Hello, everyone! Thank you for tuning in to our latest video. Today, we're diving into a tutorial series focusing on vulnerable machines called "PenetesterLab". Our target for this session is a machine labeled "s2-052".

To get started, you'll need to grab the vulnerable image from VulnHub's website. If you're new to VulnHub, don't worry; you can check out our previous videos in the VulnHub playlist for a primer.

Once you have the image, setting up the virtual machine (VM) in VirtualBox is our next step.

Settings Up

In this section, we're going to guide you through setting up a new virtual machine (VM) in VirtualBox. Since the file we've downloaded comes in the ".iso" format, the first step is creating a new VM.

Begin by launching VirtualBox.

Then, click on "New" to initiate the creation of a new virtual machine (VM). 

Here, we'll need to specify the Virtual Machine Name, Operating System type, and version. Since we obtained the information from the VulnHub page, we know that the vulnerable iso is Linux-based.

Click next, to customize the hardware settings by adjusting the RAM and Virtual CPU count.

Click Next, and you'll be prompted to create a new virtual hard disk. This step allows you to allocate storage space according to your requirements. 

After configuring the disk, click "Next", to confirm the changes that we did earlier.

Finally, click "Finish" to complete the creation of your VM. Once the VM is created, you'll see it listed in the VirtualBox Manager. 

Now, Let's organize it by grouping it under "PenetesterLab". 

Now, let's configure the settings. 

Select the VM, click on "Settings", and navigate to the storage settings. 

Here, add the iso image. 

Now, change the network adapter to "Host-only adapter" in network settings.

It's important to ensure that both your Kali Linux machine, which I use it for performing attacks, and the vulnerable machine are connected to the same network.

With everything set up, it's time to start the Virtual Machines. 

You'll notice that the Vulnerable Machine is ready, displaying a shell prompt for input. However, our goal is to access it from the Kali machine. 

Let's dive into the fun!

Enumeration

Enumeration is the first process of our attack, aimed at identifying the IP Address of our Target Machine using NetDiscover. 

To do this, open a terminal, run "netdiscover -i" and then specify the network interface name, which is eth1.

From the scan result, we have obtained our target IP address, which is, "192.168.95.4".

Next, we move on to conducting a network scan to identify open ports. This step is crucial in understanding the attack surface and planning targeted attacks. We'll utilize the widely-used Nmap tool for this task. Execute "nmap -A" followed by the IP address. 

Where, the "-A" flag enables a comprehensive scan across all available ports, providing insights into the versions running on each port.

After conducting the network scan, we spotted the presence of one open port.

Specifically, The Port 80/TCP, is basically running an HTTP service. This suggests the presence of a vulnerable web application.

So let’s take a look at the web content running on port 80. To look at the contents ourselves, we can open a web browser of our choice, and navigate to the target's IP address in the URL bar at the top of the window.

Upon examining the webpage, there appears to be a potential vulnerability. Let's utilize the Nikto command line tool to identify it.

If you're unfamiliar with Nikto, we've covered it in a previous video. 

Feel free to check it out for more information.

After analyzing the results, we've uncovered a MIME content type vulnerability. 

However, this finding alone doesn't provide much insight. To conduct a more thorough scan and uncover additional vulnerabilities, I'll employ the use of "Acunetix".

To launch the Acunetix dashboard, simply run the command "service acunetix start" in your terminal. 

This will initiate the Acunetix server on Port 3443 on localhost. 

If Acunetix isn't available, alternatives like OpenVAS or Nessus can be utilized.

For those interested in installing Acunetix on Kali for free, check out the blog link provided below this video.

Once on the Acunetix dashboard page, navigate to "Targets" and select "Add target" to begin scanning. 

Input the URL of the potential vulnerability and save the target.

No further adjustments are necessary; simply click "Scan" to initiate the process. 

From here, you can customize the scanning options to your preference. For instance, I've chosen a full scan type. After configuring the options, simply click "Create scan" to initiate the scanning process.

The scanning process has begun, and you can monitor its progress in the Activity section through the progress bar.

However, as the scanning is consuming considerable time, I'll halt it momentarily. I believe I've already identified the vulnerability.

It appears to be the Apache Struts2 Remote Code Execution (s2-052) vulnerability. 

Here, you will find out the detailed information regarding this vulnerability, offering further insights. Take a look if you wish to delve deeper.

Now that we've identified the vulnerability, it's time to move on to the exploitation step.

Exploitation

To exploit this vulnerability, we'll utilize the MSF console, which can be easily accessed from the Kali menu.

Once opened, you'll find yourself in the MSF6 console. 

Here, we'll search for the vulnerability "s2-052".

The search results display 6 modules, tailored to different operating systems. We already know the OS is Linux, but to confirm it, we can use n map. Here Linux is confirmed.

To proceed, execute "use 5" to select the Linux module, where the payload will be automatically selected.

Next, utilize the "options" command to display the required parameters for the attack.

Here, we need to provide, RHOST, RPORT, TARGETURI, LHOST, and LPORT, and also some cases we have to provide, SRVHOST, and SRVPORT.

With the configuration complete, we're ready to establish a foothold on the server. Let's proceed.

Foothold

Run the “exploit” command, to obtain the shell if it is successful.

Upon running the “exploit”, we encountered an error message: "Exploit completed but no session was created."

Now, let's carefully analyze the options to ensure everything is configured correctly. Upon verification, all settings appear to be in order. It appears to be like, the issue may lie with the payload selected. 

Let's address this by selecting a different payload.

Run "show payloads", to view the available payloads for Linux. 

In this case, I'll choose "payload/linux/x86/shell/reverse_tcp".

After selecting the new payload, run the "options" command to ensure all necessary parameters are correctly configured.

With everything in order, execute the “exploit” command once more, and observe the results. 

Success! It appears the exploit has worked.

Finally, we've successfully established a foothold on the server. Confirm this by running the "whoami" command to verify if we have root privileges. 

Indeed, we do have root access.

Since we've achieved our objective without encountering any privilege escalation issues, there's no need to proceed further.

If you have any questions or concerns, feel free to leave them in the comments section below.