.111 with your mutilldae IP Address obtained from (Section 3, Step 3)
     2. This attack is call a local file inclusion attack that can execute code -OR- in this case to view a sensitive file (e.g., /etc/passwd).
   • Instructions:
     1. Place the following URL in the address box
        • http://192.168.1.111/mutillidae/index.php?page=../../../../../../../../../../etc/passwd
   • 

1. OSVDB-3233: /phpinfo.php: Contains PHP configuration information
   • Note(FYI):
     1. Replace 192.168.1.111 with your mutilldae IP Address obtained from (Section 3, Step 3)
     2. While there is no known vulnerability or exploit associated with this, default files often reveal sensitive information or contain unknown or undisclosed vulnerabilities. The presence of such files may also reveal information about the web server version or operating system (e.g., fedora 14).
     3. Read More
   • Instructions:
     1. Place the following URL in the address box
        • http://192.168.1.111/mutillidae/phpinfo.php
   • 

1. OSVDB-3092: /includes/
   • Note(FYI):
     1. Replace 192.168.1.111 with your mutilldae IP Address obtained from (Section 3, Step 3)
     2. A potentially interesting configuration directory was found on the web server. While there is no known vulnerability or exploit associated with this, it may contain sensitive information (i.e., authentication) which can be disclosed to unauthenticated remote users, or aid in more focused attacks.
     3. Read More
   • Instructions:
     1. Place the following URL in the address box
        • http://192.168.1.111/mutillidae/includes/
     2. Click the config.inc
   • 

    

2. OSVDB-3092 Results
   • Note(FYI):
     1. In the old days (i.e., Last 10 Years), Web Administrators would commonly make a mistake of placing sensitive authentication/connection information in include files, which were publically accessible.
     2. Image an automated Internet Bot that does nothing but search the web for include files!!!
   • 

1. OSVDB-3268: Directory Indexing
   • Note(FYI):
     1. Replace 192.168.1.111 with your mutilldae IP Address obtained from (Section 3, Step 3)
     2. Directory indexing has been found to be enabled on the web server.  While there is might not be vulnerability or exploit associated with this, it may reveal sensitive or "hidden" files or directories to remote users, or aid in more focused attacks.  (e.g., a test file full of password information).
     3. Read More
   • Instructions:
     1. Place the following URL in the address box
        • http://192.168.1.111/mutillidae/passwords/
     2. Click the accounts.txt
   • 

    

2. OSVDB-3268: Directory Indexing Results
   • Note(FYI):
     1. So, we know the author intentionally included this. 
     2. But, this is a typical accident that might occur for many innocent reasons.  (e.g., development).
     3. How about people's credit card (SOX) or Health Information (HIPAA) being exposed by accident.
   • 

    

1. On BackTrack, Start up a terminal window
   • Instructions:
     1. Click on the Terminal Window
   • 
    
2. Proof of Lab, (On a BackTrack Terminal)
   • Instructions:
     1. cd /pentest/web/nikto
     2. ls -l mutillidae.txt
     3. grep -i nuke mutillidae.txt
     4. date
     5. echo "Your Name"
        • Replace the string "Your Name" with your actual name.
        • e.g., echo "John Gray"
   • Proof of Lab Instructions
     1. Press both the <Ctrl> and <Alt> keys at the same time.
     2. Do a <PrtScn>
     3. Paste into a word document
     4. Upload to Moodle
   •