‫Before going deep on exploitation framework's, let's see how we can find and run and exploit manually.
‫Because it's not the subject of the course, I'll not show you how to develop and exploit, but we are
‫going to use the exploit from exploit databases.
‫So in this demo, let's say that we think that the target system has the MSO three underscore 026 vulnerability
‫to exploit, the vulnerability will follow these steps.
‫First, we'll search for the exploit mouse zero three underscore 026.
‫Then compile the code, if there are errors in the code, we have to find and fix the errors or find
‫another exploit.
‫And finally will run the exploit now, if we're lucky enough, we can successfully exploit the target
‫system and have a command show on it.
‫So go to college and open a Web browser type, exploit Debe to search for the exploit database, I click
‫the first link, which is Exploit DeVita Dockum.
‫Now click search at the upper right hand corner.
‫Right, Ms.
‫Zero three underscore 026 in the search bar and prove that you are not a robot and click search.
‫We found three exploits in the database, so let's try the oldest one, which is developed by H.D. Moore,
‫who is the developer of Métis Boyd framework, by the way.
‫So click the link.
‫And here's a source code of the exploit, so let's download the code and save the code to Colly.
‫Now open a terminal screen and go to the folder where the exploit code is downloaded.
‫And here's a source code 66, not see, it's a source code of C programming language, and we can compile
‫it using the compiler, the Ganu Compiler Collection.
‫Gok is a compiler system produced by the new project supporting various programming languages.
‫GCC is a key component of the Guanyu toolchain and the standard compiler for most Unix like operating
‫systems.
‫Originally named the Ganu C compiler, when it only handled the C programming language in the first
‫release, then it was extended to compile C++ Objective C Objective, C++, Fortran, Java, Ayda and
‫go, among others.
‫So anyway, type JTC give the source file name and then output file name with dash o parameter and hit
‫enter.
‫Use the last command to see the file produced here, it is compiled and produced an executable binary
‫file.
‫I've got slash and file name to run the executable.
‫And it shows the help by default.
‫OK, good for us, because here we learn how to use the executable.
‫First parameter is target ID, so we have to learn the target operating system.
‫And we can use and map the network map or tool to interrogate the operating system of the target.
‫Now, I'm not going to tell you more about and map here, because it's a subject of the network scanning
‫cause.
‫Well, let's create the map query.
‫Dash as V for version detection dash oh, for the operating system, detection now is a target IP.
‫And top 10 ports to scan.
‫Here are the results, our end map query, he says that the target operating system is either Windows
‫2000 with a service back zero to four or Windows XP with a service pack zero or one.
‫We can try the ResultSet one by one, but to keep it quick, let's look at the target system.
‫So here's the target system, right, click my computer select properties, the system is Windows XP
‫with service pack one.
‫OK, so back to Cali.
‫Let's remember the usage of or exploit again.
‫Now, first parameter is Target ID and it's a six, second parameter is a target IP, which is one seven
‫two one six nine nine two zero seven for me.
‫And yes, we got the shell from the target system.
‫So let's look at the IP address.
‫It says two zero seven.
‫So I go to the target system to check if it's true.
‫So I'll open a command line type YPP config and yes, the IPE, the target is two zero seven.
‫Turn back to Colleano and type exit to close the shell.
‫Now, look at the target system, as you see the system crashed, all the exploits may have had some
‫side effect, so you better test it before using on the live systems.