Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Metasploitable-3

Source: https://stuffwithaurum.com

The Metasploitable virtual machine is an intentionally vulnerable image designed for testing security tools and demonstrating common vulnerabilities. Version 3 of this virtual machine is available in both Ubuntu and Windows forms. They can be set up using Vagrant and are available on GitHub and ship with even more vulnerabilities than Metasploitable 1 and 2. The virtual machines are compatible with VMWare, VirtualBox, and other common virtualization platforms. By default, Metasploitable’s network interfaces are bound to the “private network” configuration in Vagrant (VirtualBox users may need to change this to NAT Network), and the images should never be exposed to a hostile network.

nmap Scan

A preliminary nmap scan reveals a few services.

kali@kali:~$ sudo nmap -sV -O 10.0.2.15 -p0-65535
[sudo] password for kali:
Starting Nmap 7.80 ( https://nmap.org ) at 2020-04-11 20:33 EDT
Nmap scan report for 10.0.2.15
Host is up (0.00020s latency).
Not shown: 65526 filtered ports
PORT STATE SERVICE VERSION
21/tcp open ftp ProFTPD 1.3.5
22/tcp open ssh OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.10 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd 2.4.7
445/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
631/tcp open ipp CUPS 1.7
3000/tcp closed ppp
3306/tcp open mysql MySQL (unauthorized)
3500/tcp open http WEBrick httpd 1.3.1 (Ruby 2.3.7 (2018-03-28))
6697/tcp open irc UnrealIRCd
8181/tcp open http WEBrick httpd 1.3.1 (Ruby 2.3.7 (2018-03-28))
MAC Address: 08:00:27:48:64:BF (Oracle VirtualBox virtual NIC)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop
Service Info: Hosts: 127.0.1.1, UBUNTU, irc.TestIRC.net; OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 119.78 seconds

ProFTPD

The ProFTPD service running on the system has a remote code execution vulnerability which can be exploited using the ProFTPD 1.3.5 Mod_Copy Command Execution module.

Apache HTTP Server

The Apache web application running on the system has a remote code execution vulnerability which can be exploited using the Apache mod_cgi Bash Environment Variable Code Injection (Shellshock) module.

The Apache web servers also runs WebDAV allowing unauthenticated file uploads to the /uploads/ directory on the web server. This could be used to get a shell by uploading a malicious PHP file.

First step would be to generate a web shell.

Next, upload it through Apache WebDAV.

And trigger it by requesting the file through the webserver. Make sure to have a handler running to catch the shell!

Drupal

The Drupal web application running on the system has a remote code execution vulnerability which can be exploited using the Drupal HTTP Parameter Key/Value SQL Injection (Drupageddon) module.

phpMyAdmin

The phpMyAdmin web application running on the system has a remote code execution vulnerability which can be exploited using the phpMyAdmin Authenticated Remote Code Execution via preg_replace() module.

Ruby on Rails

The Ruby on Rails web application running on the system at port 3500 has a remote code execution vulnerability which can be exploited using the Ruby on Rails ActionPack Inline ERB Code Execution module.

The Ruby on Rails web application running on the system at port 8181 has a remote code execution vulnerability which can be exploited using the Ruby on Rails Known Secret Session Cookie Remote Code Execution module.

This exploit does require knowledge of the secret used to sign the session cookie. However, the web server conveniently sends us the secret in the Set-Cookie header.

The cookie can be decoded to fetch the signing secret by URL decoding it and then base64 decoding it after separating the signature part (the stuff after the –).

Now that we have the secret a7aebc287bba0ee4e64f947415a94e5f, we can use it to get our shell!

CUPS

The CUPS application running on the system has a remote code execution vulnerability which can be exploited using the CUPS Filter Bash Environment Variable Code Injection (Shellshock) module.

Note that there is currently a configuration issue due to which this exploit does not work on a default configuration. You will need to add the vagrant user to the lpadmin group to get this to work by running the below command as root on the Metasploitable box first.

Unreal IRCd

The Unreal IRCd application running on the system has a remote code execution vulnerability which can be exploited using the UnrealIRCD 3.2.8.1 Backdoor Command Execution module.

Apache Continuum

The Apache Continuum application running on the system has a remote code execution vulnerability which can be exploited using the Apache Continuum Arbitrary Command Execution module.

Note that this vulnerability is currently not exploitable due a configuration issue in the iptables rules. This can be resolved by updating the iptables rules as shown below.

Docker Daemon Local Privilege Escalation

The Docker daemon running on the system exposes an unprotected TCP sockets that allows a local privilege escalation vulnerability which can be exploited using the Docker Daemon – Unprotected TCP Socket Exploit module.

This exploit requires a session running as a user in the docker group. The Metasploitable 3 configuration adds the users boba_fett, jabba_hutt, greedo and chewbacca to the docker group.

The exploit for Unreal IRCd mentioned above would be a good candidate for obtaining the session as Unreal IRCd is running as the boba_fett user. This exploit would require that the Unreal IRCd exploit was used with the cmd/unix/reverse_perl payload.

Samba

The Samba application hosts a share accessible by the chewbaccauser. The share just happens to be mapped to the /var/www/html/ location on the Metasploitable 3 machine, allowing you to upload a web shell to gain access to the system.

First step would be to generate a web shell.

Next, upload it through the samba share.

And trigger it by requesting the file through the webserver. Make sure to have a handler running to catch the shell!

PreviousMetasploitable-2NextLinux Privilege Escalation

Last updated