Greetings and in this short video presentation we're going to see how we go about conducting a buffer overflow on a server 2008 installed. As described in security Bolton, Microsoft is 09 dash 050. For this particular lab, we'll be using an install on server 2008 32 bit SP one and the download for this particular install is available inside the lab. But regardless, you have to have the 32 bit edition for server 2008 sp one. Once we have our installation package or the ISO image for server 2008 32 bit downloaded, we can begin the creation for the virtual machine using VMware. And we begin by just going up to File and clicking on new virtual machine or clicking on the tile that says Create a new virtual machine.

Either one, we'll launch the new virtual machine wizard. We click Next. And now we're going to select the installation disk image using an ISO and we're going to browse on over to where we save the download for our server 2008 32 bit ISO image. Once we have selected the correct ISO image, the new virtual machine wizard will identify it. And in this case, that is Windows Server 2008 was detected. We click Next.

And now we don't have to worry about the product key because we're going to use the trial version. We're going to give it a user friendly name. We're going to type in the password and then we're going to select the box for logging on automatically. Once I'm assured that all the information is correct, I'm just going to click Next. And from here we can give the virtual machine a user friendly name such as server 2000 And, and we can also select the location for which we want to store the virtual machine. I like to keep mine off of my C partition, I like to put them onto an external partition, so they don't take up as much room.

So I've gone ahead and given my virtual machine a user friendly name of server 2008 target, I have stored it onto my E drive inside of my directory for virtual machines inside of a new folder called server 2008 target, and then I click next, we can leave the default for the 40 gig for the disk partition, and I'm going to store this virtual disk as a single file. I click next, and this is my confirmation page. Now this is the last chance I will have to go back into making any changes. I'm also going to check the box to power on this virtual machine after the creation and I click Finish. From here, the server 2008 installation process begins. And we only have one particular window that we're going to worry about.

And when we get to it, we will restart the video at that point. So the installation process will stop and it will ask me for a product key. But we do not have to have a product key and we don't need to tell it to automatically activate when it logs on for the first time, we can uncheck that box. And we can just say next, and that will start the trial period. And for this message that pops up asking you what do you want to do? Or when do you want to enter the product key you say?

No. And we can begin the installation process again. We're going to go ahead and select the standard. This is for the full installation. So we're going to select Windows Server 2008 standard installation, and we're going to click Next. Now we have to start Like the box that says I have selected the addition of windows that I that I purchased, and we click next and this begins to copy and process.

From this point forward, the installation process will complete on its own, and it will restart a couple of times. And when it's done with the installation, it will automatically boot you to the desktop with an automatic log on. Once the installation has completed, the VMware Tools will begin the installation process. Go ahead and allow that to complete and then we'll move on with the rest of the video. Once the VMware Tools have installed, the machine will need to reboot and when it does, it will come back up and we'll have access to our USB devices, our clipboard from our host machine and we'll be able to go fullscreen with our video. Now, once we have our clear desktop, we can begin by going to start and we're going to click on control panel and we're going to go into the window firewall.

And from here we're going to click on allow program through the Windows Firewall. And where it's comes up with the User Account Control, we're going to select Continue. And from here we're going to go down and find file and printer sharing. check that box and say Apply, say Okay, and now we can close up the firewall Management Console. Now since this export is designed for a file server 2008 we have to create a file to share so that we can enable the SMB service so we're going to go to start, we're going to go into computer and underneath the C drive, we're going to right clicking we're inside of the white window, we're going to go to new Select Folder, and we're going to call it share. Once we have created the share directory, we need to right click on that particular directory and then select Share from the context menu.

From here, we're just going to type in the everyone group. We're going to search for that. And we're going to add it. And we're going to select Share. We're going to allow the access to the user account control by selecting continue. And the share will be created in just a moment.

If the share process seems to be taking too long look for a hidden message that may have popped up behind the share being created window and see if that is available for you to go ahead and click on where it says do not allow this network to be shared publicly allow it to be only a private network. All right. So now we have created the share. And we can tell that this is a share because we had a to user icon wants to share the share is completed we can open it up just by double clicking it And we can right click inside the white window anywhere. And we're going to go to new rich text document. And we're going to type in top secret plans as the title for this document, paying particular attention how the name of the document is actually worded.

I've actually used underscore underscores between each of the words. This helps in the location of the file across the network with a Linux machine. Once the document inside of the share folder has been created, we're just going to go ahead and open it by double clicking it. And we're just going to type in the phrase, these are the plans. Once you have something typed inside of the document, you can go ahead and go to File and do a Save. And then you can close it out.

So the next thing we want to do is go ahead and confirm that we have network connectivity on our local network and we're going to do this by going Start. And in the search bar here, I'm going to type in cmd. It's going to be a command prompt. I'm going to type in IP config. Check my IP address, and I have an IP address of 192 dot 168 dot 145 dot 129. Now that I have discovered the correct IP address for my installation of server 2008, I'm going to go to my Cali machine.

I'm going to open up a terminal. And I'm going to attempt to ping this new server 2008 installation to ensure that we have network connectivity. So from the terminal of my callin machine, I have typed in ping 129 dot 168 dot 145 dot 129. And that is the IP address assigned to my server 2000 installation and we're going to see or check and confirm that we have connectivity and we do get a positive response back and our To break this sequence, I can just type in Ctrl C. And I'm back to the pump. We're ready now to begin the lab. And the first thing we're going to do is discover the network using n map.

So we'll begin by using n map to scan for all hosts that are currently on the 145 network. And I'm telling it that I want you to scan the last octet of the subnet mask or 255 hosts. So I'm going to go ahead and hit Enter. And in just a minute, we will see the results of the scan. So we've discovered all the hosts that are currently on the 145 network. And you can see that by the results, it's a pretty simple scan.

So we're going to step it up with another and that command to get some more interesting results. So from the previous scan results, I have chosen the IP address of one to nine as my next scan target and I'm going to use the end Map command dash st to look for all TCP IP ports that may be open on this particular target. And I'm now going to go ahead and hit Enter. And in just a moment, we'll get the scan results. So the scan has came back and we have the results and we're looking at three particular ports of interest, first port 135 139. And in particular port 445, which we know is used when the SMB service is installed and run.

One of the most useful and map options that we have is the dash capital O, which allows us to determine or identify the operating system. So I'm going to go ahead and use the 192 address again and I'm going to use the dash capital O option and hit enter and we'll see what comes back. So the scan results do come back and they are inconclusive. Because we don't have enough information to actually determine that this is a server 2008 installation, but we do have other options that we can use to scan and further confirm our suspicions. In this next part of the lab, we're going to fire up the administrator console. And we're going to use one of the scanner that is available up inside of the MS console to check the machine further and confirm that it actually is a server 2008 installation.

The launch misquote, I'm just going to go to my terminal prompt and type in M MSF console. And I'm going to hit enter, give it a moment, and it will load up the MS console for me. Once the meta sploit console has completed loading, we're going to go ahead and type in the use Command. And we're going to use a scanner call the SMB underscore version. So I'm going to type in you Space auxiliary port slash scanner or slash SMB, or slash SMB underscore version than just going to hit Enter. And now we have to type in some option.

So once we have told us what the scanner that we want to use, notice that the prompt changes. Now we have to go in and configure the options. To figure out which options need to be configured, we use the show command, followed by the word options. And I'm just going to go ahead and hit Enter. And we see what options have to be configured. going across from the top underneath name, we see that there is the our host that must be configured.

And if you look underneath that required, it will tell you yes or no. We also see what the description for that particular option is. So we're going to type in set so that we can set the option for the remote host and we're going to type in the IP address. That we want to check for an SMD version. The command is set space, our host for remote host space, the IP address of the target, in this case, that's 192 dot 168 dot 145 dot 129. Now I'm going to hit Enter, and give it a moment and it will come back with another prompt asking me to go ahead and run or launched this particular scanner.

To launch the scanner, all we have to do is type in the run command and hit Enter. And in just a moment, it'll come back with the results. And here we see that the host is running Windows Server 2008 standard SP one, which is what we want to know. We can confirm that this is the correct version displaying going back to our target. And at the search window. We can just type in winrar for Windows version, and we can hit enter and we'll get a pop up window letting us know that this says Windows Server 2008 sp one.

So now that we have discovered that we are attacking, or we have a target that is server 2008, we need to find an exploit. So I'm going to type in the command back. And that's going to take us back one level. And now we're going to do a search for 2008. And I'm going to type in search 2008. And we'll see what pops up from the results.

And you see there's quite a few we have to scroll down and everything is an apple medical order. By the way, we have to scroll down and find the export for the windows SMB, Ms. 09, underscore zero 50 underscore SMB to underscore negotiate underscore function, underscoring this, that's the actual export we're going to be using. Once I highlight that I'm going to go ahead and copy it. And we're going to move back down here to the prop I'm going to type in a use. And now I'm going to paste what I copied. And we'll see that the prompt changes.

If you would like some more information about this particular exploit, you can back off one level and just change the word use with info. And you'll get all the information you ever want to know about this particular exploit. Again, we have options to configure. So we're going to use the show options command. Once I've typed in the show options command, I'm just going to I'm going to go ahead and hit Enter. And we see that we have to configure three things, the remote host, the port, which is already done for us, but we've also got to configure the local host, which will also do and we have to select a payload.

So for my remote host, I'm going to go in and type in the IP address along with the set our host command. And now I'm going to hit enter And that's complete. The localhost is the callee machine. And I know mine to be having an IP address ending in 132. So we'll go ahead and hit enter for that. For this particular lab, we're going to want to create a reverse hosts with our victims so that we can run some commands and exploit it to its full potential.

And for that, we're going to use meta printers. So I'm going to go ahead and use a meta printer, reverse shell payload, I'm going to go ahead and type in set payload to Windows meterpreter, reverse underscore TCP and hit enter. Now, the first time you run this particular exploit, it may go ahead and blue screen or cause your server 2008 to reboot, which is part of the characteristics of a buffer overflow. So we get that denial of service, but once it comes back up, you should be able to run the command again and establish a meterpreter prompt. So we're going to go and type in exploit. And now we hit enter.

The meta trader prop is the signal that you have successfully delivered the payload. And that brings us to the conclusion for this short video presentation. But do continue on with the lab as there's a lot of good post exploitation left to do. And I want to thank you for watching and I hope to see you in my next online video. Thank you