Metasploit Unleashed http://www.offensive-security.com/metasploit-unleashed/
27.11.2012
1 / 457
Contents 1.
Introduction .................................................................................................................................. 10 1.1
Filesystem And Libraries ................................................................................................... 11
Libraries........................................................................................................................................ 11 1.2
Modules And Locations ..................................................................................................... 11
Exploits ......................................................................................................................................... 11 Payloads, Encoders, Nops ........................................................................................................ 11 Modules Locations ...................................................................................................................... 12 1.3
Metasploit Object Model .................................................................................................... 12
1.4
Mixins And Plugins ............................................................................................................. 12
Metasploit Mixins ........................................................................................................................ 12 Metasploit Plugins....................................................................................................................... 13 2.
Required Materials ..................................................................................................................... 14 2.1
Hardware Prerequisites ..................................................................................................... 14
Hard Drive Space ....................................................................................................................... 14 Available Memory ....................................................................................................................... 15 Processor ..................................................................................................................................... 15 Internet Accessibility................................................................................................................... 16 2.2
Metasploitable ..................................................................................................................... 16
2.3
Setting up your Windows XP SP2 .................................................................................... 16
Working with the NIST Image ................................................................................................... 17 Windows XP Post Install ............................................................................................................ 17 Setting Up Additional Services ................................................................................................. 17 Creating A Vulnerable Webapp ................................................................................................ 25 3.
Metasploit Fundamentals .......................................................................................................... 35 3.1
Msfcli ..................................................................................................................................... 35
Benefits of mscli .......................................................................................................................... 36 3.2
Msfweb ................................................................................................................................. 37
3.3
Msfconsole ........................................................................................................................... 37
Benefits......................................................................................................................................... 37 Launching..................................................................................................................................... 38 Help ............................................................................................................................................... 38 Tab Completion ........................................................................................................................... 39 3.4
Msfconsole Commands ..................................................................................................... 40
back .............................................................................................................................................. 40 2 / 457
check............................................................................................................................................. 40 connect ......................................................................................................................................... 41 irb .................................................................................................................................................. 41 jobs................................................................................................................................................ 42 load ............................................................................................................................................... 42 resource ....................................................................................................................................... 43 route .............................................................................................................................................. 44 info ................................................................................................................................................ 44 set.................................................................................................................................................. 45 sessions ....................................................................................................................................... 47 search ........................................................................................................................................... 48 show.............................................................................................................................................. 50 auxiliary ........................................................................................................................................ 51 exploits ......................................................................................................................................... 51 payloads ....................................................................................................................................... 52 encoders....................................................................................................................................... 54 nops .............................................................................................................................................. 55 setg ............................................................................................................................................... 55 use ................................................................................................................................................ 56 3.5
Exploits ................................................................................................................................. 56
Active Exploits ............................................................................................................................. 56 3.6
Using Exploits ...................................................................................................................... 58
Show ............................................................................................................................................. 58 3.7
Payloads............................................................................................................................... 60
Singles .......................................................................................................................................... 60 Stagers ......................................................................................................................................... 60 Stages........................................................................................................................................... 60 3.8
Payload Types..................................................................................................................... 60
Inline (Non Staged)..................................................................................................................... 60 Staged .......................................................................................................................................... 61 Meterpreter .................................................................................................................................. 61 iveX ...................................................................................................................................... 61 NoNX ............................................................................................................................................ 61 Ord ................................................................................................................................................ 61 IPv6 ............................................................................................................................................... 61 3 / 457
Reflective DLL injection ............................................................................................................. 61 3.9
Generating Payloads .......................................................................................................... 61
3.10
About the Metasploit Meterpreter ..................................................................................... 63
How Meterpreter Works ............................................................................................................. 63 Meterpreter Design Goals ......................................................................................................... 63 Adding Runtime Features .......................................................................................................... 64 3.11
Meterpreter Basics ............................................................................................................. 64
help ............................................................................................................................................... 64 background .................................................................................................................................. 64 ps ................................................................................................................................................... 64 migrate.......................................................................................................................................... 65 ls .................................................................................................................................................... 65 ...................................................................................................................................... 65 ........................................................................................................................................... 65 ipconfig ......................................................................................................................................... 66 getuid ............................................................................................................................................ 66 execute ......................................................................................................................................... 66 shell ............................................................................................................................................... 66 idletime ......................................................................................................................................... 66 hashdump .................................................................................................................................... 67 4.
Information Gathering ................................................................................................................ 68 4.1
The Dradis Framework ...................................................................................................... 68
4.2
Configuring Databases ...................................................................................................... 70
4.3
Port Scanning ...................................................................................................................... 70
4.4
Notes on Scanners and Auxiliary Modules ..................................................................... 73
Port Scanning .............................................................................................................................. 73 SMB Version Scanning .............................................................................................................. 74 Idle Scanning ............................................................................................................................... 75 4.5
Hunting For MSSQL ........................................................................................................... 77
4.6
Service Identification .......................................................................................................... 79
4.7
Sniffing ............................................................................................................... 81
4.8
Extending Psnuffle .............................................................................................................. 82
Module Location .......................................................................................................................... 82 Session definition ........................................................................................................................ 83 4.9
SNMP Sweeping ................................................................................................................. 83 4 / 457
4.10 5.
Writing Your Own Scanner ................................................................................................ 86
Vulnerability Scanning ............................................................................................................... 89 5.1
SMB Check ............................................................................................................... 89
5.2
VNC Authentication ............................................................................................................ 90
5.3
Open X11 ............................................................................................................................. 91
5.4
WMAP Web Scanner ......................................................................................................... 92
5.5
Working With NeXpose ...................................................................................................... 94
NeXpose from msfconsole ........................................................................................................ 97 5.6
Nessus Via Msfconsole ................................................................................................... 101
5.7
Using The Database......................................................................................................... 104
hosts ........................................................................................................................................... 104 6.
7.
Writing A Simple Fuzzer .......................................................................................................... 110 6.1
Simple TFTP Fuzzer ........................................................................................................ 110
6.2
Simple IMAP Fuzzer......................................................................................................... 112
Exploit Development ................................................................................................................ 116 7.1
Exploit Design Goals ........................................................................................................ 116
7.2
Exploit Format ................................................................................................................... 116
Exploit Skeleton ........................................................................................................................ 117 Defining Vulnerability Tests..................................................................................................... 117 Sample check() Method ........................................................................................................... 117 7.3
Exploit Mixins..................................................................................................................... 118
Exploit::Remote::T ................................................................................................................ 118 Exploit::Remote::DCERPC ...................................................................................................... 118 Exploit::Remote::SMB .............................................................................................................. 118 Exploit::Remote::BruteTargets................................................................................................ 119 7.4
Exploit Targets .................................................................................................................. 119
Target Options Block ................................................................................................................ 120 Accessing Target Information ................................................................................................. 120 Adding and Fixing Exploit Targets ......................................................................................... 120 7.5
Exploit Payloads ............................................................................................................... 121
Encoding Example .................................................................................................................... 121 Payload Block Options ............................................................................................................. 121 Making Something Go Boom .................................................................................................. 140 Getting A Shell .......................................................................................................................... 144 Using The Egghunter Mixin ..................................................................................................... 150 5 / 457
Completing The Exploit ............................................................................................................ 153 Porting Exploits ......................................................................................................................... 160 Client Side Exploits................................................................................................................... 166
8.
8.1
Binary Payloads ................................................................................................................ 166
8.2
Antivirus By ............................................................................................................... 169
8.3
Binary Linux Trojan........................................................................................................... 174
8.4
Java Applet Infection ........................................................................................................ 177
8.5
Client Side Attacks ........................................................................................................... 183
8.6
VBScript Infection Methods ............................................................................................. 188
MSF Post Exploitation .............................................................................................................. 191
9.
9.1
Privilege Escalation .......................................................................................................... 191
9.2
PSExec The Hash .................................................................................................. 192
9.3
Event Log Management................................................................................................... 195
9.4
Fun With Incognito ............................................................................................................ 198
9.5
Interacting With The Registry.......................................................................................... 201
Persistent Netcat Backdoor ..................................................................................................... 202 9.6
Enabling Remote Desktop............................................................................................... 205
9.7
Packet Sniffing .................................................................................................................. 206
packetrecorder .......................................................................................................................... 207 9.8
Pivoting ............................................................................................................................... 208
9.9
TimeStomp......................................................................................................................... 214
9.10
Screen Capture ................................................................................................................. 220
9.11
Searching For Content ..................................................................................................... 222
9.12
John The Ripper ............................................................................................................... 223 Meterpreter Scripting ............................................................................................................ 225
10. 10.1
Existing Scripts .................................................................................................................. 225
10.2
Writing Meterpreter Scripts.............................................................................................. 230
10.3
Custom Scripting............................................................................................................... 232
10.4
Useful API Calls ................................................................................................................ 236
10.5
Useful Functions ............................................................................................................... 238 Maintaining Access............................................................................................................... 243
11. 11.1
Keylogging ......................................................................................................................... 243
11.2
Persistent Meterpreter Service ....................................................................................... 245
11.3
Meterpreter Backdoor ...................................................................................................... 247
Interacting With Metsvc ........................................................................................................... 248 6 / 457
MSF Extended Usage .......................................................................................................... 251
12. 12.1
PHP Meterpreter ............................................................................................................... 251
12.2
Backdooring EXE Files .................................................................................................... 252
12.3
Browser Autopwn .............................................................................................................. 254
12.4
Karmetasploit..................................................................................................................... 257
Configuration ............................................................................................................................. 257 Karmetasploit In Action ............................................................................................................ 260 Attack Analysis .......................................................................................................................... 264 12.5
MSF vs OSX ...................................................................................................................... 270
12.6
File- Backdoors..................................................................................................... 272
12.7
Building A Module ............................................................................................................. 273
Payloads Through MSSQL...................................................................................................... 276 Creating Our Auxiliary Module ................................................................................................ 277 The Guts Behind It .................................................................................................................... 279 Beyond Metasploit ................................................................................................................ 282
13. 13.1
Armitage ............................................................................................................................. 282
Armitage Setup ......................................................................................................................... 282 Armitage Scanning ................................................................................................................... 283 Armitage Exploitation ............................................................................................................... 288 13.2
Social-Engineering Toolkit (SET) ................................................................................... 292
Getting Started with SET ......................................................................................................... 292 Menu Based Driving ................................................................................................................. 298 Spear-Phishing Attack Vector ................................................................................................. 302 Credential Harvester Attack .................................................................................................... 306 Tabnabbing Attack .................................................................................................................... 310 Man Left In The Middle Attack ................................................................................................ 312 Web Jacking Attack Method.................................................................................................... 313 Infectious Media Generator ..................................................................................................... 316 Teensy USB HID Attack .......................................................................................................... 318 SMS Spoofing Attack ............................................................................................................... 323 SET Automation ........................................................................................................................ 326 SET Web-Interface ................................................................................................................... 329 SET Module Development ...................................................................................................... 330 SET FAQ .................................................................................................................................... 333 13.3
Fast-Track .......................................................................................................................... 334 7 / 457
Fast Track Modes ..................................................................................................................... 335 Fast Track Updates .................................................................................................................. 337 Nmap Scripting Engine ............................................................................................................ 337 MSSQL Injection ....................................................................................................................... 339 MSSQL Bruter ........................................................................................................................... 343 Binary To Hex............................................................................................................................ 347 Mass-Client Attack .................................................................................................................... 348 SQL Pwnage ............................................................................................................................. 352 Payload Generator ................................................................................................................... 356 Module Reference ................................................................................................................ 359
14. 14.1
Auxiliary Modules .............................................................................................................. 359
HTTP Modules .............................................................................................................. 359 14.1.1
MSSQL Modules .......................................................................................... 360
14.1.2
MySQL Modules ........................................................................................... 363
14.1.3
Postgres Modules ......................................................................................... 366
14.1.4
DCERPC .................................................................................................................... 368
14.1.5
Discovery ................................................................................................................... 375
14.1.6
FTP ............................................................................................................................. 380
14.1.7
http .............................................................................................................................. 383
14.1.8
IMAP ........................................................................................................................... 403
14.1.9
MSSQL ....................................................................................................................... 404
14.1.10
MySQL .................................................................................................................... 407
14.1.11
POP3 ...................................................................................................................... 409
14.1.12
SMB ........................................................................................................................ 410
14.1.13
SMTP ...................................................................................................................... 422
14.1.14
SNMP ..................................................................................................................... 424
14.1.15
SSH ......................................................................................................................... 429
14.1.16
Telnet ...................................................................................................................... 431
14.1.17
TFTP ....................................................................................................................... 434
14.1.18
VNC......................................................................................................................... 435
14.2
Server Capture Modules .................................................................................................. 437
14.2.1
ftp................................................................................................................................. 437
14.2.2
http_ntlm..................................................................................................................... 438
14.2.3
imap ............................................................................................................................ 439
14.2.4
pop3 ............................................................................................................................ 440 8 / 457
14.2.5 14.3
smb ............................................................................................................................. 441
Post Modules ..................................................................................................................... 442
14.3.1
Multiple OS Post Gather Modules .......................................................................... 442
14.3.2
Windows Post Capture Modules ............................................................................ 444
14.3.3
Windows Post Gather Modules .............................................................................. 445
14.3.4
Windows Post Manage Modules ............................................................................ 450
14.3.5
Linux Post Gather Modules ..................................................................................... 453
9 / 457
1. Introduction “If I had eight hours to chop down a tree, I’d spend the first six of them sharpening my axe.”
-Abraham Lincoln
This saying has followed me for many years, and is a constant reminder to me that approaching a problem with the right set of tools is imperative for success. So what does this semi philosophical opening have to do with the Metasploit Framework? Before approaching a penetration test or an audit, I take care to “sharpen my tools” and update anything updatable in BackTrack. This includes a short chain reaction, which always starts with a prompt “msfupdate” of the Metasploit framework. I consider the MSF to be one of the single most useful auditing tools freely available to security professionals today. From a wide array of commercial grade exploits and an extensive exploit development environment, all the way to network information gathering tools and web vulnerability plugins. The Metasploit Framework provides a truly impressive work environment. The MSF is far more than just a collection of exploits, it's an infrastructure that you can build upon and utilize for your custom needs. This allows you to concentrate on your unique environment, and not have to reinvent the wheel. This course has be written in a manner to encom not just the front end "" aspects of the framework, but rather give you an introduction to the capabilities that Metasploit provides. We aim to give you an in depth look into the many features of the MSF, and provide you with the skill and confidence to utilize this amazing tool to its utmost capabilities. We will attempt to keep this course up to date with all new and exciting Metasploit features as they are added.
10 / 457
A degree of prerequisite knowledge is expected and required of students before the content provided in this course will be useful. If you find you are unfamiliar with a certain topic, we recommend you spend time engaging in self research on the problem before attempting the module. There is nothing more satisfying than solving problems yourself, so we we highly encourage you to Try Harder™
1.1
Filesystem And Libraries
The MSF filesystem is laid out in an intuitive manner and is organized by directory.
data: editable files used by Metasploit documentation: provides documentation for the framework external: source code and third-party libraries lib: the 'meat' of the framework code base modules: the actual MSF modules plugins: plugins that can be loaded at run-time scripts: Meterpreter and other scripts tools: various useful command-line utilities
Libraries Rex The basic library for most tasks Handles sockets, protocols, text transformations, and others SSL, SMB, HTTP, XOR, Base64, Unicode Msf::Core Provides the 'basic' API Defines the Metasploit Framework Msf::Base Provides the 'friendly' API Provides simplified APIs for use in the Framework
1.2
Modules And Locations
Metasploit, as presented to the , is composed of modules. Exploits
Defined as modules that use payloads An exploit without a payload is an Auxiliary module
Payloads, Encoders, Nops Payloads consist of code that runs remotely Encoders ensure that payloads make it to their destination Nops keep the payload sizes consistent.
11 / 457
Modules Locations Primary Module Tree Located under /opt/framework/msf3/modules/ -Specified Module Tree Located under ~/.msf4/modules/ This location is ideal for private module sets Loading Additional Trees at Runtime the -m option when running msfconsole (msfconsole -m) Use the loadpath command within msfconsole
1.3
Metasploit Object Model
In the Metasploit Framework, all modules are Ruby classes.
Modules inherit from the type-specific class The type-specific class inherits from the Msf::Module class There is a shared common API between modules
Payloads are slightly different.
Payloads are created at runtime from various components Glue together stagers with stages
1.4
Mixins And Plugins
A quick diversion into Ruby.
Every Class only has one parent A class may include many Modules Modules can add new methods Modules can overload old methods Metasploit modules inherit Msf::Module and include mixins to add features.
Metasploit Mixins Mixins are quite simply, the reason why Ruby rocks.
Mixins 'include' one class into another This is both different and similar to inheritance Mixins can override a class' methods
Mixins can add new features and allows modules to have different 'flavors'.
Protocol-specific (ie: HTTP, SMB) Behavior-specific (ie: brute force) connect() is implemented by the T mixin connect() is then overloaded by FTP, SMB, and others.
Mixins can change behavior.
The Scanner mixin overloads run() Scanner changes run() for run_host() and run_range() 12 / 457
It calls these in parallel based on the THREADS setting The BruteForce mixin is similar
class MyParent def woof puts “woof!” end end class MyClass < MyParent end object = MyClass.new object.woof() => “woof!” ================================================================ module MyMixin def woof puts “hijacked the woof method!” end end class MyBetterClass < MyClass include MyMixin end
Metasploit Plugins Plugins work directly with the API.
They manipulate the framework as a whole Plugins hook into the event subsystem They automate specific tasks which would be tedious to do manually
Plugins only work in the msfconsole.
Plugins can add new console commands They extend the overall Framework functionality
13 / 457
2.
Required Materials
It should come as no surprise that the majority of exploits available in the Metasploit Framework are targeted against Microsoft Windows, so in order to complete the course labs you will require a target system to attack. This system should consist of a Virtual Machine running on your choice of host operating system. While VMware Converter and VMware Player are "free", you will have to for the s. However, the virtualization applications and appliances are well worth the registration if you're not already a current member. You may also use VMware Workstation or other implementations of Virtual Infrastructure. In addition to VMware, there is also VirtualBox which can be ed for free at https://www.virtualbox.org/wiki/s This course was created using the latest svn trunk version of the Metasploit Framework which, at the time of this writing is version 4.2.0-dev. If you are using back|track 5 as your platform, you can always update to the latest version of the trunk by issuing the "msfupdate" command.
2.1
Hardware Prerequisites
Before we dive into the wonderful world of the Metasploit Framework we need to ensure our hardware will meet or exceed some requirements before we proceed. This will help eliminate many problems before they arise later in this document. All values listed are estimated or recommended. You can get away with less although performance will suffer. Some of the hardware requirements that should be considered are:
Hard Drive Space Available Memory Processors Capabilities Inter/Intra-net Access
Hard Drive Space This will be the most taxing hurdle to overcome. Be creative if you might have some storage space constraints. This process can consume almost 20 gigabytes of Storage space, so be forewarned. This means we can not use a FAT32 partition since it does not large files. Choose NTFS, ext3 or some other format. The recommended amount of space needed is 40 gigabytes. 730000000 696MB 730000000 696MB 730000000 696MB 730000000 696MB 730000000 696MB 272792685 260MB total -------3740MB
//z01 //z02 //z03 //z04 //z05 //zip
file file file file file file
size size size size size size
on on on on on on
disk disk disk disk disk disk
//Total space before decompression and extraction
14 / 457
5959506432 5700MB 20401094656 19456MB total -------28896MB 8589934592 8192MB total -------37088MB 123290094 112MB 377487360 360MB 101075736 97MB 157286400 150MB total -------37807MB
//Extracted image file size on disk //Per Converted FDCC VM on disk
//Optional Backtrack "GUEST" HDD Requirement's
//VMware-converter-4.0.1-161434.tar.gz //VMware Converter installed on disk //VMware-Player-2.5.3-185404.i386.bundle //VMware Player Installed on disk //See how fast it gets consumed!
If you decided to produce clones or snapshots as you progress through this course, these will also take up valuable space on your system. Be vigilant and do not be afraid to reclaim space as needed. Available Memory Without supplying enough memory to your HOST and GUEST operating systems you will eventually cause system failure. You are going to require RAM for your host OS as well as the equivalent amount of RAM that you are dedicating for each virtual machine. Use the guide below to aid you in deciding the amount of RAM needed for your situation. Linux "HOST" Minimal Memory Requirement's 1GB of system memory (RAM) Realistically 2GB or more Per Windows "GUEST" Minimal Memory Requirement's At least 256 megabytes (MB) of RAM (1GB is recommended) // more never hurts! Realistically 1GB or more with a SWAP file of equal value (Optional) Backtrack "GUEST" Minimal Memory Requirement's AT least 512 megabytes (MB) of RAM (1GB is recommended) // more never hurts! Realistically 1GB or more with a SWAP file of equal value
Processor Processor Speed is always a problem with dated hardware although old hardware can be utilized in other fashions to serve a better purpose. The bare-minimum requirement for VMware Player is a 400MHz or faster processor (500MHz recommended). The more horsepower you can throw at it, of course, the better.
15 / 457
Internet Accessibility This can be solved with a cat5 cable from your router/switch/hub. If there is no DH server on your network you will have to assign static IP addresses to your GUEST VM's. A wireless network connection can work just as well as an Ethernet cable, however, the signal degradation over distance, through objects, and structures will severely limit your connectivity.
2.2 Metasploitable One of the problems you encounter when learning how to use an exploitation framework is trying to configure targets to scan and attack. Luckily, the Metasploit team is aware of this and released a vulnerable VMware virtual machine called 'Metasploitable'. This VM has a number of vulnerable services and packages installed for you to hone your skills on. The VM will run on any recent VMware product and is configured with a non-persistent disk so any potential damage you do to the system will be reverted on reboot. You can the torrent file of Metasploitable fromhttp://updates.metasploit.com/data/Metasploitable.zip.torrent. Once you have ed the VM, extract the zip file, open up the vmx file using your VMware product of choice, and power it on. After a brief time, the system will be booted and ready for action.
For more information on the VM configuration, there is a ree.txt file but beware...there are spoilers in it. 2.3 Setting up your Windows XP SP2 In order to get the most benefit from the information in this course, you will require access to an installation of Windows XP SP2 to test against. It is highly recommended that you set up a virtual machine using a product such as VirtualBox, VirtualPC, or the free VMware Server.
16 / 457
If you don't happen to have an old WinXP CD lying around, you can try to the Federal Desktop Core Configuration (FDCC) image from NIST. If you choose this route, you will need to remove all of the patches that are installed in the VM. Working with the NIST Image Recommended for extracting and running the NIST FDCC Image is Winrar (which also runs under Wine) and Virtual Box. The name / scheme for the Image is: Renamed_ / P@ssw0rd123456 Windows XP Post Install 1. Go into the Control and select "Switch to Classic View" on the left-hand side. 2. Open "Windows Firewall" and turn it "Off". 3. Open "Automatic Updates" and select "Turn off Automatic Updates" so Windows doesn't undo our changes for us. 4. Open "Security Center", select "Change the way Security Center alerts me" on the left-hand side and de-select all of the checkboxes. This will disable the annoying system tray pop-up notifications. 5. Back in the Control , open "Add or Remove Programs". Select the "Show updates" checkbox at the top. This will display all of the software and security updates that have been installed. 6. Still in the Control , from the toolbar, select "Tools", then "Folder Options". Select the "View" tab and scroll all the way to the bottom. Make sure you un-check the box next to "Use simple file sharing" and click "OK".
Setting Up Additional Services In order to provide a larger attack surface for the various components of Metasploit, we will enable and install some additional services within our Windows virtual machine. Bear in mind that you will require the Windows XP installation CD or iso in order to install additional services in the VM. Internet Information Services (IIS) and Simple Network Management Protocol (SNMP) To begin, navigate to the Control and open "Add or Remove Programs". Select "Add/Remove Windows Components"on the left-hand side.
17 / 457
Select the "Internet Information Services (IIS)" checkbox and click "Details". Select the "File Transfer Protocol (FTP) Service"checkbox and click "OK". By default, the installed IIS FTP service allows for anonymous connections.
18 / 457
Lastly, select the "Management and Monitoring Tools" checkbox and click "Details". Ensure that both options are selected and click "OK". When all is ready, click "Next" to proceed with the installation of IIS and SNMP.
There is an issue with the .NET Framework installed in the NIST virtual machine but it is easily fixed. In the Control , select "Add or Remove Programs" again, select "Microsoft .NET Framework 2.0 Service Pack 1", and click "Change".
19 / 457
A progress window will pop up and a progress bar will be displayed and then it will close. This is normal behavior and you can now exit the Control and proceed.
SQL Server 2005 Express We will also perform an installation of Microsoft's free SQL Server 2005 Express. This will allow us to use some of the different SQL modules in Metasploit. First, the nonservice pack version of SQL Server Express Note that if you are using your own custom-built VM for this course, you will need to install the Windows Installer 3.1 and the .Net Framework 2.0 in order to install SQL Express. Windows Installer 3.1 .NET Framework 2.0 Once the installer has finished ing, we can run it and select all of the defaults 20 / 457
except for "Authentication Mode". Select "Mixed Mode", set an "sa" of "1", and then continue on with the rest of the installation.
Once the installation is complete, we will need to make it accessible on our network. Click "Start" -> "All Programs" ->"Microsoft SQL Server 2005" -> "Configuration Tools" -> "SQL Server Configuration Manager". When the Configuration Manager starts up, select "SQL Server 2005 Services", right-click "SQL Server (SQL EXPRESS)" and select "Stop". Next, expand "SQL Server 2005 Network Configuration" and select "Protocols for SQLEXPRESS".
21 / 457
Double-click "T/IP", change "Enabled" to "Yes", and change "Listen All" to "No" on the "Protocol" tab.
22 / 457
Next, select the "IP Addresses" tab, and remove any entries under "IPAll". Under "IP1" and "IP2", remove any values for"Dynamic Ports". Both IP1 and IP2 should have "Active" and "Enabled" set to "Yes". Lastly, set the IP1 "IP Address" to your local address and set the IP2 address to 127.0.0.1. Your settings should look similar to the screenshot below. Click "OK"when everything is set correctly.
Next, we'll enable the SQL Server Browser service. Select "SQL Server 2005 Services" and double-click "SQL Server Browser". On the "Service" tab, set the "Start Mode" to "Automatic" and click "OK".
23 / 457
By default, the SQL server runs under a limited-privilege which breaks a lot of custom web applications. We will change this by double-clicking "SQL Server (SQLEXPRESS)" and setting it to Log On as the Built-in "Local System". This can also be set by running "services.msc". Click "OK" when you've finished.
With everything finally configured, right-click "SQL Server (SQL EXPRESS)" and select "Start". Do the same for the "SQL Server Browser" service. You can now exit the Configuration Manager and that the services are listening properly by running "netstat -ano" from a command prompt. You should see UDP port 1434 listening as well as your network IP address listening on port 1433.
24 / 457
Creating A Vulnerable Webapp In order to create our vulnerable web app, you will need to Server Management Studio Express. Install SQL Server Managment Studio Express, accepting all of the defaults for the installation then run it via "Start" -> "All Programs" -> "Microsoft SQL Server 2005" > "SQL Server Management Studio Express". When Management Studio starts up, select "SQL Server Authentication" and connect using the name "sa" and of "1". Right-click "Databases" in the "Object Explorer" and select "New Database".
25 / 457
Enter "WebApp" for the database name and click "OK". In the "Object Explorer", expand "Databases", and expand the"WebApp" database. Right-click "Tables" and select "New Table".
Create a new table named "s" with the column names and types as shown below.
Save the "s" table, right-click it and select "Open Table".
Enter in some sample data into the table and save all of your work.
26 / 457
Under the main "Object Explorer" tree, expand "Security", then "s". Rightclick "s" and select "New ".
In the " - New" window, select "Search", enter "aspnet" and click "Check Names". Click "OK" but keep the " - New" window open.
Click on properties for ASPNET, and ensure that under mapping the has db_owner and public rights to the WebApp database.
27 / 457
Next, we need to create our website to interact with the back-end database we created. Start Notepad and paste the following code into a new document. Save this file as "C:\Inetpub\wwwroot\Default.aspx". <%@ Page Language="C#" AutoEventWireup="true" ValidateRequest="false" CodeFile="Default.aspx.cs" Inherits="_Default" %> <%--the ValidateRequest="true" in the page directive will check for <script> and other potentially dangerous inputs--%>