Skip to main content

3 posts tagged with "Metasploit"

Metasploit is an open-source penetration testing framework that helps security professionals identify vulnerabilities in computer systems, networks, and applications. It provides a comprehensive set of tools to scan, exploit, and manage exploits on target systems, allowing users to simulate real-world attacks and assess the effectiveness of their security controls. Metasploit's modular design enables users to customize and extend its capabilities with custom modules and plugins.

View All Tags

HTB | Blue | Write-Up

· 14 min read

Summary:​

We spawn a target machine, then perform reconnaissance to gather initial information about its services and vulnerabilities. We identify an SMB vulnerability, which we investigate further by searching for applicable exploits (specifically CVE-2017-0144).

Using this knowledge, we configure an exploit with Metasploit to take advantage of the discovered vulnerability. Next, we verify the vulnerability's presence using Metasploit's capabilities. With the exploit confirmed, we run it against the target machine, leveraging its SMB vulnerability to gain access. We then proceed to grab both the user flag and root flag, ultimately achieving System Own status once these tasks are accomplished.

Machine Name: Blue | Difficulty: Easy | OS: Windows

HTB | Netmon | Write-Up

· 16 min read

Summary:​

We navigate the Hack The Box website starting by spawning a target machine. Next, we perform reconnaissance on the target to gather initial information and identify an FTP server running on it. We use anonymous authentication to access the FTP share, then enumerate the files available on this share.

Continuing our investigation, we access the NETMON configuration files and extract user credentials from them. Modifying these credentials to suit our needs, we proceed to access the PRTG Network Monitor web interface. Utilizing Metasploit's capabilities, we exploit CVE-2018-9276 to gain shell access with the "LocalSystem" account, thereby achieving system level access. With this access in hand, we grab both the user flag and root flag, ultimately declaring System Own status once these tasks are accomplished.

Machine Name: Netmon | Difficulty: Easy | OS: Windows