Learning Windows Server Exploitation – Metasploitable 3 Walkthrough

Metasploitable 3 Overview

The tutorial demonstrates steps for penetration testing and exploitation of system vulnerabilities. It involves:

1. Setup and Configuration:
   • Preparation of tools like Metasploit.
   • Interaction with a Jenkins server.
2. Exploitation Workflow:
   • Scanning systems for vulnerabilities.
   • Creating and executing payloads.
   • Privilege escalation and lateral movement.

Methodology

1. System Setup and Scanning

• Network Scanning:
  • Multiple open ports detected (e.g., 21, 22, 80, 135).
  • IP address and Jenkins server identified.
• Jenkins Access:
  • Automatically logged into a Jenkins server due to default credentials left unsecured by administrators.
  • Exploration of Jenkins Script Console to execute scripts remotely on the backend system.

OSCP Study Notes

OSCP Study Notes

2. Exploitation Steps

• Using Jenkins Script Console:
  • Demonstrates how scripts can be executed on the backend (Windows server) through the Jenkins Script Console.
• Payload Creation:
  • Generates a Metasploit payload using msfvenom:
    • Payload type: Windows reverse TCP.
    • Host and port configurations set.
  • Sets up a Python HTTP server to host and deliver the payload.
• Payload Delivery:
  • Uses a PowerShell command to download the payload onto the target system via Jenkins.
• Payload Execution:
  • The payload is executed on the Windows target system, establishing a reverse shell.

3. Post-Exploitation Activities

• Privilege Escalation:
  • Identifies active services (e.g., Tomcat server).
  • Extracts plaintext credentials from Tomcat’s configuration files.
• Uploading Exploitable Payloads:
  • Uploads a .war file to the Tomcat server, designed to trigger execution on the server.
• Advanced Exploitation:
  • Searches for specific JavaScript or Jar files to trigger uploaded payloads.
  • Gathers system information and prepares for further exploitation.

Learning Points

1. Security Misconfigurations:
   • Exploiting default credentials and unsecured configurations.
   • Importance of securing services like Jenkins and Tomcat.
2. Tools and Techniques:
   • Use of Metasploit for payload generation and listener setup.
   • Leveraging scripting consoles in software platforms for exploitation.
3. Privilege Escalation:
   • Extracting credentials and exploiting misconfigured services.
   • Demonstrates a clear path from initial access to system-level privileges.
4. Skill Development:
   • Combining multiple tools and techniques for penetration testing.
   • Importance of understanding underlying system configurations for successful exploitation.

Metasploitable 3 | Video Walkthrough | P1

Part 2

In part 2 of Metasploitable 3 walkthrough , we demonstrated another way of exploiting the Windows server on Metasploitable 2 with Metasploit. We used Metasploit modules to exploit ManageDesktop web application and Plain text credentials from Tomcat for privilege escalation.

Skills Learned

• Metasploitable 2
• Metasploit

Metasploitable 3 | Video Walkthrough | P2