Armitage Kali Linux Tutorial - Scanning & Exploitation Video Lecture | Get to know Ethical Hacking (English) - Software Development

hello and welcome to this video in this
video we're gonna be exploring armitage
all right so we're actually gonna be
performing exploits on our vulnerable
operating system which in this case is
Metasploit able to so I hope you're
really excited so you might be asking
yourself what exactly is Armitage
well Armitage is simply the graphical
user interface for Metasploit alright so
the way you have nmap and Xen map and
map being at the command line interface
and that you have your Zen map which is
the graphical user interface that is the
same way so you have your Metasploit
console and Armitage so Armitage is the
graphical user interface for Metasploit
alright so some of the advantages are it
gives the user much better idea of
what's going on so great ease of access
and the user is able to understand the
scan process and how everything is being
exploited and you just give the user
graphical representation of the scan and
the exploitation technique alright so
let's get started now by default
Metasploit are sorry Armitage can be
found on the dock on candida X so if you
just go to this little green head
creature icon I'm not sure if that is
what it is but irregardless of that as
you can see it is Armitage or if you do
not have it on your dock you can just go
into applications and you can go into
exploitation tools and you'll find
Armitage there alright so just click on
Armitage and now it's gonna prompt you
to connect to the local host in a few
seconds just give it a few seconds to
start up and there we are it's gonna
prompt you to connect to the local host
and the port just hit connect do not
change anything here and once you hit
connect it's gonna prompt you to start
the Metasploit RPC server so just hit
yes we want to do that and now it's
gonna start connecting to the remote
host and just give it a few seconds and
we should be good with Armitage alright
so the great thing about Armitage as I
said is that the exploitation is is then
the exploitation process is automated as
well as you know the the setting of
hosts the setting of targets but you
know vulnerability and
you know it also offers sort of you know
functionality like that and we'll be
looking at this when we'll be exploiting
um our our met exploitable to virtual
machine alright so as you can see
Armitage's loaded up and you might be a
bit confused with the interface because
you heard me tell you that it was a
graphical user interface and now you're
seeing a Metasploit console here well
don't worry about that the Metasploit
console there is is there to aid you in
what what exactly is going on alright so
the first thing I'm gonna start with is
I'm going to start with this little
toolbar up here this little toolbar is
very very simply put
so in Armitage you can you can change
settings like add a new connection you
can check the preferences you can set
the target few setters you can set the
targets you set the exploit rank you can
use a socks proxy like we did in the
proxy gains video we can look at the
listeners so you can connect to or wait
for you can set the L host the listening
host if you want another listening house
for example if you're running Kali Linux
on another computer and you want that
computer to also listen to you you also
have your scripts and you can close our
message in terms of the view this is
just to edit the view when we look at
hosts you can add your hosts so for
example we'll add our Metasploit able to
virtual machine here but we'll do that
in a few seconds we have n map scans
which is awesome you can automate in map
scans directly from Armitage you then
have your Metasploit scans which is
awesome
we then have your dns enumeration which
we looked at in the information
gathering section I hope you remember so
everything can come together really
really beautifully and that's why I
really enjoy using Armitage and you I'm
sure you'll see why all right you can
then clear your database which is
essentially just clearing yeah you know
any of the left over scans that you had
performed or exploits
that you had performed you then have
your attacks where you can find the tax
on your target or your host or and you
have Hail Mary which is something we'll
look at in a few minutes okay looking at
the workspaces you can manage and show
all your all your the workspaces you
currently have terms of help you have
your homepage your tutorial scripts and
your board section all right fantastic
now let's get into the interface so the
interface is sorted
into three sections all right you have
your your first section your second
section and your third section all right
so you can enlarge them and resize them
depending on how you want them to be
displayed so I usually like having mine
like this because I like having to see
what the console at this place but as
much as I like that I will be looking at
the first section here in the first
section essentially what is being
displayed here is your pre-configured
modules all right so you can also search
for modules here you know in this little
search bar so this is where you have all
the modules sorted in terms of auxilary
exploits payloads and the post which
we'll look at in a few seconds when it
comes to the second the second interface
here the second interface is used to
display your active targets that we were
able to exploit against alright so this
is where all your active targets will be
displayed in forms of computers we'll
look at that again when we'll get
started with Metasploit able to and for
the console this is your Metasploit
console and it'll be well your activity
will be sorted in forms of tabs here
again you look at exactly how that
happens and essentially allows you to
run your meterpreter or your console
sessions are simultaneously something
really really awesome and I'm sure
you'll appreciate it okay let's get
started with your module section so as I
said your modules essentially contain
your all your modules in this section
and they're sorted in terms of auxilary
exploits payloads and post and you can
go through them so for example we have
auxilary you can look at the auxilary
scanners you have your scanners fuzzers
you know your sniffers puffers etc etc
you have your exploits where you exploit
the sword in terms of their platform
that they're running on an operating
system that they are running on for
example you have Android Apple iOS
Firefox freebsd linux unix Mac OS X and
Windows you then have your play payloads
that are also sorted in terms of their
platforms and the operating systems that
they're currently that they are to be
exploited on all right you then have
your post which is also similarly sorted
in terms of their their platforms and
the operating systems that they are
designed to be exploited on so let me
just close every one of this and
as I said you can also use these search
the search bar here to search for the
Metasploit
modules alright now let's get started
with some actual exploitation and we're
gonna start off with Metasploit vault -
alright so what we're gonna do is we're
gonna go into hosts all right now in
hosts you can import hosts or you can
add hosts we're not gonna add a host yet
and the reason is I'm going to use an
nmap scan to also perform some
information gathering while adding the
hosts so what I'm gonna do is I'm just
gonna go into nmap scan and I want to
perform a quick scan and that will
detect the operating system that is
running on our target or or our host for
that matter so I'm gonna click on that
and now it's gonna prompt you to enter
your host IP address or your target IP
address or the range if you want to scan
your entire network in this case what
I'm gonna do is I'm just gonna get the
IP address format exploitable - which as
you can see here is 192.168.1.1 or 6 so
I just gonna enter that right now
excellent so once we hit enter it's
going to perform the nmap scan and it's
gonna detect what operating system is
running now as I said here the
activities are going to be sorted out in
terms of tabs so your console is still
open and your nmap scan is still ongoing
here or it's a it's just started and you
can run them both simultaneously which
is fantastic right so the scan is done
and it should give you a prompt here
saying the scan is complete
voila so it's gonna give you an option
here saying use attacks find attacks to
suggest applicable exploits for your
targets interesting so I'm gonna hit OK
and what do we have here well we have a
little cute little penguin here to
represent Linux so we know it is running
a linux 2.6 and the kernel is not
specified more than that all right so
you know you can see the services and
the ports that are the ports and the
services running on these posts with the
nmap scan so we were able to get
information about our target and now we
understand what operating system is
running on it and we can see these
services running on the ports in the
previous video we looked at exploiting
the FTP protocol or the FTP port with
the FDF the vs FTP D backdoor
and how did we do that all right the
first thing we did is we know that it
exists as an exploit so we're going to
go into our modules and I'm going to
show you exactly how to find it so we're
going to go into exploits and we are
gonna go into UNIX because it is a UNIX
it is a UNIX exploit and once I click
into UNIX we're gonna then select the
protocol which in this case is the FTP
protocol right here and we're going to
expand that and voila you have your sv
SFTP T 2.3.4 backdoor so if you want to
if you want to execute this what we do
is we just double click it alright and
once we double click it is going to give
you the options that we used in the
previous or we used in the Metasploit
console options like setting your our
host and the our port so by default the
L host which is you're listening host
which is your IP address with default is
set by default so 192 point one sixty
point one point 107 and the default
listening port is also set by default
all you have to do is just enter your
host which in this case is 192 point one
sixty point one point 106 and we will
exploit the backdoor using the FTP
service so 192 point one sixty eight
point one point 106 and once you're
ready you can just hit launch
alright and it's gonna launch the
exploit so just give it a few seconds
and it's gonna open up a new tab over
here the exploit tab just give it a few
seconds here and there we are found
shell command shell open and voila we
have backdoor access now you might have
noticed something also very very
interesting the linux computer here is
now surrounded by lightning or
electricity and is turn red now this
means that we have successfully
exploited this system in one way or
another right so this is fantastic
everything is automated really really
well but now you might be asking i want
to exploit more things with Metasploit
about what can i do now
alright you tell me what I can do so
what we're gonna do is we're gonna close
up this menu here and what in the
awesome thing as I said is the
automation but before that I'm just
gonna well if I look at the shell that's
running if I right click sorry about
that for a click on the target we can
see that it gives us options to log in
to the default network search
now that is something just you know very
very common once you have cracked them
if if the cracking process is possible
you can then log into things like the
FTP protocol the HTTP MySQL SSH you get
the idea now the shell that we created
which is what we exploit that we used
allows us to interact with it we can
then upload we can pass this session we
can post modules and we can disconnect
so let's say we wanted to interact with
it so if we want it to interact with it
it's gonna open up a shell for us and
again we can list the files on the
server the Metasploit able to you know
virtual machine which is considered to
be a server because it does run some web
applications and voila you have access
to the root folder so let's see if we
change directory to the home directory
and we list the files in there we have
the MSF admin so let's also change
directory into that MSF admin and we can
list the files in there we have the
Wonderbolts OCD vulnerable
whoopsie D vulnerable C D vulnerable and
if you list there we have the we have
the the web services that are running so
you have MySQL the samba Tiki Wicki etc
etc so I'm just gonna close the shell
because we are done with that exploit
let's look at how to exploit or how to
find exploits automatically now so I'm
going to close that show and I'm just
gonna right click and I'm going to go to
the shell 1 and I'm gonna disconnect
because we are done with that exploit
right so once it's disconnected it's
gonna remove the little icon that
denoted the fact that the operating
system of the computer was was exploited
now you might be asking well how do we
you know how we exploit it automatically
or how do we find exploits automatically
well we go into attacks and we find
attacks all right so now it's gonna find
attacks that you can run on the
operating system or oil the computer in
this case our our target host which is
the Metasploit above to virtual machine
so as you can see it's gonna it's gonna
query the exploits and just give it a
few seconds to go through all of them
and what it's done it's gonna give you
all a list of the compatible exploits
that you can use or exploits that can
actually exploit a vulnerability
on your on your on the operating system
or the target that you've chosen so if
we right-click now and we go into attack
you can see that is listed all these
services that we can crack so if we go
to FTP the vs FTP D backdoor here we
have the pure FTP bash execution here
you can also check for exploits again
you have your telnet you have your HTTP
vulnerabilities so these are all
vulnerability or exploits that you can
run on this virtual machine so if we go
to for example something like the web
app we can or let's let's get something
more practical sorry about that if they
go into the MySQL so we are only have
one exploit for the MySQL database so if
we click on this payload if we load it
and let's see if everything is set
correctly we are host we are Osteria but
that's okay so it is going to launch or
let's see if we can get any information
right so it's gonna start the exploit in
a new tab I'm just gonna close the old
tab so it's gonna start the exploit
process yes give it a few seconds here
and there we are is going through a
process for some reason the MySQL
function system execution is not
available so yeah this exploit did not
work now this is what I was talking
about no it is going to work
[Music]