(Buffer Overflow: Lesson 2)

{ Create PCMan Metasploit Module, Attack, and Capture Memory }

1. What is the scenario?
   • Suppose a new exploit comes out and nobody has released any vulnerability testing scripts.  The previous lesson (Buffer Overflow: Lesson 1: PCMan's FTP Server 2.0.7 Buffer Overflow Explained) teaches you how to create perl fuzzing and exploit scripts to test if a vulnerability exists along with the corresponding implementation.
   • This lesson is to show you how to create your own Metasploit Module after conducting the proper Buffer Overflow Analysis.  
    
2. What is Damn Vulnerable Windows XP?
   • This is a Windows XP Virtual Machine that provides a practice environment to conduct ethical penetration testing, vulnerability assessment, exploitation and forensics investigation.
   • The Microsoft Software License Terms for the IE VMs are included in the release notes.
   • By downloading and using this software, you agree to these license terms.
   
   
3. What is PCMan FTP Server?
   • PCMan's FTP Server is a free software mainly designed for beginners not familiar with how to set up a basic FTP.  Configuration is made very easy. Consequently, security was not a major concern of this specific application version.  Accordingly, the following exploit (CVE-2013-4730) exists.
    
4. What is the PCMan FTP Server 2.0.7 Buffer Overflow Exploit?
   • The CVE Vulnerability number is CVE-2013-4730.
   • Buffer overflow in PCMan's FTP Server 2.0.7 allows remote attackers to execute arbitrary code via a long string in a USER command.
   
   
5. Special Thanks!!!
   1. I wanted to thank Master Peleus(@0x42424242)for his original PCMan Buffer Overflow Article in which this lesson is based upon.
   2. I wanted to thank my very talented Hac-King-Do student, Master Mitchell(@bobmitch2311) for assisting me in the creation of pcman_user.rb.  Boston College is very lucky to have a Computer Science Student of your caliber.
   3. I wanted to thank my good friend Carlos Cajigas (@carlos_cajigas) for creating LosBuntu and for his generous guidance and mentorship in Cyber Forensics
   
   
6. References
   • https://www.offensive-security.com/metasploit-unleashed/msfconsole/
   • https://www.offensive-security.com/metasploit-unleashed/meterpreter-backdoor
   • https://github.com/rapid7/metasploit-framework/wiki/How-to-get-started-with-writing-an-exploit
   
   
7. Pre-Requisite Lessons
   • Damn Vulnerable Windows XP: Lesson 1: How to create a Damn Vulnerable Windows XP Machine
   • Damn Vulnerable Windows XP: Lesson 8: How to install OllyDbg v1.10 x86 Debugger
   • Damn Vulnerable Windows XP: Lesson 9: How to setup the PCMan's FTP Server 2.0.7 Buffer
   • Buffer Overflow: Lesson 1: PCMan's FTP Server 2.0.7 Buffer Overflow Explained
   
   
8. Lab Notes
   • In this lab we will do the following:
     1. We will use fuzzing, pattern_create.rb, and pattern_offset.rb to determine the offset for PCMan.
     2. We will explain every line of the Windows FTP PCMan Metasploit Module (pc-man_user.rb).
     3. We will use pcman_user.rb to check and exploit the PCMan application.
     4. We will configure a Samba Share on our Forensics Server (LosBuntu).
     5. We will download WinPMEM to the Samba Forensics Share.
     6. We will use WinPMEM to Collect Memory from the PCMan exploit and send the Captured Memory to the Samba Share.
    
9. Legal Disclaimer
   • As a condition of your use of this Web site, you warrant to computersecuritystudent.com that you will not use this Web site for any purpose that is unlawful or that is prohibited by these terms, conditions, and notices.
   • In accordance with UCC § 2-316, this product is provided with "no warranties, either express or implied." The information contained is provided "as-is", with "no guarantee of merchantability."
   • In addition, this is a teaching website that does not condone malicious behavior of any kind.
   • You are on notice, that continuing and/or using this lab outside your "own" test environment is considered malicious and is against the law.
   • © 2016 No content replication of any kind is allowed without express written permission.

1. Open VMware Player on your windows machine.
   • Instructions:
     1. Click the Start Button
     2. Type "vmware player" in the search box
     3. Click on VMware Player
   • 

    

2. Edit Virtual Machine Settings
   • Instructions:
     1. Click on Damn Vulnerable WXP-SP2
     2. Edit Virtual Machine Settings
   • Note:
     • Before beginning a lesson it is necessary to check the following VM settings.
   • 

    

3. Set Network Adapter
   • Instructions:
     1. Click on Network Adapter
     2. Click on the radio button "Bridged: Connected directly to the physical network".
     3. Click the OK Button
   • 

    

4. Start Up Damn Vulnerable WXP-SP2.
   • Instructions:
     1. Start Up your VMware Player
     2. Play virtual machine
   • 

    

5. Logging into Damn Vulnerable WXP-SP2.
   • Instructions:
     1. Click on Administrator
     2. Password: Supply Password
        •  (See Note)
     3. Press <Enter> or Click the Arrow
   • Note(FYI):
     2. Password was created in (Lab 1, Section 1, Step 8)
   • 

    

6. Open the Command Prompt
   • Instructions:
     1. Click the Start Button
     2. All Programs --> Accessories --> Command Prompt
   • 

    

7. Obtain Damn Vulnerable WXP-SP2's IP Address
   • Instructions:
     1. ipconfig
     2. Record Your IP Address
   • Note(FYI):
     • In my case, Damn Vulnerable WXP-SP2's IP Address 192.168.2.106.
     • This is the IP Address of the Victim Machine.
   • 

1. Open VMware Player on your windows machine.
   • Instructions:
     1. Click the Start Button
     2. Type "vmware player" in the search box
     3. Click on VMware Player
   • 

    

2. Edit Virtual Machine Settings
   • Instructions:
     1. Click on Kali
     2. Edit Virtual Machine Settings
   • Note:
     • Before beginning a lesson it is necessary to check the following VM settings.
   • 

    

3. Configure CD/DVD
   • Instructions:
     1. Click on CD/DVD (IDE)
     2. Click on the radio button "Use physical drive:"
     3. Select Auto detect
   • 

    

4. Set Network Adapter
   • Instructions:
     1. Click on Network Adapter
     2. Click on the radio button "Bridged: Connected directly to the physical network".
     3. Click the OK Button
   • 

1. Start Up Kali
   • Instructions:
     1. Click on Kali
     2. Play virtual machine
   • 

    

2. Supply Username
   • Instructions:
     1. Click Other...
     2. Username: root
     3. Click the Log In Button
   • 

    

3. Supply Password
   • Instructions:
     1. Password: <Provide you Kali root password>
     2. Click the Log In Button
   • 

    

4. Open a Terminal Window
   • Instructions:
     1. Click on Applications
     2. Accessories --> Terminal
   • 

    

5. Obtain Kali's IP Address
   • Instructions:
     1. ifconfig
     2. Record your IP Address
   • Note(FYI):
     • Arrow #1, ifconfig is used to display Kali's IP Address.
     • Arrow #2, Record Your IP Address. 
       • Mine is 192.168.2.111. 
       • Yours will probably be different.
   • 

1. Open VMware Player on your windows machine.
   • Instructions:
     1. Click the Start Button
     2. Type "vmware player" in the search box
     3. Click on VMware Player
   • 

    

2. Edit Virtual Machine Settings
   • Instructions:
     1. Select LosBuntu
     2. Click Edit Virtual Machine Settings
   • 

    

3. Configure Memory
   • Instructions:
     1. Click on Memory.
     2. Up the memory to 1 GB
   • Note(FYI):
     • LosBuntu really needs 1.5 to 2 GB; however, you are only configuring MimiKatz with Volatility in this lesson.
     • Do NOT Click the OK Button, we still have more to configure.
   • 

    

4. Configure CD/DVD(IDE)
   • Instructions:
     1. Click on CD/DVD(IDE)
     2. Device status: Check Connect at power on
     3. Connection: Click Use physical drive
     4. Select Auto detect
   • Note(FYI):
     • Do NOT Click the OK Button, we still have more to configure
   • 

    

5. Configure Network Adapter
   • Instructions:
     1. Click on Network Adapter
     2. Network Connection: Click Bridged (Automatic)
     3. Device status: Check Connect at power on
     4. Click the OK Button
   • 

    

6. Play LosBuntu Virtual Machine
   • Instructions:
     1. Select LosBuntu
     2. Click Play virtual machine
   • 

    

1. Login to LosBuntu
   • Instructions:
     1. Password: mtk
     2. Press <Enter>
   • 

    

2. Open Terminal Windows
   • Instructions:
     1. Click on the Terminal Window
   • 

    

3. Become root
   • Instructions:
     1. sudo su -
     2. password: mtk
     3. pwd
   • Note(FYI):
     • Command #1, Use (sudo su -) to simulate an initial root login where the /etc/profile, .profile and .bashrc are executed.  Not only will the root user's environment be present, but also the root user will be placed in it's own home directory (/root).
     • Command #2, Use (pwd) to display the current working directory of the particular user.
   • 

    

4. Obtain IP Address
   • Instructions:
     1. ifconfig -a
     2. Record Your IP Address
   • Note(FYI):
     • Command #1, Use (ifconfig) to view all (-a) IP Addresses associated with LosBuntu.  You should only have two interfaces: eth0 and lo.
       • eth0 - Is the primary interface.  In my case, the IP Address is 192.168.2.115.
       • lo - Is the local loopback address.  The loopback address is used to establish an IP connection to the same machine or computer being used by the end-user.  The loopback construct gives a computer or device capable of networking the capability to validate or establish the IP stack on the machine.
     • If your host machine has Internet Connectivity, but LosBuntu does not have an IP Address associated with eth0, then issue the following command as root.
       • dhclient -v
   • 

    

1. Section Notes
   • Notes(FYI):
     1. The goal of this section is to configure samba to allow the victim machine to eventually dump its memory to the (/forensics/pcman) Samba Share folder.
     2. In addition, we will download WinPMEM and set the correct ownerships and permission that will allow WinPMEM to execute on the victim machine from the Samba Share.

    

2. Create Forensics Directory (On LosBuntu)
   • Instructions:
     1. mkdir -p /forensics/pcman
     2. chown -R mtk:mtk /forensics
     3. chmod -R 770 /forensics
     4. ls -ld /forensics/pcman
   • Note(FYI):
     • Arrow #1, Use (mkdir) to create the (/forensics/pcman) directory, and use the (-p) to suppress errors if the directory already exists.
     • Arrow #2, Use (chown) to change the user and group ownerships to mtk for user and mtk for group for the (/forensics) directory and all underlying directories and files.
     • Arrow #3, Use (chmod) to set the read/write/execute permissions for both user and group for the (/forensics) directory and all underlying directories and files.
     • Arrow #4, Use (ls) with the flags (-ld) to list the (/forensics/pcman) directory listing.
   • 

    

3. Download WinPMEM
   • Instructions:
     1. cd /forensics/pcman
     2. wget https://github.com/google/rekall/releases/download/v1.3.1/winpmem_1.6.2.exe
     3. chown -R mtk:mtk winpmem_1.6.2.exe
     4. chmod -R 770 winpmem_1.6.2.exe
   • Note(FYI):
     • Arrow #1, Use (cd) to navigate into the directory (/forensics/pcman).
     • Arrow #2, Use (wget) to download the WinPMEM Executable (winpmem_1.6.2.exe).
     • Arrow #3, Use (chown) to change the user and group ownerships to mtk for user and mtk for group for the the WinPMEM Executable (winpmem_1.6.2.exe).
     • Arrow #4, Use (chmod) to set the read/write/execute permissions for both user and group for the WinPMEM Executable (winpmem_1.6.2.exe).
   • 

    

4. Open Samba Configuration File
   • Instructions:
     1. cd /etc/samba
     2. cp smb.conf smb.conf.BKP
     3. gedit smb.conf > /dev/null &
   • Note(FYI):
     • Arrow #1, Use (cd) to enter the (/etc/samba) directory.
     • Arrow #2, Use (cp) to make a backup copy of the samba configuration file (smb.conf).
     • Arrow #3, Use (gedit) to open the (smb.conf) file from command line.  Use the redirect operator (>) to send standard error into a black hole (/dev/null).
   • 

    

5. Open Samba Preference
   • Instructions:
     1. Click Edit
     2. Select Preferences
   • 

    

6. Display Line Number
   • Instructions:
     1. Check Display lines numbers
     2. Click the Close Button
   • 

    

7. Add Forensics Directory
   • Instructions:
     1. Scroll Down to line 262
     2. Append forensics/pcman to the end of the slash /
   • Note(FYI):
     • Arrow #2, Line 262 should look like the below.
       •  path = /forensics/pcman
   • 

    

8. Save File
   • Instructions:
     1. File --> Save
   • 

    

9. Quit gedit
   • Instructions:
     1. File --> Quit
   • 

    

10. Restart the Samba Service
    • Instructions:
      1. service smbd restart
    • Note(FYI):
      • Arrow #1, Use (service) to restart the samba (ie. smbd) service.
    • 

1. Section Notes
   • Notes(FYI):
     1. The goal of this section is to show a student how to conduct research using the Common Vulnerabilities and Exposures Website.
        • https://cve.mitre.org/

    

2. Open Firefox (On Damn Vulnerable WXP-SP2)
   • Instructions:
     1. Click the Start Button
     2. All Programs --> Mozilla Firefox
   • 

    

3. PCMan 2.0.7 Buffer Overdue Description
   • Instructions:
     1. Navigate to the following URL
        • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4730
   • Note(FYI):
     2. Arrow #2, The first clue of the description tells you the the remote attacker can execute arbitrary code via a long string. 
        • Accordingly, your question should be how long do I make the string?
     3. Arrow #3, The second clue of the description tells you that the remote attacker is attacking the USER command.
        • Subsequently, your next question should be how do we attack the USER command with a long string.
   • 

1. Section Notes
   • Notes(FYI):
     1. The goal of this section is to download the pcman_user.rb module and place it in the correct metasploit framework 4.7.0 directory structure.

    

2. Enter Windows Exploit FTP Directory (On Kali 1.0.5)
   • Instructions:
     1. cd /usr/share/metasploit-framework/modules/exploits/windows/ftp
     2. ls
   • Note(FYI):
     • Arrow #1, Use (cd) to navigate into the correct metasploit ftp directory (/usr/share/metasploit-framework/modules/exploits/windows/ftp).
     • Arrow #2, Use (ls) to display the contents of the current directory.  This particular directory contains all the Windows FTP Exploit Metasploit Modules.
   • 

    

3. Download pcman_user.rb
   • Instructions:
     1. wget http://www.computersecuritystudent.com/SECURITY_TOOLS/BUFFER_OVERFLOW/WINDOWS_APPS/lesson2/pcman_user.rb.TXT
     2. mv pcman_user.rb.TXT pcman_user.rb
     3. chmod 644 pcman_user.rb
     4. ls -l pcman_user.rb
   • Note(FYI):
     • Arrow #1, Use (wget) to download pcman_user.rb.TXT
     • Arrow #2, Use (mv) to rename FROM pcman_user.rb.TXT TO pcman_user.rb
     • Arrow #3, Use (chmod) to set the privileges of file (pcman_user.rb) to 644, where the user has read(4) and write(2); the group has read(4); and the world has read(4).
     • Arrow #4, Use (ls -l) to list the file details of file (pcman_user.rb).
   • 

1. Section Notes
   • Notes(FYI):
     1. The goal of this section is to demonstrate how to start and stop the PCMan FTP Server as it is was originally designed.

    

2. Start PCMan FTP Server (On Damn Vulnerable WXP-SP2)
   • Instructions:
     1. Right Click on PCMANFTPD2
     2. Click on Open
   • 

    

3. PCMan is Online
   • Note(FYI):
     1. Arrow #1, Notice the FTP Server is online
   • 

    

4. Exit PCMan
   • Instructions:
     1. --> (See Picture)
     2. Click the Yes Button
   • 

1. Section Notes
   • Notes(FYI):
     1. The goal of this section is to conduct a basic footprinting interrogation using nmap and telnet.

    

2. Start PCMan FTP Server (On Damn Vulnerable WXP-SP2)
   • Instructions:
     1. Right Click on PCMANFTPD2
     2. Click on Open
   • 

    

3. PCMan is Online
   • Note(FYI):
     1. Notice the FTP Server is online.
        • I apologize for the repetitive starting and stopping of the FTP Server.
        • But, Practice Makes Better
   • 

    

4. Basic NMAP Scan (On Kali 1.0.5)
   • Note(FYI):
     • Replace (192.168.2.106) with your Damn Vulnerable WXP-SP2 Address found in (Section 1, Step 7).
   • Instructions:
     1. nmap 192.168.2.106
     2. Notice that you can see that FTP is running on Port 21
   • Note(FYI):
     • Arrow #1, Use (nmap) to run a very basic footprint scan on the Damn Vulnerable WXP-SP2 machine.
     • Arrow #2, It is great that we can see that FTP is running, but you should be asking who is the vendor and what is the version.
   • 

    

5. View Basic NMAP Scan Connection (On Damn Vulnerable WXP-SP2)
   • Note(FYI):
     1. In my case, a User made a connection from 192.168.2.111, which is the IP Address of my Kali Machine. 
     2. Notice the connects and disconnects within the same second.  Accordingly, this is a pretty good sign that somebody is scanning you.
   • 

    

6. NMAP Version Banner Scan (On Kali 1.0.5)
   • Note(FYI):
     • Replace (192.168.2.106) with your Damn Vulnerable WXP-SP2 Address found in (Section 1, Step 7).
   • Instructions:
     1. nmap -sV --script=banner -p 21 192.168.2.106
     2. The banner displays PCMan's FTP Server 2.0
   • Note(FYI):
     • Arrow #1, use (nmap) to determine the version (-sV) of the service running on a specific port(-p 21) and display the banner (--script=banner) if possible.
     • Arrow #2, Notice how easy NMAP makes it to grab a banner, and through clever covert flag automation, an attacker can easily crawl the internet for vulnerable applications (ie., PCMan 2.0.7).
   • 

    

7. View Banner NMAP Scan Connection (On Damn Vulnerable WXP-SP2)
   • Note(FYI):
     1. Arrow #1, Now the we used NMAP to invoke both version detection (-sV) and banner detection (--script=banner); we see a lot of connects and disconnects.
     2. Arrow #2, Also, notice that NMAP is trying to use the FTP HELP menu to potentially collect some artifacts.
   • 

    

8. Use Telnet (On Kali 1.0.5)
   • Note(FYI):
     • Replace (192.168.2.106) with your Damn Vulnerable WXP-SP2 Address found in (Section 1, Step 7).
   • Instructions:
     1. telnet 192.168.2.106 21
     2. Notice the Banner that is displayed on the screen
     3. Press both the <Ctrl> and Right Bracket(]) keys at the same time.
     4. quit
   • Note(FYI):
     • Arrow #1, Use (telnet) to the IP (192.168.2.106)over port (21) to establish a TCP connection.
     • Arrow #2, Notice that you are also supplied the same banner that NMAP supplies.  Accordingly, this really old fashion technique is almost normal traffic, the attacker is probably not as likely to set off as many alarms.  You should turn off all banners on any service that you are running if the application provides that flexible option.
   • 

    

9. Exit PCMan
   • Instructions:
     1. --> (See Picture)
     2. Click the Yes Button
   •