Penetration testing using metasploit framework

International Research Journal of Engineering and Technology (IRJET) e-ISSN: 2395-0056
Volume: 05 Issue: 12 | Dec 2018 www.irjet.net p-ISSN: 2395-0072
© 2018, IRJET | Impact Factor value: 7.211 | ISO 9001:2008 Certified Journal | Page 193
RESEARCH PAPER
A study on Penetration Testing Using Metasploit Framework
Pawan Kesharwani1, Sudhanshu Shekhar Pandey2, Vishal Dixit3, Lokendra Kumar Tiwari4
1,2,3,4Center for Computer Sciences, Ewing Christian College, Prayagraj
---------------------------------------------------------------------***---------------------------------------------------------------------
Abstract - The process of performing a penetration test is to verify that networks and systems are not vulnerable to a security
risk that could allow unauthorized access to resources. This paper will review the steps involved in preparing for and
performing a penetration test. The intended audience for this paper is projectdirectors ormanagerswhomightbeconsidering
having a penetration test performed. The process of performinga penetrationtestiscomplex.Eachcompanymustdetermineif
the process is appropriate for them or not.
Key Words: Security Testing, Vulnerability Assessment, Penetration Testing, Web Application Penetration Testing.
1. INTRODUCTION
Over the last few years, companies have been adding additional functionality to existing applications and implementing new
applications in an effort to provide more convenience or better service for customers and/or employees. Examples of this
functionality could be in the form of World Wide Web access for bank customers or telecommutingoptionsforemployeeswho
work at home. Additionally, companies have also determined that a presence on the World Wide Web is a way to increase
brand awareness and establish a top-of -mind awareness for their product or service for potential customers. Security is a
significant concern for World Wide Web servers. The World Wide Web servers have added a new set of vulnerabilities that
companies should consider. However, vulnerabilities are not limited to World Wide Web servers. Vulnerabilitiesexistandcan
be unintentionally induced in systems or resources that have been in operation for an extended period.
1.1 What Is Penetration Testing?
Penetration testing also called pen testing or ethical hacking is the practice of testing a computer system, network or web
application to find security vulnerabilities that an attacker could exploit. Penetration testing can be automated with software
applications or performed manually. Either way, the process involves gathering information about the target before the test,
identifying possible entry points, attempting to break in -- either virtually or for real -- and reporting back the findings.
1.2 WHY PERFORM A PENETRATION TEST?
If vulnerability is utilized by an unauthorized individual to access company resources, company resources can be
compromised. The objective of a penetration test is to address vulnerabilities before they can be utilized.
2. PHASES IN PENETRATION TESTING:
1) INFORMATION GATHERING: In this phase we shall gather all information related to server like what is correct
domain of web server and how many sub-domains are connectedtothisdomain.Isanyfirewall issetupfor webserver
or not? In our information gathering phase, we have found that web server’s IP - 192.168.43.236. For detection of
firewall we will use the tool WAFW00F (Web Application Firewall Detection Tool).
2) SCANNING: In the scanning phase, we identify that what type of services is running on the web server andwhatisthe
version of that particular service. We also identify that at which port this service is running. We identify that all
services is running on which Operating system. For doing this we mainly use NMAP (Network MAPPER) tool and
METASPLOIT’s AUXILIARY/SCANNER facility.
3) DISCOVER VULNERABILITY: For find vulnerability in web server or any system pentester mainlyuse Nikto,Nessus
or Metasploit’s Auxiliary/scanner facility. In my work I mainly use auxiliary’s Scanner Facility.
4) EXPLOITATION: After find vulnerability, a pentester’s main goal is Breach all type of securityandtakeremoteaccess
of server. For doing this we use METASPLOIT.
5) REPORT GENERATION: In this phase we just generate full report of our Penetration testing process.

3. GATHERING INFORMATION ABOUT SYSTEMS (INVENTORY SCAN)
The Inventory scan process involves obtaining as much information as possible about the system that is targeted for the
penetration test. Information of value: Operating System (including version number) in use, applications and application
versions. With the Operating System and application specific information, only the known vulnerabilities that exist for the
specific Operating System and or application need be tested. This is the distinction between an indiscriminate address space
probe for any open ports (also known as script kiddies) and an actual penetration test.
4. EXPLOITATION OF VULNERABILITIES
The exploitation phase of the penetration test is performed by using a vulnerability scanner to identify problems with the
configuration of a system. There are number of freeware and commercial tools that perform specific functions. The tools
(subset of the tools mentioned include:
A. Nessus –A network vulnerability scanner tool for Unix systems.
B. Firewalk –A traceroute like tool that allows the Access Control Lists of a firewall tobe determinedanda network map
can be created.
C. John the Ripper –John is an active password cracking tool to identify weak password syntax.
D. Crack / Libcrack –A password cracking tool for Unix systems.
5. PROVIDING THE RESULTS OF THE TEST
The results of the test should include solutions to reduce or eliminate the vulnerabilities. This is what differentiates a
penetration test and a security audit. The significant vulnerabilities identified should be addressed first and a schedule
determined to verify that the vulnerabilities have been addressed. The next department, network or system can then be
selected for the same penetration testing process.
The solutions implemented will be dependent on the vulnerabilities identified, the loss to thecompanyifconditionstriggering
the vulnerability occurred, and the cost (and effectiveness) of the available solutions. One solution might require that a new
system running a web server must pass a vulnerability test before the web port is opened at the firewall. Another solution
might require that all mail within the domain is sent to a central mail system and delivered to local host systems bythecentral
mail server. Enforcement of the existing policy might be the only condition required to address certain vulnerabilities.
In the case of desktop security, remote administration software might be already prohibited at the company. But a better job
needs to be done to ensure compliance.
There will also be vulnerabilities that can be addressed by applying the most recent version of the application or operating
system patch. The results of the report should be closely guarded. If the informationfell intothewronghands,anunauthorized
individual could exploit the recently.
6. Test Performed By Team Members
1) INFORMATION GATHERING :
ATTACKER’S IP: 192.168.43.30 (KALI OS)
VICTIM’S IP: 192.168.43.236
Our first work is login on attacking system. While we started information gathering phase, we first gather that what is IP of
victim. Now our second work is that we check that, is any firewall enable on this server or not. We shall do this by using
WAFW00F tool.
After successfully login to attacking system,
We open our terminal and type wafw00f and press enter key.
Here type wafw00f http://192.168.43.236

FIGURE – 1.1
After seeing the output of this work, we easily understand that this server is behind a firewall or any kind of security.
Now I want to know that what admin name of the system and what is password. For do this I shall create wordlist of both
username and password. After creating wordlist, I shall do brute force attack onwebserver.FordoingBruteforce attack ishall
use XHYDRA tool. This is a password cracking tool.
USER NAME LIST:
FIGURE – 1.2
PASSWORD LIST:
FIGURE – 1.3

Now Open APPLICATION > PASSWORD ATTACKS > XHYDRA
Set target IP – 192.168.43.236
Set Username list and Password list in xHydra
FIGURE – 1.5
Now click on start button and as we can see the output.
FIGURE – 1.6

Here after brute-force attack, username is l2s3r and password is l2s3r@l2s3r of server – 192.168.43.236
Now we shall start scanning process where we identify the server O.S, whatservicesisrunningonserverandwhatisversionof
services.
2) SCANNING :
For scanning process we shall use NMAP (network mapper) tool.
NMAP:
NMAP USE:
-sT Scan using TCP connect
-sS Scan using TCP SYN scan (default)
-sU Scan UDP ports
Set ip in NMAP for scanning For detect running O.S, running services use –sS, -sV, -A.
PENETRATION TESTING IN SMB PROTOCOL USING METASPLOIT (PORT 445)
msf > search scanner/smb
FOR DETECT SMB VERSION 1
msf > use auxiliary/scanner/smb/smb1
msf auxiliary(scanner/smb/smb1) > show options
msf auxiliary(scanner/smb/smb1) > set rhosts 192.168.43.236
msf auxiliary(scanner/smb/smb1) > run
After seeing this output we can easily understand that windows 7 support smb version 1
Now we move to our next part which is discovering vulnerability.

3) DISCOVER VULNERABILITY :
For discover vulnerability in server we again use METASPLOIT.
FOR CHECK THAT SMB IS VULNERABLE OR NOT
msf > use auxiliary/scanner/smb/smb_ms17_010
msf auxiliary(scanner/smb/smb_ms17_010) > show options
msf auxiliary(scanner/smb/smb_ms17_010) > set rhosts 192.168.43.236
msf auxiliary(scanner/smb/smb_ms17_010) > run
As we can see from output that: Host is likely VULNERABLE to MS17-010.
4) EXPLOITATION:
Multiple ways to Connect Remote PC using SMB Port
msf > use exploit/windows/smb/psexec
msf exploit (windows/smb/psexec) > show options
msf exploit (windows/smb/psexec) > set rhost 192.168.43.236
msf exploit (windows/smb/psexec) > set smbuser l2s3r
msf exploit (windows/smb/psexec) > set smbpass l2s3r@l2s3r
msf exploit (windows/smb/psexec) > set payload windows/meterpreter/reverse_tcp
msf exploit (windows/smb/psexec) > set lhost 192.168.43.30
msf exploit (windows/smb/psexec) > exploit

Once the commands run we shall gain a meterpreter session of your victim’s PC and so we can access it as we want.
Result:
Vulnerability #1 – : scanner/smb/smb_ms17_010 Eternalblue is the exploit used for compromising a windows 7 system. The
windows tools will be running in kali by a window emulator, called wine. The execution of windows tools will be transparent
thanks to exploit code for metasploit released by elevenpaths.
Vulnerability #2- windows/smb/psexec The psexec module is often used by penetration testers to obtain access to a given
system that you already know the credentials for. It waswrittenbySysinternalsandhasbeenintegrated withintheframework.
Often as penetration testers, we successfully gain access to a system through some exploit, use meterpreter to grab the
passwords or other methods like fgdump, pwdump, or cachedump and then use rainbowtables to crack those hash values.
Conclusion:
Penetration testing is a comprehensive method to identify the vulnerabilities in a system. It offers benefits such as prevention
of financial loss; compliance to industry regulators, customers and shareholders; preserving corporate image; proactive
elimination of identified risks. The testers can choose from black box,whitebox,andgrayboxtestingdependingon theamount
of information available to the user. The testers can also choose from internal and external testing, depending on the specific
objectives to be achieved. There are three types of penetration testing: network,applicationandsocial engineering.Thispaper
discussed a three-phase methodology consisting of test preparation, test, and test analysis phase. The test phase is done in
three steps: information gathering, vulnerability analysis, and vulnerability exploit. This phase can be done manuallyorusing
automated tools.
REFERENCES
1. http://nmap.org/ accessed on 05/12/2018.
2. https://searchsoftwarequality.techtarget.com accessed on 5/12/2018.
3. https://www.google.com/ accessed on 5/12/2018.
4. Metasploit -The Penetration Tester’s Guide by David Kennedy,Jim O’Gorman, Devon Kearns.
5. Penetration testing a Hands-on introduction to Hacking San Francisco by Georgia Weidman.
6. McGraw, G. (2006). Software Security: Building Security In, Adison Wesley Professional.
7. https://www.exploit-db.com/ accessed on 05/12/2018.
8. https://www.rapid7.com/ accessed on 05/12/2018.
AUTHORS
Corresponding Author –
Pawan Kesharwani
B.VOC IT-ITeS
Ewing Christian College Prayagraj
Second Author –
Sudhanshu Shekhar Pandey
B.VOC IT-ITeS
Third Author –
Vishal Dixit
B.VOC IT-ITeS

Fourth Author–
Dr. Lokendra Kumar Tiwari
Assitant Professor, B.VOC IT-ITeS

Penetration testing using metasploit framework

Recommended

More Related Content

What's hot (18)

Similar to Penetration testing using metasploit framework (20)

Recently uploaded (20)

Penetration testing using metasploit framework