5

Nessus is a vulnerability scanner, it's job is to find what vulnerabilities may be present in a target system. It does not actually perform the attack itself (except by accident if it were to accidentally DOS the target with an unsafe check). Instead you should use to the results of the Nessus scan to use other tools, like Metasploit to perform the attack


5

If you have root on the server (or any kind of shell access), generate a payload on Metasploit, copy it to the server, and execute. You don't turn telnet into meterpreter, you start another connection.


4

If you run Metasploitable bridged in your network, the VM is connected to the network directly. Everyone in the network has access to the VM so everyone can exploit the vulnerabilities. The VM runs on your host so an attacker can use your resources. It could also be, that the attacker could escape the VM and attack your host device. You should use a host ...


4

A Wordpress user can go to this URL and request a password reset link via email: https://yourwordpress.example/wp-login.php?action=lostpassword The reset link will look similar to this: https://yourwordpress.example/wp-login.php?action=rp&key=dDnnToiqjYtsa9KdfVZl&login=admin The key parameter in the URL ensures that only the reciever of the ...


3

The problem is that Kali's nmap is trying to scan your HOST system instead of metasploitable. This is the only solution that worked for me, hope it helps you, as I also had a inet addr: 10.0.2.15. Click on Metasploitable in VB Click settings Select network Change NAT to Bridged Adapter Repeat with Kali Enjoy a working nmap!


2

Having a look at the Armitage code for Find Attacks it seems to implement it's own version of an old option in Metasploit db_autopwn that had been deprecated back in 2011. However, I have found a "recently" updated plugin (Aug 2017) for this option which can be found here: metasploit-db_autopwn To install, navigate to Metasploits plugin directory (in Kali: ...


2

There used to be an autopwn option in Metasploit which would do what you are looking for but only target browsers. However, just like the name in Armitage implies, it selects a large set of exploits, fire it at the target and hope for the best. However, exploitation if not done correctly can do more harm than good. For example, an SMB exploit which has a ...


2

The problem with Metasploitable and alike is that these are mostly for demonstration purposes and contain far too many vulnerabilities which also aren't easy to fix either. Also in a CTF, you don't want people to corrupt the complete VM but only get a token out of a single service. I would suggest looking at the iCTF, they have some sample services. If you ...


2

I use the exploit proftpd_133c_backdoor ... From the documentation you can see that: This module exploits a malicious backdoor that was added to the ProFTPD download archive. This backdoor was present in the proftpd-1.3.3c.tar.[bz2|gz] archive between November 28th 2010 and 2nd December 2010 But you are obviously using a version of proftpd which is ...


1

In order to login you need to also submit a hidden field called user_token which looks like this: <input type='hidden' name='user_token' value='random_value_here' /> The value changes every time you refresh the page, so you need a little web-scraping to do what you are looking for. The following code uses bs4 to scrape the page and get the correct ...


1

Maybe try using some alternative expressions to a query that checks whether 1=1? Some examples could be: For instances when the 'OR' keyword is being caught by WAF: 1 && 1 = 1 1 || 1=1 For instances where the equlals sign (=) is being caught by WAF: OR 2 between 3 and 1 or 2 > 1 or 1 < 2 For instances where integer-based comparison is ...


1

Finally I got it. I was not explicitly setting the payload. Once I used java/meterpreter/reverse_http I got it through.


1

I have some experience with VirtualBox simply not working as it should. I believe there are some bugs in their network simulation. Sometimes simple things stop working and just random reboots, fiddling, or simply time fix the problem. First, try to update VirtualBox, it has solved some of my problems in the past. Second, when all else fails, what I use for ...


1

You could probably get some ideas here: https://www.shellntel.com/?offset=1467995296914 The short version is to write a NASL to exploit what it finds on metasploitable instead of just checking for a vulnerability.


1

You must first have a working Meterpreter or a handler session that has received an incoming shell (these are the interpreter environments that provide an implant, or backdoor payload, to the system(s) under target). Typically, a handler session can be upgraded to Meterpreter using the sessions -u <selected session> flag. The module you specified is a ...


1

Nmap uses different scanning methods depending on whether it's running as root or not. The error you see is normal. Try adding -Pn and you will probably get identical results to the scan you ran as a regular user.


Only top voted, non community-wiki answers of a minimum length are eligible