Chapter 2. Identifying and Scanning Targets

We learned the basics of Metasploit in the Chapter 1, Getting Started with Metasploit. Let us now shift our focus to an essential aspect of every penetration test, that is, the scanning phase. One of the most critical aspects of penetration testing, the scanning phase involves identification of various software and services running on the target, hence, making it the most time consuming and the most crucial aspect of a professional penetration test. They say, and I quote, "If you know the enemy and know yourself, you need not fear the result of a hundred battles". If you want to gain access to the target by exploiting vulnerable software, the first step for you to take is to figure out if a particular version of the software is running on the target. The scanning and identification should be conducted thoroughly, so that you don't end up performing a DOS attack on the wrong version of the software.

In this chapter, we will try uncovering the scanning...

Working with FTP servers using Metasploit

The module we will be using for this demonstration is ftp_version.rb from scanners in the auxiliary section.

Scanning FTP services

Let us select the module using the use command and check what different options are required by the module for it to work:

We can see we have a number of modules to work with. However, for now, let us use the ftp_version module, as shown in the following screenshot:

To scan the entire network, let's set RHOSTS to 192.168.10.0/24 (0-255) and also increase the number of threads for a speedy operation:

Let's run the module and analyze the output:

We can see we have scanned the entire network and found two hosts running FTP services, which are TP-LINK FTP server and FTP Utility FTP server. So now that we know what services are running on the target, it will be easy for us to find any matching exploit if the version of these FTP services is vulnerable.

We can also see that some lines are displaying the progress of the scan and generating...

Scanning MSSQL servers with Metasploit

Let us now jump into Metasploit-specific modules for testing the MSSQL server and see what kind of information we can gain by using them.

Using the mssql_ping module

The very first auxiliary module that we will be using is mssql_ping. This module will gather service information related to the MSSQL server.

So, let us load the module and start the scanning process as follows:

We can clearly see that mssql_ping has generated an excellent output of the fingerprinted MSSQL service.

Brute-forcing MSSQL passwords

Metasploit also offers brute-force modules. A successful brute-force does exploit low entropy vulnerabilities; if it produces results in a reasonable amount of time it is considered a valid finding. Hence, we will cover brute-forcing in this phase of the penetration test itself. Metasploit has a built-in module named mssql_login, which we can use as an authentication tester for brute-forcing the username and password of an MSSQL server database.

Let us...

Scanning SNMP services with Metasploit

Let us perform a TCP port scan of a different network as shown in the following screenshot:

We will be using the tcp scan module listed under auxiliary/scanner/portscan, as shown in the preceding screenshot. Let's run the module and analyze the results as follows:

We can see that we found two services only that don't look that appealing. Let us also perform a UDP sweep of the network and check if we can find something interesting:

To carry out a UDP sweep, we will use the auxiliary/scanner/discovery/udp_sweep module as shown in the preceding screenshot. Next, we only need to provide the network range by setting the RHOSTS option. Additionally, you can increase the number of threads as well. Let's run the module and analyze results:

Amazing! We can see plenty of results generated by the UDP sweep module. Additionally, a Simple Network Management Protocol (SNMP) service is also discovered on 192.168.1.19.

The SNMP, is a commonly used service that provides...

Scanning NetBIOS services with Metasploit

Netbios services also provide vital information about the target and help us uncover the target architecture, operating system version, and many other things. To scan a network for NetBIOS services, we can use the nbname module from auxiliary/scanner/netbios, as shown in the following screenshot:

As we did previously, we set the RHOSTS to the entire network by providing the CIDR identifier. Let's run the module and analyze the results as follows:

We can see that we have almost every system running the NetBIOS service on the network listed in the preceding screenshot. This information provides us with useful evidence for the operating system type, name, domain, and related IP addresses of the systems.

Scanning HTTP services with Metasploit

Metasploit allows us to perform fingerprinting of various HTTP services. Additionally, Metasploit contains a large number of exploit modules targeting different kinds of web servers. Hence, scanning HTTP services not only allows for fingerprinting the web servers, but it builds a base of web server vulnerabilities that Metasploit can attack later. Let us use the http_version module and run it against the network as follows:

Let's execute the module after setting up all the necessary options such as RHOSTS and Threads as follows:

The http_version module from Metasploit has successfully fingerprinted various web server software and applications in the network. We will exploit some of these services in Chapter 3, Exploitation and Gaining Access. We saw how we could fingerprint HTTP services, so let's try figuring out if we can scan its big brother, the HTTPS with Metasploit.

Scanning HTTPS/SSL with Metasploit

Metasploit contains the SSL scanner module that can uncover a variety of information related to the SSL service on a target. Let us quickly set up and run the module as follows:

We have the SSL module from auxiliary/scanner/http, as shown in the preceding screenshot. We can now set the RHOSTS, a number of threads to run, and RPORT if it is not 443, and execute the module as follows:

Analyzing the preceding output, we can see that we have a self-signed certificate in place on the IP address 192.168.1.8 and other details such as CA authority, e-mail address, and much more. This information becomes vital to law enforcement agencies and in cases of fraud investigation. There have been many cases where the CA has accidentally signed malware spreading sites for SSL services.

We learned about various Metasploit modules. Let us now delve deeper and look at how the modules are built.

Module building essentials

The best way to start learning about module development is to delve deeper into the existing Metasploit modules and see how they work. Let's look at some modules to find out what happens when we run these modules.

The format of a Metasploit module

The skeleton for Metasploit modules is relatively simple. We can see the universal header section in the following code:

require 'msf/core' 
class MetasploitModule < Msf::Auxiliary 
  def initialize(info = {}) 
    super(update_info(info, 
      'Name'           => 'Module name', 
      'Description'    => %q{ 
       Say something that the user might want to know. 
      }, 
      'Author'         => [ 'Name' ], 
      'License'        => MSF_LICENSE 
    )) 
  end 
def run 
    # Main function 
  end 
end 

A module starts by including the necessary libraries with the required keyword, which in the preceding code is followed by the msf/core libraries. Thus, it includes the core libraries from the msf directory...

Disassembling existing HTTP server scanner modules

Let's work with a simple module that we used previously, that is, the HTTP version scanner and see how it works. The path to this Metasploit module is /modules/auxiliary/scanner/http/http_version.rb.

Let's examine this module systematically:

# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit 
# website for more information on licensing and terms of use. 
# http://metasploit.com/ 
require 'rex/proto/http' 
require 'msf/core' 
class Metasploit3 < Msf::Auxiliary

Let's discuss how things are arranged here. The copyright lines starting with the # symbol are the comments and they are included in all Metasploit modules. The required 'rex/proto/http' statement asks the interpreter to include a path to all the HTTP protocol methods from the rex library. Therefore, the path to all the files from the /lib/rex/proto/http directory is now available to the module...

Summary and exercises

Throughout this chapter, we covered scanning extensively over various types of services such as databases, FTP, HTTP, SNMP, NetBIOS, SSL, and more. We looked at how the stuff works for developing custom modules and dismantled some library functions and modules. This chapter will help you answer the following set of questions:

• How do you scan FTP, SNMP, SSL, MSSQL, NetBIOS, and various other services with Metasploit?
• Why is it necessary to scan both TCP and UDP ports?
• How can a Metasploit module be edited inline for fun and profit?
• How are various libraries added to Metasploit modules?
• Where do you look for functions used in a Metasploit module to build a new module?
• What is the format of a Metasploit module?
• How do you print status, information, and error messages in Metasploit modules?

You can try the following self-paced exercises to learn more about the scanners:

• Try executing system commands through MSSQL using the credentials found in the tests
• Try finding a vulnerable...