Discovery Thru Pivot with the Metasploit Pentest Plugin
Thursday, July 19, 2012 at 8:22AM Recently I have been working more and more on my pentest plugin for Metasploit doing bug fixes and trying to improve some of the current areas of it. I added the Auto Exploit plugin to it for exploit automation and added some commands to aid in doing enumeration and discovery thru a pivot.
I was talking with the guys in Defensive Intuition and Black Hills Defensive Security and one of the areas they wanted to see me cover in the plugin was being able to quickly move enumerating and scanning other targets when they got a Meterpreter session on a clients network. So I added 2 commands to help with this to the plugin.
Lets start with a session that is connected to a host that is behind NAT:
msf > sessions Active sessions =============== Id Type Information Connection -- ---- ----------- ---------- 1 meterpreter x86/win32 VICTIMLAB\Administrator @ WIN2K3LAB01 192.168.1.100:4444 -> 192.168.1.138:49323 (10.10.10.2) msf >
lets start by loading the plugin
msf > load pentest
___ _ _ ___ _ _
| _ \___ _ _| |_ ___ __| |_ | _ \ |_ _ __ _(_)_ _
| _/ -_) ' \ _/ -_|_-< _| | _/ | || / _` | | ' \
|_| \___|_||_\__\___/__/\__| |_| |_|\_,_\__, |_|_||_|
|___/
Version 1.2
Pentest plugin loaded.
by Carlos Perez (carlos_perez[at]darkoperator.com)
[*] Successfully loaded plugin: pentest
msf exploit(handler) > back
msf >
As shown in my others post about the plugin it will add commands to the list of commands available in the console to look at the command available we can just enter the help command or ? :
msf > help
. . . .
Discovery Commands
==================
Command Description
------- -----------
discover_db Run discovery modules against current hosts in the database.
network_discover Performs a portscan and enumeration of services found for non pivot networks.
pivot_network_discover Performs enumeration of networks available to a specified Meterpreter session.
show_session_networks Enumerate the networks one could pivot thru Meterpreter in the active sessions.
. . . .
The commands we have available are:
* discover_db - this command will go thru the hosts that are present in the database and will run a set of modules to enumerate and gather information from the services that have been detected on those host. One can provide a range of host to limit the discovery and SMB settings for the SMB modules that will be ran against hosts.
* network_discovery - will run the nmap scanner against a given CIDR, it will determine the ports that are used by Metasploit auxiliary and exploit modules and use those if none are specified and after running the scan it will run additional discovery modules to further enumerate and gather information from those services.
* pivot_network_discover - This command will enumerate all interfaces and routes on a given Windows Meterpreter session, it will create routes to the found networks thru the session specified, it will determine which of the enumerated networks are directly connected to the host or are remote so as to determine the best way to run detection of hosts, it will do a ARP Sweep if the network is directly connected since this provides the most accuracy and if the network is a remote one it will execute a ping scan against it, it will execute if specified a TCP and UDP port scan against the hosts it discovered, if a port list is not provided it will auto generate one from the existing auxiliary and exploit modules currently available in addition to adding some additional common ones, if specified it will launch discovery modules to further enumerate the services found.
* show_session_networks - will list the networks available thru Windows Meterpreter Sessions.
Lets start by listing the networks available thru a session. Lets first look at the options available for the show_session_networks command:
msf > show_session_networks -h
This command will show the networks that can be routed thru a Meterpreter session.
OPTIONS:
-h Help Message.
-s Sessions to enumerate networks against. Example or .
Now lets list the networks available:
msf > show_session_networks -s all Network Netmask Session ------- ------- ------- 10.10.10.0 255.255.255.0 1
Now that we know the networks connected to the session we can check the options we have available to the command pivot_network_discover :
msf > pivot_network_discover -h
OPTIONS:
-D SMB Domain for discovery(optional).
-P SMB Password for discovery(optional).
-U SMB Username for discovery(optional).
-d Run Framework discovery modules against found hosts.
-h Help Message.
-p Port list. Provide a comma separated list of port and/or ranges to TCP scan.
-s Session to do discovery of networks and hosts.
-t Perform TCP port scan of hosts discovered.
-u Perform UDP scan of hosts discovered.
-v Be verbose and show pending actions.
Lets see what information we have in our current workspace for hosts, services and notes:
msf > hosts Hosts ===== address mac name os_name os_flavor os_sp purpose info comments ------- --- ---- ------- --------- ----- ------- ---- -------- msf > services Services ======== host port proto name state info ---- ---- ----- ---- ----- ---- msf > notes msf >
Lets run a discovery thru the current session we have:
msf > pivot_network_discover -t -u -d -s 1 [*] Identifying networks to discover [*] Routing new subnet 10.10.10.0/255.255.255.0 through session 1 [*] Running windows/gather/arp_scanner against 1 [*] Running module against WIN2K3LAB01 [*] ARP Scanning 10.10.10.0/24 [*] IP: 10.10.10.2 MAC 00:0c:29:5e:e3:bd [*] IP: 10.10.10.1 MAC 00:0c:29:4d:e7:5a [*] IP: 10.10.10.200 MAC 00:0c:29:45:73:cb [*] IP: 10.10.10.201 MAC 00:0c:29:c9:15:98 [*] IP: 10.10.10.239 MAC 00:0c:29:1e:8d:30 [*] IP: 10.10.10.238 MAC 00:0c:29:10:5c:d7 [*] IP: 10.10.10.243 MAC 00:0c:29:2e:97:ff [*] Generating list of ports used by Auxiliary Modules [*] Generating list of ports used by Exploit Modules [*] Discovering 10.10.10.0/24 Network [+] Running TCP Portscan against 10.10.10.2 [+] Running TCP Portscan against 10.10.10.1 [+] Running TCP Portscan against 10.10.10.200 [+] Running TCP Portscan against 10.10.10.201 [+] Running TCP Portscan against 10.10.10.239 [+] Running TCP Portscan against 10.10.10.238 [+] Running TCP Portscan against 10.10.10.243 [+] Running UDP Portscan against 10.10.10.2 [+] Running UDP Portscan against 10.10.10.1 [+] Running UDP Portscan against 10.10.10.200 [*] 10.10.10.1:80 - TCP OPEN [*] 10.10.10.243:514 - TCP OPEN [*] 10.10.10.2:445 - TCP OPEN [*] 10.10.10.243:111 - TCP OPEN [*] 10.10.10.243:445 - TCP OPEN [*] 10.10.10.239:23 - TCP OPEN [*] 10.10.10.243:23 - TCP OPEN [*] 10.10.10.243:21 - TCP OPEN [*] 10.10.10.2:135 - TCP OPEN [*] 10.10.10.243:1099 - TCP OPEN [*] 10.10.10.243:80 - TCP OPEN [*] 10.10.10.243:22 - TCP OPEN [*] 10.10.10.243:513 - TCP OPEN [*] 10.10.10.2:389 - TCP OPEN [*] 10.10.10.239:135 - TCP OPEN [*] 10.10.10.243:25 - TCP OPEN [*] 10.10.10.201:135 - TCP OPEN [*] 10.10.10.200:445 - TCP OPEN [*] 10.10.10.200:135 - TCP OPEN [*] 10.10.10.243:512 - TCP OPEN [*] 10.10.10.239:445 - TCP OPEN [*] 10.10.10.238:445 - TCP OPEN [*] 10.10.10.238:135 - TCP OPEN [*] Discovered NTP on 10.10.10.2:123 (1c0104fa00000000000a0da14c4f434cd3b1d5bebfd032b2c54f234b71b152f3d3b1e271bbb79f3ed3b1e271bbb79f3e) [*] Discovered DNS on 10.10.10.1:53 (403e858000010001000000000756455253494f4e0442494e440000100003c00c0010000300000000000d0c646e736d6173712d322e3435) [*] Discovered NetBIOS on 10.10.10.200:137 (WINXPLAB01::U :VICTIMLAB::G :WINXPLAB01::U :VICTIMLAB::G :00:0c:29:45:73:cb) . . . . [*] Scanned 1 of 1 hosts (100% complete) [*] 10.10.10.243:23 TELNET _ _ _ _ _ _ ____ \x0a _ __ ___ ___| |_ __ _ ___ _ __ | | ___ (_) |_ __ _| |__ | | ___|___ \ \x0a| '_ ` _ \ / _ \ __/ _` / __| '_ \| |/ _ \| | __/ _` | '_ \| |/ _ \ __) |\x0a| | | | | | __/ || (_| \__ \ |_) | | (_) | | || (_| | |_) | | __// __/ \x0a|_| |_| |_|\___|\__\__,_|___/ .__/|_|\___/|_|\__\__,_|_.__/|_|\___|_____|\x0a |_| \x0a\x0a\x0aWarning: Never expose this VM to an untrusted network!\x0a\x0aContact: msfdev[at]metasploit.com\x0a\x0aLogin with msfadmin/msfadmin to get started\x0a\x0a\x0ametasploitable login: [*] Scanned 1 of 1 hosts (100% complete) [-] File doesn't seem to exist. The upload probably failed. [*] Scanned 1 of 1 hosts (100% complete) [*] 10.10.10.243 (Apache/2.2.8 (Ubuntu) DAV/2) WebDAV disabled. [*] Scanned 1 of 1 hosts (100% complete) [*] 10.10.10.243:80 Apache/2.2.8 (Ubuntu) DAV/2 ( Powered by PHP/5.2.4-2ubuntu5.10 ) [*] Scanned 1 of 1 hosts (100% complete) [*] Scanned 1 of 1 hosts (100% complete) [*] waiting for some modules to finish msf > [*] 10.10.10.243:3306 is running MySQL 5.0.51a-3ubuntu5 (protocol 10) [*] 10.10.10.243:5900, VNC server protocol version : 3.3 [*] Scanned 1 of 1 hosts (100% complete) [*] Scanned 1 of 1 hosts (100% complete) [*] 10.10.10.243:5900, VNC server security types supported : VNC [*] Scanned 1 of 1 hosts (100% complete) [*] 10.10.10.243:5432 Postgres - Version 8.3.8 (Pre-Auth) [*] Scanned 1 of 1 hosts (100% complete) [*] 10.10.10.239:23 Does not support encryption: Welcome to Microsoft Telnet Service \x0a\x0a\x0dlogin: [*] Scanned 1 of 1 hosts (100% complete) [*] 10.10.10.243:23 Does not support encryption: _ _ _ _ _ _ ____ \x0a _ __ ___ ___| |_ __ _ ___ _ __ | | ___ (_) |_ __ _| |__ | | ___|___ \ \x0a| '_ ` _ \ / _ \ __/ _` / __| '_ \| |/ _ \| | __/ _` | '_ \| |/ _ \ __) |\x0a| | | | | | __/ || (_| \__ \ |_) | | (_) | | || (_| | |_) | | __// __/ \x0a|_| |_| |_|\___|\__\__,_|___/ .__/|_|\___/|_|\__\__,_|_.__/|_|\___|_____|\x0a |_| \x0a\x0a\x0aWarning: Never expose this VM to an untrusted network!\x0a\x0aContact: msfdev[at]metasploit.com\x0a\x0aLogin with msfadmin/msfadmin to get started\x0a\x0a\x0ametasploitable login: [*] Scanned 1 of 1 hosts (100% complete) msf >
One thing that we have to keep in mind scanning thru a pivot is slow, that is why I decided to go with the list of generated ports since these will provide me the best chances to leverage the tools and modules in the framework. For large networks I recommend also using the -v option to see how many scanner jobs are pending.
Now that we finished the discovery lets look at the hosts, services and notes we now have:
msf > hosts
Hosts
=====
address mac name os_name os_flavor os_sp purpose info comments
------- --- ---- ------- --------- ----- ------- ---- --------
10.10.10.1 00:0c:29:4d:e7:5a 10.10.10.1 Unknown device
10.10.10.2 00:0c:29:5e:e3:bd win2k3lab01 Microsoft Windows 2003 SP2 server
10.10.10.200 00:0c:29:45:73:cb winxplab01 Microsoft Windows XP SP2 client
10.10.10.201 00:0c:29:c9:15:98 Unknown device
10.10.10.238 00:0c:29:10:5c:d7 win-yr4v852v71y Microsoft Windows 2008 Enterprise SP1 server
10.10.10.239 00:0c:29:1e:8d:30 test-01bcdaf47c Microsoft Windows XP SP2 client
10.10.10.243 00:0c:29:2e:97:ff metasploitable Linux Debian server
msf > services
Services
========
host port proto name state info
---- ---- ----- ---- ----- ----
10.10.10.1 53 udp dns open 403e858000010001000000000756455253494f4e0442494e440000100003c00c0010000300000000000d0c646e736d6173712d322e3435
10.10.10.1 80 tcp http open lighttpd/1.4.23
10.10.10.2 135 tcp open
10.10.10.2 123 udp ntp open 1c0104fa00000000000a0da14c4f434cd3b1d5bebfd032b2c54f234b71b152f3d3b1e271bbb79f3ed3b1e271bbb79f3e
10.10.10.2 53 udp dns open Microsoft DNS
10.10.10.2 137 udp netbios open WIN2K3LAB01::U :VICTIMLAB::G :VICTIMLAB::G :WIN2K3LAB01::U :VICTIMLAB::U :VICTIMLAB::G :VICTIMLAB::U :__MSBROWSE__::G :00:0c:29:5e:e3:bd
10.10.10.2 3389 tcp open
10.10.10.2 445 tcp smb open Windows 2003 Service Pack 2 (language: Unknown) (name:WIN2K3LAB01) (domain:VICTIMLAB)
10.10.10.2 389 tcp open
10.10.10.200 123 udp ntp open 1c020efa00000000001000000a0a0a02d3b17b6e0454d46dc54f234b71b152f3d3b1e2508240cefdd3b1e2508240cefd
10.10.10.200 135 tcp open
10.10.10.200 3389 tcp open
10.10.10.200 445 tcp smb open Windows XP Service Pack 2 (language: English) (name:WINXPLAB01) (domain:VICTIMLAB)
10.10.10.200 137 udp netbios open WINXPLAB01::U :VICTIMLAB::G :WINXPLAB01::U :VICTIMLAB::G :00:0c:29:45:73:cb
10.10.10.201 135 tcp open
10.10.10.238 137 udp netbios open WIN-YR4V852V71Y::U :WORKGROUP::G :WIN-YR4V852V71Y::U :00:0c:29:10:5c:d7
10.10.10.238 135 tcp open
10.10.10.238 445 tcp smb open Windows 2008 Enterprise Service Pack 1 (language: Unknown) (name:WIN-YR4V852V71Y) (domain:WORKGROUP)
10.10.10.239 23 tcp telnet open Welcome to Microsoft Telnet Service \x0a\x0a\x0dlogin:
10.10.10.239 123 udp ntp open Microsoft NTP
10.10.10.239 135 tcp open
10.10.10.239 137 udp netbios open TEST-01BCDAF47C::U :WORKGROUP::G :TEST-01BCDAF47C::U :WORKGROUP::G :WORKGROUP::U :__MSBROWSE__::G :00:0c:29:1e:8d:30
10.10.10.239 445 tcp smb open Windows XP Service Pack 2 (language: English) (name:TEST-01BCDAF47C) (domain:WORKGROUP)
10.10.10.243 80 tcp http open Apache/2.2.8 (Ubuntu) DAV/2 ( Powered by PHP/5.2.4-2ubuntu5.10 )
10.10.10.243 22 tcp ssh open SSH-2.0-OpenSSH_4.7p1 Debian-8ubuntu1
10.10.10.243 23 tcp telnet open _ _ _ _ _ _ ____ \x0a _ __ ___ ___| |_ __ _ ___ _ __ | | ___ (_) |_ __ _| |__ | | ___|___ \ \x0a| '_ ` _ \ / _ \ __/ _` / __| '_ \| |/ _ \| | __/ _` | '_ \| |/ _ \ __) |\x0a| | | | | | __/ || (_| \__ \ |_) | | (_) | | || (_| | |_) | | __// __/ \x0a|_| |_| |_|\___|\__\__,_|___/ .__/|_|\___/|_|\__\__,_|_.__/|_|\___|_____|\x0a |_| \x0a\x0a\x0aWarning: Never expose this VM to an untrusted network!\x0a\x0aContact: msfdev[at]metasploit.com\x0a\x0aLogin with msfadmin/msfadmin to get started\x0a\x0a\x0ametasploitable login:
10.10.10.243 25 tcp smtp open 220 metasploitable.localdomain ESMTP Postfix (Ubuntu)
10.10.10.243 21 tcp ftp open 220 (vsFTPd 2.3.4)\x0d\x0a
10.10.10.243 111 udp portmap open 100000 v2 TCP(111), 100000 v2 UDP(111), 100024 v1 UDP(55600), 100024 v1 TCP(53257), 100003 v2 UDP(2049), 100003 v3 UDP(2049), 100003 v4 UDP(2049), 100021 v1 UDP(58825), 100021 v3 UDP(58825), 100021 v4 UDP(58825), 100003 v2 TCP(2049), 100003 v3 TCP(2049), 100003 v4 TCP(2049), 100021 v1 TCP(47361), 100021 v3 TCP(47361), 100021 v4 TCP(47361), 100005 v1 UDP(40587), 100005 v1 TCP(42089), 100005 v2 UDP(40587), 100005 v2 TCP(42089), 100005 v3 UDP(40587), 100005 v3 TCP(42089)
10.10.10.243 111 tcp sunrpc open 100000 v2
10.10.10.243 137 udp netbios open METASPLOITABLE::U :METASPLOITABLE::U :METASPLOITABLE::U :WORKGROUP::G :WORKGROUP::G :00:00:00:00:00:00
10.10.10.243 139 tcp open
10.10.10.243 445 tcp smb open Unix Samba 3.0.20-Debian (language: Unknown) (domain:WORKGROUP)
10.10.10.243 512 tcp open
10.10.10.243 513 tcp open
10.10.10.243 514 tcp open
10.10.10.243 1099 tcp open
10.10.10.243 1524 tcp open
10.10.10.243 2049 udp sunrpc open 100003 v4
10.10.10.243 2049 tcp sunrpc open 100003 v4
10.10.10.243 3306 tcp mysql open 5.0.51a-3ubuntu5
10.10.10.243 3632 tcp open
10.10.10.243 5432 tcp postgres open 8.3.8
10.10.10.243 5900 tcp vnc open VNC protocol version 3.3
10.10.10.243 6000 tcp open
10.10.10.243 6667 tcp open
10.10.10.243 6697 tcp open
10.10.10.243 8180 tcp open
10.10.10.243 8787 tcp open
10.10.10.243 40587 udp sunrpc open 100005 v3
10.10.10.243 42089 tcp sunrpc open 100005 v3
10.10.10.243 47361 tcp sunrpc open 100021 v4
10.10.10.243 53257 tcp sunrpc open 100024 v1
10.10.10.243 55600 udp sunrpc open 100024 v1
10.10.10.243 58825 udp sunrpc open 100021 v4
msf > notes
[*] Time: 2012-07-19 01:35:46 UTC Note: host=10.10.10.2 type=host.virtual_machine data={:vendor=>"VMWare", :method=>"netbios"}
[*] Time: 2012-07-19 01:35:47 UTC Note: host=10.10.10.200 service=smb type=smb.fingerprint data={:os_flavor=>"Windows XP", :os_name=>"Microsoft Windows", :os_sp=>"Service Pack 2", :os_lang=>"English"}
[*] Time: 2012-07-19 01:36:03 UTC Note: host=10.10.10.239 service=smb type=smb.fingerprint data={:os_flavor=>"Windows XP", :os_name=>"Microsoft Windows", :os_sp=>"Service Pack 2", :os_lang=>"English"}
[*] Time: 2012-07-19 01:36:05 UTC Note: host=10.10.10.200 type=host.virtual_machine data={:vendor=>"VMWare", :method=>"netbios"}
[*] Time: 2012-07-19 01:36:16 UTC Note: host=10.10.10.238 service=smb type=smb.fingerprint data={:os_flavor=>"Windows 2008 Enterprise", :os_name=>"Microsoft Windows", :os_sp=>"Service Pack 1", :os_lang=>"Unknown"}
[*] Time: 2012-07-19 01:36:22 UTC Note: host=10.10.10.239 type=host.virtual_machine data={:vendor=>"VMWare", :method=>"netbios"}
[*] Time: 2012-07-19 01:36:28 UTC Note: host=10.10.10.243 service=smb type=smb.fingerprint data={:os_flavor=>"Unix", :os_name=>"Unknown", :os_sp=>"Samba 3.0.20-Debian"}
[*] Time: 2012-07-19 01:36:33 UTC Note: host=10.10.10.238 type=host.virtual_machine data={:vendor=>"VMWare", :method=>"netbios"}
[*] Time: 2012-07-19 01:36:34 UTC Note: host=10.10.10.243 service=139/tcp type=smb.domain.enumusers data={:sid_txt=>"5-21-1042354039-2475377354-766472396", :pass_min=>5, :pass_min_history=>0, :server_role=>3, :lockout_threshold=>0, :lockout_duration=>1480786430454, :lockout_window=>1480786430454, :users=>{1010=>"games", 501=>"nobody", 1210=>"bind", 1026=>"proxy", 1204=>"syslog", 3002=>"user", 1066=>"www-data", 1000=>"root", 1018=>"news", 1216=>"postgres", 1004=>"bin", 1016=>"mail", 1222=>"distccd", 1226=>"proftpd", 1202=>"dhcp", 1002=>"daemon", 1208=>"sshd", 1012=>"man", 1014=>"lp", 1218=>"mysql", 1082=>"gnats", 1200=>"libuuid", 1068=>"backup", 3000=>"msfadmin", 1224=>"telnetd", 1006=>"sys", 1206=>"klog", 1212=>"postfix", 3004=>"service", 1076=>"list", 1078=>"irc", 1214=>"ftp", 1220=>"tomcat55", 1008=>"sync", 1020=>"uucp"}, :name=>"METASPLOITABLE"}
[*] Time: 2012-07-19 01:36:36 UTC Note: host=10.10.10.243 service=139/tcp type=smb.shares data={:shares=>[["print$", "DISK", "Printer Drivers"], ["tmp", "DISK", "oh noes!"], ["opt", "DISK", ""], ["IPC$", "IPC", "IPC Service (metasploitable server (Samba 3.0.20-Debian))"], ["ADMIN$", "IPC", "IPC Service (metasploitable server (Samba 3.0.20-Debian))"]]}
[*] Time: 2012-07-19 01:35:33 UTC Note: host=10.10.10.2 service=smb type=smb.fingerprint data={:os_flavor=>"Windows 2003", :os_name=>"Microsoft Windows", :os_sp=>"Service Pack 2", :os_lang=>"Unknown"}
You can download the latest version from my GitHub repository at https://github.com/darkoperator/Metasploit-Plugins/blob/master/pentest.rb Also I got a request from a friend to turn the discovery command in to a post module so I started work on that also. I hope you find these new commands useful.