Manual exploitation

At this point we should have two systems ready to go in our virtual environment: Our Kioptrix Level 1 machine which will be our target as well as our BackTrack machine which will be taking on the role of attacker. Before we can start with exploitation we need to determine our plan of attack.

Enumerating services

We will begin by locating the machine on our network using nmap. Open up a new terminal session and type:

nmap -f -n -P0 -v -p- -T4 192.168.75.0/24

We have instructed nmap to scan all TCP ports for IPs on 192.168.75.X using fragmented packets. Here is an excerpt of the results:

Scanning 192.168.75.14 [65535 ports]
Discovered open port 139/tcp on 192.168.75.14
Discovered open port 80/tcp on 192.168.75.14
Discovered open port 22/tcp on 192.168.75.14
Discovered open port 443/tcp on 192.168.75.14
Discovered open port 111/tcp on 192.168.75.14
Discovered open port 32768/tcp on 192.168.75.14
Completed SYN Stealth Scan at 10:24, 8.05s elapsed (65535 total ports)
Nmap scan...