The Metasploit Framework exploit
The Metasploit Framework was used to commence a reverse shell attack on an Ubuntu server. Additional reconnaissance was performed on the webserver in order to obtain critical information that is necessary for the exploit. A reverse shell attack allows the attacking system to send remote commands to the target system. Further post-exploitation tools that are built into The Metasploit Framework can be used to intrude deeper into the systems.
Reconnaissance
A webserver at the IP address 192.168.10.10 was already found in previous attacks. More nmap commands, targeting the webserver, were issued from the Kali Linux system. Additional flags were used in an attempt to obtain more information on the target system.
The -O flag displayed information regarding the operating system on the target. It was found that the host is running Linux version 4.X or 5.X.
The -sV flag was used to discover the running services version numbers. A service called Very Secure File Transfer Protocol Daemon (VSFTPD) version 2.3.4 was found running on the server.
Demonstration
Searching for VSFTPD in The Metasploit Framework console revealed a backdoor that can be exploited in version 2.3.4. The same version that was discovered running on the webserver.
The use 0 command was issued to mount the exploit. Next, the RHOST option was set to 192.168.10.10.
Once the target was set, the run command was used to start the exploit. A connection was made to the FTP server and the vulnerability was taken advantage of. The output showed a backdoor being created along with a session being found. The exploit was successful in creating a reverse shell on the Ubuntu webserver.
Commands were issued via The Metasploit Framework console on the Kali Linux system. The uname -a command confirms the reverse shell attack was successful by displaying Linux 4.15.0. Other commands such as ls and whoami were issued to further confirm the shell was opened on the remote system.