‫So the scan is completed in 17 minutes.
‫Now, another pause here, because I disable the windows plug ins, it seems as if the Windows systems
‫don't have critical vulnerabilities.
‫It's not right, especially my Windows XP has several critical vulnerabilities.
‫If you didn't disable windows plug ins, you're supposed to see some more vulnerabilities for Windows
‫systems.
‫Now to see the results of the voidable scan in detail, let's click the Métis Voidable results to 06.
‫The Nessa's home found 10 critical vulnerabilities with their scan configuration, but please note that
‫the configuration affects the results so the target systems may have more vulnerabilities than reported.
‫If there is a vulnerability and it's not found in a scan, we call it a false negative.
‫I'm sure you know that the critical vulnerabilities are the most dangerous ones, but that's where it
‫gets good.
‫They are the most exploitable ones in general.
‫So let's click on one of these critical vulnerabilities, for example, being shown back door detection.
‫Well, look at the description, it says a shell is listening on the port without any authentication
‫being required.
‫This is obviously a back door.
‫Your support number of 15 24.
‫Now let's check of the finding is a true positive go to terminal screen.
‫I used Ngarkat tool to connect simply type ency and the target IP and the target bought 15 24 and we're
‫in.
‫We have the shell for Métis voidable.
‫Type, who am I to learn the credential we have, we are the user now, it was too simple, it's just
‫not fun.
‫And, you know, I don't like it.
‫I like a good challenge.
‫Right.
‫I mean, we are the route user and we can access anything we want.
‫For example, shadow file, which contains the hashes of the user's passwords.
‫OK, back to the browser and click on the back to vulnerability's link to turn back to the vulnerabilities
‫of Métis voidable.
‫Now, I'd like to show you some more.
‫Scroll on down the vulnerability, it shows 50 vulnerabilities per page by default, but let's make
‫it 200 to see all the findings in a single page.
‫Now, the findings are ordered by SAVARY levels, so information is at the bottom.
‫Findings with the severity level of information identify non vulnerability information, which is,
‫you know, nice to know, and it keeps it separate from the vulnerability detail.
‫So here there's an info RMI registry detection, let's click it.
‫It says that the remote host is running an RMI registry, retrieving remote objects in the Java runtime
‫method invocation system.
‫So let's look for the exploits of the Métis Floyd framework if there is any exploit for Java RMI.
‫Opening terminal screen and run MSF console.
‫So here we have MSF console, let's search the exploits of RMI.
‫Too many results.
‫To keep it more specific, I want to search Java RMI.
‫So we have to auxiliaries and to exploits at this time, so look at the exploit in the last line, this
‫module takes advantage of the default configuration of the RMI registry and RMI activation services,
‫which allow loading classes from any remote.
‫You, Earl.
‫Let's try to use it on our RMI poor.
‫Please don't worry, I am going to explain what these all mean.
‫I just want to show you an example at the beginning.
‫So bear with me.
‫I use the module name with the full path.
‫You can simply select the module name and click the middle button of the mouse to copy and paste it.
‫Type show payloads to see the payloads can be used with this module.
‫So I want to use this payload to have an interpreter session.
‫Again, don't worry, I'll explain what the interpreter is soon, but just copy and paste the payload
‫name type show options to see the parameters of the exploit and the payload as well.
‫Set the remote host as Métis voidable two zero six default remote port is the same with our port one
‫zero nine nine.
‫Servoz is the local host to listen on, set this to be our colleague to to to.
‫By default, support remain.
‫So the other options are not required.
‫I'll just leave it blank.
‫Now, are the payload options set the listen host to be our colleague to to to default?
‫Listen, port is good for four, four and finally type exploit to run the exploit.
‫So there it looks like we have a better picture session.
‫Type sessions dash l to list the active sessions, be patient, we'll see them in detail type session
‫dashi session ID to interact with a session and here we are, we're in now.
‫I'm going to show you what we can do with an interpreter session in the following chapter.
‫But here's a couple of Mettenberger commands disinfo info to see the system information.
‫Hash dump the gather password hashes.
‫Now, no such command for this system, thankfully, we have an alternative for this type run post Linux
‫gathers hash, dump and hit, enter and collect the fruits of your labor.
‫So as you see here, we found another way to exploit the system, even though the finding was just information.
‫So I hope you understand not to underestimate any finding.