Chapter 5. Testing Services with Metasploit

Let us now talk about testing the various specialized services. It is likely that during our career as a penetration tester we will come across a company or a testable environment that only requires testing to be performed on a particular server, and this server may run services such as databases, VoIP, or a SCADA control system. In this chapter, we will look at the various development strategies to use while carrying out penetration tests on these services. In this section, we will cover the following points:

• Carrying out database penetration tests
• The fundamentals of ICS and their critical nature
• Understanding SCADA exploitation
• Testing Voice over Internet Protocol services

Service-based penetration testing requires exceptional skills and a sound knowledge of the services that we can successfully exploit. Therefore, in this chapter, we will look at both the theoretical and the practical challenges of carrying out efficient service-based testing.

Testing MySQL with Metasploit

It's well known that Metasploit supports extensive modules for Microsoft's SQL server. However, it supports a number of functionalities for other databases as well. We have plenty of modules for other databases in Metasploit that support popular databases, such as MySQL, PostgreSQL, and Oracle. In this chapter, we will cover Metasploit modules for testing a MySQL database.

If you are someone who comes across MSSQL more often, I have covered MSSQL testing with Metasploit in my Mastering Metasploit book series.

Note

Refer to MSSQL testing from the Mastering Metasploit book series at:https://www.packtpub.com/networking-and-servers/mastering-metasploit-second-edition

So let's conduct a port scan to see if a database has a target machine running on the IP address 172.28.128.3, as follows:

We can clearly see we have port 3306 open, which is a standard port for the MySQL database.

Using Metasploit's mysql_version module

Let's fingerprint the version of the MySQL instance...

The fundamentals of SCADA

Supervisory Control and Data Acquisition (SCADA) is required for controlling activities in dams, power grid stations, oil refineries, large server control services, and so on.

SCADA systems are built for highly specific tasks, such as controlling the level of dispatched water, managing the gas lines, controlling the electricity power grid to monitor power in a particular city, and various other operations.

Analyzing security in SCADA systems

In this section, we will discuss how we can breach the security of SCADA systems. We have plenty of frameworks that can test SCADA systems, but discussing them will push us beyond the scope of this book. Therefore, keeping it simple, we will restrict our discussion to SCADA exploitation only, carried out using Metasploit.

The fundamentals of testing SCADA

Let us understand the basics of exploiting SCADA systems. SCADA systems can be compromised using a variety of exploits in Metasploit, which were added recently to the framework...

Testing Voice over Internet Protocol services

Let us now focus on testing Voice over Internet Protocol (VoIP)-enabled services and see how we can check for various flaws that might affect VoIP services.

VoIP fundamentals

VoIP is a much less costly technology when compared to the traditional telephonic services. VoIP provides much more flexibility than traditional telephony in terms of telecommunication, and offers various features, such as multiple extensions, caller ID services, logging, the recording of each call made, and so on. Some companies now have their Private Branch exchange (PBX) on IP-enabled phones these days.

The traditional and still-present telephonic system is still vulnerable to interception through physical access, such that if an attacker alters the connection of a phone line and attaches their transmitter, they will be able to make and receive calls to their device and can enjoy Internet and fax services.

However, in the case of VoIP services, we can compromise security...

Summary and exercises

Throughout this chapter, we saw how we could test MySQL databases, VoIP services, and SCADA systems for a number of vulnerabilities. We saw how an attacker gaining access to just the database could end up having system-level access. We also saw how vulnerabilities in ICS and SCADA can lead an attacker to compromise an entire server, which may result in enormous damage, and we saw how PBX deployed in various companies can be used not only to spoof calls but to compromise the whole client system. To practice your skills, you can perform the following further exercises at your own pace:

• Try testing MSSQL and PostgreSQL databases and make a note of the modules.
• Download other software-based SCADA systems and try exploiting them locally.
• Try to run system commands for MSSQL.
• Resolve error 13 on MySQL for writing files onto the server.
• The database testing covered in this chapter was performed on Metasploitable 2. Try setting up the same environment locally and repeat the exercise...