3

I am trying to learn about security and penetration testing. So far I've learned how to work with Metasploit (MSFconsole) and nmap (db_nmap).

I am using 2 VMs, one with Kali and the second with Debian server.

After running nmap on the server I got these results:

enter image description here

So, I tried to find an exploit for these services, without result. I searched in the auxiliary/scanner folder and also in the exploit folder and found nothing. I searched CVEdetails for these exposed HTTP services and I found this.

There exist many exploits for the HTTP service, So my questions are:

  1. How can I exploit this service, How should I select the specific exploit and payload to use?

  2. How do you recommend continuing the penetration test?

Improve this question
4
  • 1
    Did you try "searchsploit" in the console? Maybe searchsploit Apache 2.2, searchsploit OpenLDAP 2, searchsploit OpenSSH 5.5, and so on. You can get more specific if you get too many results. For some, you may be looking for local exploits, or remote. You can also exclude Denial of Service exploits by appending | grep -v '/dos/' at the end of the searchsploit command.
    – Mark Buffalo
    Aug 13, 2017 at 16:26
  • Hi @MarkBuffalo Thanks a lot, from where you got this function? I didn't found it in the help.
    – Aby W
    Aug 14, 2017 at 7:57
  • and with the tab key also not appear. I found some exploits but using "searchsploit -p exploit_title" I got "could not find exploit EDB-id num", I'm using the free version from kali, maybe this is the reason why is not working?
    – Aby W
    Aug 14, 2017 at 8:12
  • I don't understand what you're saying, but it may not even have a known exploit. You may simply need to visit hxxp://192.168.43.77 and look at the page, running dirbuster, gobuster, nikto, nmap, etc., against it, and then exploit the web app. Searchsploit is free, by the way.
    – Mark Buffalo
    Aug 15, 2017 at 0:45

1 Answer 1

Reset to default
3

Well, the server you're scanning, is it a package made to contain known vulnerabilities? Because looking at the versions of the services, I don't see anything vulnerable standing out... The fact that you have a lot of vulnerabilities for apache http does not mean that the particular version of apache httpd that you have there is vulnerable.

A good place to check what vulnerabilities exist for a specific version of an application is https://www.cvedetails.com.

Edit: The cvedetails link shows a number of low-risk vulnerabilities, none of which are proven to provide arbitrary code execution.

Improve this answer
2
  • Hey you can look the link on the question,
    – Aby W
    Aug 14, 2017 at 10:44
  • Thanks, Do you have any example from cvedetails which show the vulns?
    – Aby W
    Aug 29, 2017 at 8:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .