PentesterAcademy Vulnerable Servers II Lab Write-Up | metasploit-pivoting Lab Link : https://attackdefense.pentesteracademy.com/challengedetails?cid=1747 Vulnerable Servers II is a lab from PentesterAcademy, which is rated as easy. The lab topology shows two machines which means, there are two targets and the attacker has to perform pivoting in order to hack and get the flag from the target machine. First Select the nearest Server and Click on Run the lab. Once the lab is up, a web based terminal will be opened in the Web Browser. Firstly, check the IP address of the attacking machine. We can see that, there are two interfaces. And as per the instructions, the first target machine should be 192.17.147.3. Let’s perform an Nmap scan of the target. The scan result shows that TCP port 8080 is open and is running an Apache Tomcat webserver/Coyote JSP engine 1.1. Let’s try to connect the webserver using netcat. We can see that the Webserver is running OpenKM, a Document
Netcat is one of the most powerful and useful tool for testing and debugging the network and protocol connectivity.
Though administrators use this tool for troubleshooting, the attackers can use this for malicious intentions such as establishing a backdoor connectivity, transferring files, scanning ports etc.
Netcat can act as in client-server mode as well. This tool is available for both Windows and Linux.
Lets go through the five most common usage of netcat commands.
1) Check whether the port is Open.
For checking TCP ports :-
#nc -v <IP or Domain name> <port number>
Eg: nc -v www.jaacostan.com 80
For checking UDP ports:-
#nc -vu www.jaacostan.com 53 //where "u" in "-uv" represents UDP.
2) For doing Port Scans
#nc -vzu <IP or Website> <port range>
eg: #nc -vz www.jaacostan.com 100-200
for scanning the opened UDP ports,
#nc -vzu www.jaacostan.com 100-200 //where "u" in "-uzv" represents UDP.
3) Netcat as aClient Server.
Once netcat is installed on a system whose IP is 192.168.1.10,
#nc -l 4444 // executing this command will open up a port listening on 4444.
from another machine, establish a connection with the server.
#nc 192.168.1.10 4444.
4) Transfer a file.
On the server, open a port 4444.
#nc -l 4444 > output // any data receives on this port will be saved on file called named as "output"
In the client, create a sample file. here i created "jaa".
From the client, send the contents of file "jaa".
#cat jaa | nc 192.168.1.1 4444 //Transfer the contents of the file "jaa" to the server.
5) Bind a program to a port and access it.
Bind a program, here CMD to the port number 4444.
#nc -nlvp 4444 -e cmd.exe
establish a connection with the server on port 4444.
#nc -nv 192.168.1.10 4444
This will open up a CMD prompt of server from the client machine.
Though administrators use this tool for troubleshooting, the attackers can use this for malicious intentions such as establishing a backdoor connectivity, transferring files, scanning ports etc.
Netcat can act as in client-server mode as well. This tool is available for both Windows and Linux.
Lets go through the five most common usage of netcat commands.
1) Check whether the port is Open.
For checking TCP ports :-
#nc -v <IP or Domain name> <port number>
Eg: nc -v www.jaacostan.com 80
For checking UDP ports:-
#nc -vu www.jaacostan.com 53 //where "u" in "-uv" represents UDP.
2) For doing Port Scans
#nc -vzu <IP or Website> <port range>
eg: #nc -vz www.jaacostan.com 100-200
for scanning the opened UDP ports,
#nc -vzu www.jaacostan.com 100-200 //where "u" in "-uzv" represents UDP.
3) Netcat as aClient Server.
Once netcat is installed on a system whose IP is 192.168.1.10,
#nc -l 4444 // executing this command will open up a port listening on 4444.
from another machine, establish a connection with the server.
#nc 192.168.1.10 4444.
4) Transfer a file.
On the server, open a port 4444.
#nc -l 4444 > output // any data receives on this port will be saved on file called named as "output"
In the client, create a sample file. here i created "jaa".
From the client, send the contents of file "jaa".
#cat jaa | nc 192.168.1.1 4444 //Transfer the contents of the file "jaa" to the server.
5) Bind a program to a port and access it.
Bind a program, here CMD to the port number 4444.
#nc -nlvp 4444 -e cmd.exe
establish a connection with the server on port 4444.
#nc -nv 192.168.1.10 4444
This will open up a CMD prompt of server from the client machine.