Chuyển đến nội dung chính

CEH v9 Compo Lab 1 : Hack Metasploiable 2 & TheROCK v1

Chào các bạn
Trước khi chuyển sang Metasploiable 3 chúng ta cần dút điểm một số lab pentest system của Metasploiable 2 &THEROCK bao gồm những bài sau đây :
- Lưu ý : Để PoC (nghĩa là chứng minh đã hoàn tất) thì các bạn nên quay video lại tiến trình làn bài hay ít nhất cũng chụp 1 cái hình minh họa kết quả cuối cùng. Về quy cách quay video thì các bạn nên có 1 file text giới thiệu vắn tắt Mô Hình Lab, & Các bước thực hiện bài Lab để người xem có thể hiểu được nội dung cần truyền tải. Phần mềm ghi video có thể dùng như Bandicam, Camtasia ...
Các bài hướng dẫn trình bày kha chi tiết, nên các bạn có thể bỏ bớt các tình huống đăng nhập hoặc trong bài tác giả dùng Backtrack nên nếu mình dùng Kali hay Parrot ... cần phải linh động, vì các ứng dụng trên linux nó hoạt động khá tương tự nhau.
Danh mục các bài tập cần hoàn thành và gởi cho Admin Tran Ngoc Bang
1 - Bài Thực Hành Metasploit Framework Lesson 2 : Exploiting the distcc daemon to obtain root http://www.antoanthongtin.edu.vn/2013/11/bai-thuc-hanh-metasploit-framework_62.html
2.1 - Hướng Dẫn Thực Hành : Social Engineering Toolkit (SET): Lesson 1 http://www.antoanthongtin.edu.vn/2013/11/huong-dan-thuc-hanh-social-engineering_17.html
2.2 - Hướng Dẫn Thực Hành - (Social Engineering Toolkit (SET): Lesson 2 http://www.antoanthongtin.edu.vn/2013/11/huong-dan-thuc-hanh-social-engineering_18.html
2.3 - Hướng Dẫn Thực Hành - Social Engineering Toolkit (SET) : Lesson 3 http://www.antoanthongtin.edu.vn/2013/11/huong-dan-thuc-hanh-social-engineering.html
3 - Bài Thực Hành Metasploit Framework Lesson 3 : Exploiting Samba, CVE-2007-2447: Remote Command Injection http://www.antoanthongtin.edu.vn/2013/11/bai-thuc-hanh-metasploit-framework_2.html
4 - Bài Thực Hành Metasploit Framework Lesson 4 : Exploiting a Mis-Configured NFS Share http://www.antoanthongtin.edu.vn/2013/11/bai-thuc-hanh-metasploit-framework_83.html
5- Bài Thực Hành Metasploit Framework Lesson 5 : Exploiting the RMI Registration Server http://www.antoanthongtin.edu.vn/2013/11/bai-thuc-hanh-metasploit-framework_48.html
6 - Bài Thực Hành Metasploit Framework Lesson 6 : Scan Metasploitable wish Nessus http://www.antoanthongtin.edu.vn/2013/11/bai-thuc-hanh-metasploit-framework_21.html
7 - Bài Thực Hành Metasploit Framework Lesson 7 : Exploiting UnrealIRCD 3.2.8.1 http://www.antoanthongtin.edu.vn/2013/11/bai-thuc-hanh-metasploit-framework_76.html
8 - Bài Thực Hành Metasploit Framework Lesson 8 : Exploiting VSFTPD 2.3.4 http://www.antoanthongtin.edu.vn/2013/11/bai-thuc-hanh-metasploit-framework_84.html
9 - Bài Thực Hành Metasploit Framework Lesson 9 : Exploiting the Grub Menu to Gain the Root Password http://www.antoanthongtin.edu.vn/2013/11/bai-thuc-hanh-metasploit-framework_19.html
10 - Bài Thực Hành Metasploit Framework Lesson 10 : Exploiting Samba, Obtain Hashes, John the Ripper http://www.antoanthongtin.edu.vn/2013/11/bai-thuc-hanh-metasploit-framework.html

Hack THEROCK
1 - Hack Web Server THEROCK v1 { Using the MsfGUI to Grab A Shell and Transfer a File } http://www.antoanthongtin.edu.vn/2017/03/hack-web-server-therock-v1-using-msfgui.html
2 - Hack Web Server THEROCK v1 { Establishing A VNCShell To The Vulnerable Machine } http://www.antoanthongtin.edu.vn/2017/03/metasploit-ms08-067-establishing.html
3 - Hack Web Server THEROCK v1 (Kali : MS08-067) { Using the MsfCli to Grab A DOS Command Prompt } http://www.antoanthongtin.edu.vn/2017/03/hack-web-server-therock-v1-kali-ms08_13.html
4 - Hack Web Server THEROCK v1 (Kali : MS08-067) { Establishing A Shell To The Vulnerable Machine } http://www.antoanthongtin.edu.vn/2017/03/hack-web-server-therock-v1-kali-ms08.html
Nhãn:

Bài đăng phổ biến từ blog này

Pentest lab - Metasploitable 2

Today I will walk through different ways of exploiting Metasploitable 2, the newer release of Rapid7’s popular vulnerable machine. First, what is Metasploitable? Metasploitable is an intentionally vulnerable Linux virtual machine. This VM can be used to conduct security training, test security tools, and practice common penetration testing techniques. In my lab environment, the IP of the attacker machine is 192.168.127.159, and the victim machine is 192.168.127.154. Since this is a test lab, I won’t be concerned about stealth. Instead, I will try to get the most information out of the scans. Let’s start by port scanning the target with nmap. I did a full port, aggresive scan against the target. Here are the results. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 ...
Đọc thêm

Metasploitable 2 vulnerability assessment

A vulnerability assessment is a crucial part in every penetration test and is the process of identifying and assessing vulnerabilities on a target system. In this part of the tutorial we will be assessing the vulnerabilities available on the network side of the Metasploitable 2 virtual machine. We will be assessing the web applications on the Metasploitable 2 machine in a later tutorial. In the previous Metasploit enumeration and fingerprinting tutorial we’ve learned that the Metasploitable 2 machine contains a lot of vulnerabilities. We have collected valuable information about the target system which we will be using to find known vulnerabilities both on- and offline. Exploitation of these vulnerabilities will be demonstrated in the next exploitation tutorial. In this tutorial we will be looking at a few different ways to perform vulnerability analysis. We will be manually searching for exploits, use scanning tools like Nmap with scripts and we will be...
Đọc thêm

Hack the Gibson VM (CTF Challenge)

It’s a boot2root challenge and it does not get over with getting root access. You have to find flag also. So let’s start. First of all download lab from https://download.vulnhub.com/gibson/gibson.ova Now open kali terminal and like always start with first step i.e. netdiscover netdiscover it shows all the hosts those are up in our network and from here we get our target ip. Target IP: 192.168.1.6 As our target is all set we are going to scan it with nmap which will show all the open ports. In this case open ports are only two i.e. 22 and 80. nmap –p- -A 192.168.1.6 As from the above result we have got 80 port open so we will open target ip in browser. It shows an accessible directory. Let’s try opening it as we cannot see anything important here. Oh no such luck with this also. It’s written the result will be found by brute force but there is no place where we can apply brute force. As we do not have any other option so let’s just go to view page source to see if we could get a...
Đọc thêm