2KKUU7ita

Figure 11-11:
Exploitable
vulnerability
found by
Qualys-
Guard.
Chapter 11: Windows
Before you go ’sploitin’ vulnerabilities with Metasploit, it’s very important to
know that you’re venturing into sensitive territory. Not only can you gain full,
unauthorized access to sensitive systems, but you can also put the systems
being tested into a state where they can hang or reboot. So, read each
exploit’s documentation and proceed with caution.
Before you can exploit a missing patch or related vulnerability, you have to
find out what’s available for exploitation. The best way to go about doing this
is to use a tool such as QualysGuard or LanGuard to find them. I’ve found
QualysGuard to be very good at rooting out such vulnerabilities even as an
unauthenticated user on the network. Figure 11-11 shows QualysGuard scan
results of a Windows server system that has the nasty Windows Plug and
Play Remote Code Execution vulnerability that I still see quite often.
Using Metasploit
After you find a vulnerability, the next step is to exploit it. In this example, I
use Metasploit (an open source tool owned by Rapid7) and obtain a remote
command prompt on the vulnerable server. Here’s how:
217