<\/p>\n\n\n\n
Task A. Exploit SMB on Windows XP with Metasploit (20 pt, 2pt each)<\/h2>\n\n\n\n
In this task, you need to complete the following steps to exploit SMB vulnerability on
Windows XP.<\/p>\n\n\n\n
- \n
- Run a port scan against the Windows XP using the Nmap command to identify open ports and services.<\/li>\n<\/ol>\n\n\n\n\n\n
![\"\"](\"https:\/\/sites.wp.odu.edu\/nadiaeportifolioids493\/wp-content\/uploads\/sites\/38245\/2025\/03\/1.5.png\")
<\/a><\/figure>\n<\/div>\n<\/div>\n\n\n\n2. Identify the SMB port number (default: 445) and confirm that it is open.<\/p>\n\n\n\n
\n\n![\"\"](\"https:\/\/sites.wp.odu.edu\/nadiaeportifolioids493\/wp-content\/uploads\/sites\/38245\/2025\/03\/2.5.png\")
<\/a><\/figure>\n<\/div>\n<\/div>\n\n\n\n3. Launch Metasploit Framework and search for the exploit module:
ms08_067_netapi<\/p>\n\n\n\n\n\n![\"\"](\"https:\/\/sites.wp.odu.edu\/nadiaeportifolioids493\/wp-content\/uploads\/sites\/38245\/2025\/03\/3.5.png\")
<\/a><\/figure>\n<\/div>\n<\/div>\n\n\n\n4. Use ms08_067_netapi as the exploit module and set meterpreter reverse_tcp as the payload.<\/p>\n\n\n\n
\n\n![\"\"](\"https:\/\/sites.wp.odu.edu\/nadiaeportifolioids493\/wp-content\/uploads\/sites\/38245\/2025\/03\/4.5-1.png\")
<\/a><\/figure>\n<\/div>\n<\/div>\n\n\n\n- \n
- Use XXXX (follow the lab instructions) as the listening port number.
Configure the rest of the parameters. Display your configurations and exploit
the target.<\/li>\n<\/ol>\n\n\n\n\n\n![\"\"](\"https:\/\/sites.wp.odu.edu\/nadiaeportifolioids493\/wp-content\/uploads\/sites\/38245\/2025\/03\/5.5-1.png\")
<\/a><\/figure>\n<\/div>\n<\/div>\n\n\n\n- \n
- [Post-exploitation] Execute the screenshot command to take a screenshot of the target machine if the exploit is successful.<\/li>\n<\/ol>\n\n\n\n\n\n
![\"\"](\"https:\/\/sites.wp.odu.edu\/nadiaeportifolioids493\/wp-content\/uploads\/sites\/38245\/2025\/03\/6.png\")
<\/a><\/figure>\n<\/div>\n<\/div>\n\n\n\n\n\n![\"\"](\"https:\/\/sites.wp.odu.edu\/nadiaeportifolioids493\/wp-content\/uploads\/sites\/38245\/2025\/03\/6.5-1.png\")
<\/a><\/figure>\n<\/div>\n<\/div>\n\n\n\n- \n
- [Post-exploitation] In meterpreter shell, display the target system\u2019s local
date and time.<\/li>\n<\/ol>\n\n\n\n\n ![\"\"](\"https:\/\/sites.wp.odu.edu\/nadiaeportifolioids493\/wp-content\/uploads\/sites\/38245\/2025\/03\/7.png\")
<\/a><\/figure>\n<\/figure>\n\n\n\n<\/p>\n\n\n\n
- \n
- [Post-exploitation] In meterpreter shell, get the SID of the user.<\/li>\n<\/ol>\n\n\n\n\n\n
![\"\"](\"https:\/\/sites.wp.odu.edu\/nadiaeportifolioids493\/wp-content\/uploads\/sites\/38245\/2025\/03\/8.png\")
<\/a><\/figure>\n<\/div>\n<\/div>\n\n\n\n- \n
- [Post-exploitation] In meterpreter shell, get the current process identifier<\/li>\n<\/ol>\n\n\n\n\n\n
![\"\"](\"https:\/\/sites.wp.odu.edu\/nadiaeportifolioids493\/wp-content\/uploads\/sites\/38245\/2025\/03\/9.png\")
<\/a><\/figure>\n<\/div>\n<\/div>\n\n\n\n- \n
- [Post-exploitation] In meterpreter shell, get system information about the
target.<\/li>\n<\/ol>\n\n\n\n\n\n![\"\"](\"https:\/\/sites.wp.odu.edu\/nadiaeportifolioids493\/wp-content\/uploads\/sites\/38245\/2025\/03\/10.png\")
<\/a><\/figure>\n<\/div>\n<\/div>\n\n\n\nTask B. Exploit EternalBlue on Windows Server 2008 with Metasploit (20 pt)
<\/h2>\n\n\n\nIn this task, you need to use similar steps to exploit the EternalBlue vulnerability on Windows Server 2008. Make sure to search and replace the exploit module against Windows Server 2008 accordingly.<\/p>\n\n\n\n
\n ![\"\"](\"https:\/\/sites.wp.odu.edu\/nadiaeportifolioids493\/wp-content\/uploads\/sites\/38245\/2025\/03\/11.png\")
<\/a><\/figure>\n<\/figure>\n\n\n\n<\/p>\n\n\n\n
Configure your Metasploit accordingly and set XXXX (follow the lab instruction) as the listening port number. Display the configuration and exploit the target. (10 pt)<\/p>\n\n\n\n
\n\n![\"\"](\"https:\/\/sites.wp.odu.edu\/nadiaeportifolioids493\/wp-content\/uploads\/sites\/38245\/2025\/03\/11-1.png\")
<\/a><\/figure>\n<\/div>\n<\/div>\n\n\n\n\n\n![\"\"](\"https:\/\/sites.wp.odu.edu\/nadiaeportifolioids493\/wp-content\/uploads\/sites\/38245\/2025\/03\/Screenshot-2025-03-04-215102.png\")
<\/a><\/figure>\n<\/div>\n<\/div>\n\n\n\n- \n
- [Post-exploitation] Execute the screenshot command to take a screenshot of the
target machine if the exploit is successful. (2 pt)<\/li>\n<\/ol>\n\n\n\n\n\n![\"\"](\"https:\/\/sites.wp.odu.edu\/nadiaeportifolioids493\/wp-content\/uploads\/sites\/38245\/2025\/03\/Screenshot-2025-03-04-215244.png\")
<\/a><\/figure>\n<\/div>\n<\/div>\n\n\n\n- \n
- [Post-exploitation] In meterpreter shell, display the target system\u2019s local date and
time. (2 pt)<\/li>\n<\/ol>\n\n\n\n\n\n![\"\"](\"https:\/\/sites.wp.odu.edu\/nadiaeportifolioids493\/wp-content\/uploads\/sites\/38245\/2025\/03\/Screenshot-2025-03-04-215339.png\")
<\/a><\/figure>\n<\/div>\n<\/div>\n\n\n\n- \n
- [Post-exploitation] In meterpreter shell, get the SID of the user. (2 pt)<\/li>\n<\/ol>\n\n\n\n\n\n
![\"\"](\"https:\/\/sites.wp.odu.edu\/nadiaeportifolioids493\/wp-content\/uploads\/sites\/38245\/2025\/03\/Screenshot-2025-03-04-215502.png\")
<\/a><\/figure>\n<\/div>\n<\/div>\n\n\n\n- \n
- [Post-exploitation] In meterpreter shell, get the current process identifier. (2 pt)<\/li>\n<\/ol>\n\n\n\n\n\n
![\"\"](\"https:\/\/sites.wp.odu.edu\/nadiaeportifolioids493\/wp-content\/uploads\/sites\/38245\/2025\/03\/Screenshot-2025-03-04-215607.png\")
<\/a><\/figure>\n<\/div>\n<\/div>\n\n\n\n- \n
- [Post-exploitation] In meterpreter shell, get system information about the target. (2 pt)<\/li>\n<\/ol>\n\n\n\n\n\n
![\"\"](\"https:\/\/sites.wp.odu.edu\/nadiaeportifolioids493\/wp-content\/uploads\/sites\/38245\/2025\/03\/Screenshot-2025-03-04-215708.png\")
<\/a><\/figure>\n<\/div>\n<\/div>\n\n\n\nTask C. Exploit Windows 7 with a deliverable payload (60 pt)<\/h2>\n\n\n\n
In this task, you need to create an executable payload with the required configurations below. Once your payload is ready, you should upload it to the web server running on Kali Linux and download the payload from Windows 7, then execute it on the target to make a reverse shell (10 pt). Of course, don’t forget to configure your Metasploit on Kali Linux before the payload is triggered on the target VM.<\/p>\n\n\n\n
The requirements for your payload are (10 pt, 5pt each):<\/p>\n\n\n\n
- \n
- Payload Name: Use your MIDAS ID (for example, pjiang.exe)<\/li>\n\n\n\n
- Listening port: XXXX (follow the lab instruction)<\/li>\n<\/ul>\n\n\n\n
<\/p>\n\n\n\n
\n\n![\"\"](\"https:\/\/sites.wp.odu.edu\/nadiaeportifolioids493\/wp-content\/uploads\/sites\/38245\/2025\/03\/20.png\")
<\/a><\/figure>\n<\/div>\n<\/div>\n\n\n\n[Post-exploitation] Once you have established the reverse shell connection to the
target Windows 7, complete the following tasks in your meterpreter shell:<\/p>\n\n\n\n- \n
- Execute the screenshot command to take a screenshot of the target machine if
the exploit is successful. (10 pt)<\/li>\n<\/ol>\n\n\n\n\n\n![\"\"](\"https:\/\/sites.wp.odu.edu\/nadiaeportifolioids493\/wp-content\/uploads\/sites\/38245\/2025\/03\/21.png\")
<\/a><\/figure>\n<\/div>\n<\/div>\n\n\n\n\n\n![\"\"](\"https:\/\/sites.wp.odu.edu\/nadiaeportifolioids493\/wp-content\/uploads\/sites\/38245\/2025\/03\/22.png\")
<\/a><\/figure>\n<\/div>\n<\/div>\n\n\n\n- \n
- Create a text file on the attacker Kali named “IMadeIT-YourMIDAS.txt” (replace
YourMIDAS with your university MIDAS ID) and put the current timestamp in the file.
Upload this file to the target’s desktop. Then log in to Windows 7 VM and check if
the file exists. You need to show me the command that uploads the file. (10 pt)<\/li>\n<\/ol>\n\n\n\n\n\n![\"\"](\"https:\/\/sites.wp.odu.edu\/nadiaeportifolioids493\/wp-content\/uploads\/sites\/38245\/2025\/03\/23.png\")
<\/a><\/figure>\n<\/div>\n<\/div>\n\n\n\n\n\n![\"\"](\"https:\/\/sites.wp.odu.edu\/nadiaeportifolioids493\/wp-content\/uploads\/sites\/38245\/2025\/03\/24.png\")
<\/a><\/figure>\n<\/div>\n<\/div>\n\n\n\n[Privilege escalation] Background your current session, then gain administrator-level
privileges on the remote system
(10 pt). After you escalate the privilege, complete the following tasks:<\/p>\n\n\n\n- \n
- Create a malicious account with your name and add this account to the
administrator group. You need to complete this step on the Attacker Side. (5 pt)<\/li>\n<\/ol>\n\n\n\n\n\n![\"\"](\"https:\/\/sites.wp.odu.edu\/nadiaeportifolioids493\/wp-content\/uploads\/sites\/38245\/2025\/03\/Screenshot-2025-03-04-220408.png\")
<\/a><\/figure>\n<\/div>\n<\/div>\n\n\n\n- \n
- Remote access to the malicious account created in the previous step and browse
the files belonging to the user, “Windows 7”, in RDP. (5 pt)<\/li>\n<\/ol>\n\n\n\n\n\n![\"\"](\"https:\/\/sites.wp.odu.edu\/nadiaeportifolioids493\/wp-content\/uploads\/sites\/38245\/2025\/03\/Screenshot-2025-03-04-220533.png\")
<\/a><\/figure>\n<\/div>\n<\/div>\n\n\n\n
- Remote access to the malicious account created in the previous step and browse
- Create a malicious account with your name and add this account to the
- Create a text file on the attacker Kali named “IMadeIT-YourMIDAS.txt” (replace
- Execute the screenshot command to take a screenshot of the target machine if
- [Post-exploitation] In meterpreter shell, get system information about the target. (2 pt)<\/li>\n<\/ol>\n\n\n\n
- [Post-exploitation] In meterpreter shell, get the current process identifier. (2 pt)<\/li>\n<\/ol>\n\n\n\n
- [Post-exploitation] In meterpreter shell, get the SID of the user. (2 pt)<\/li>\n<\/ol>\n\n\n\n
- [Post-exploitation] In meterpreter shell, display the target system\u2019s local date and
- [Post-exploitation] Execute the screenshot command to take a screenshot of the
- [Post-exploitation] In meterpreter shell, get system information about the
- [Post-exploitation] In meterpreter shell, get the current process identifier<\/li>\n<\/ol>\n\n\n\n
- [Post-exploitation] In meterpreter shell, get the SID of the user.<\/li>\n<\/ol>\n\n\n\n
- [Post-exploitation] In meterpreter shell, display the target system\u2019s local
- [Post-exploitation] Execute the screenshot command to take a screenshot of the target machine if the exploit is successful.<\/li>\n<\/ol>\n\n\n\n
- Use XXXX (follow the lab instructions) as the listening port number.