Conducting Vulnerability on Windows XP-SP2 System using Nessus and Metasploit

This project aims to conduct vulnerability on a Windows XP-SP2 system using Nessus and gain access using Metasploit. It includes steps to install Kali Linux and Windows XP on a virtual machine. The project covers the use of Nessus to identify vulnerabilities and the use of Kali Linux for penetration testing. Subject: Computer Security

Computer security

Table of Contents
Introduction................................................................................................................................2
Nessus........................................................................................................................................3
Kali Linux and Windows XP.....................................................................................................3
Install kali Linux........................................................................................................................3
Install windows xp...................................................................................................................24
Attack against a Windows XP SP2 System..............................................................................31
Part a)..............................................................................................................................................31
Part b)..............................................................................................................................................33
Part c)..............................................................................................................................................34
Part d)..............................................................................................................................................35
Part e)..............................................................................................................................................36
Part f)...............................................................................................................................................37
Part g)..............................................................................................................................................38
Part h)..............................................................................................................................................39
Conclusion................................................................................................................................40
Reference..................................................................................................................................41

Introduction
In this project the main aim is to conduct vulnerability for the window XP-SP2 system
using Nessus and then gain access into this system using Metasploit. First step is to install the
Kali Linux and Windows XP on the virtual machine. It contains information such as last
name, IP address, process ID, cracked password etc. We will hack the password using Kali
Linux and Windows XP on the virtual machine.
Nessus
Nessus is used to identify common vulnerabilities and exposures architecture for linking
between security tools. It is an open source network vulnerability scanner and used for
security purpose. The individual threats and potential attacks are described by simple
language, called as Nessus attack scripting language (Nsouli-Lalardrie, 2010). It consists of
servers, remote clients and conducts scanning which allows for administrator interaction. It
has the same features such as a computer and server size compatibility, updates the missing
security, detects missing security, local or remote hosts are detected by Nessus, execution of
security tests and security audits. It is available for UNIX, FreeBSD and Linux. It scans a
computer and raises an alert that access to any computer connected to the network for any
hacking or malicious intent. It accesses different remote clients and servers. Each computer
has thousands of ports and these may work or may not be working. Nessus is used to test
these ports and then displays which ports are working and which are not.
Kali Linux and Windows XP
Kali Linux is mainly used to perform penetration testing and is based on debian Linux. It
contains several hundreds of tools and these can perform information security tasks such as
computer forensics, reverse engineering, security research and penetration test. Backtrack is
one of Kali Linux tools which is used to test the duplicated tools. Kali Linux kernel has the
latest innovation which performs the needs to do wireless assessments (Höhl, 2013). Kali
Linux includes multilingual support and allows multi users. It supports single board system
like beagle bone black and raspberry Pi. It has ARM repositories integrated with mainline
distributors and it is available on a wide range of id ARM devices. We have used the
penetration test for this project and for that Kali Linux and Windows XP have been installed.
Windows has two types of version i.e. Window XP Home and Window XP Professional. It
includes plug and play features for connecting to wireless networks and this focuses on
mobility. It is used to update the system for protection against viruses and malware. We have

used Kali Linux and Windows XP on virtual machine for protection against malware. The
Kali Linux and Windows XP have to be downloaded and installed on the virtual machine.
Install Kali Linux
First step is to download and install Kali Linux on the virtual machine.
Open the virtual machine for installing the Kali Linux ("Kali Linux – Assuring Security by
Penetration Testing", 2014).

Click on “create a new virtual machine” for creating a new VM.
The new virtual machine wizard then opens, choose the typical option and then click on the
next button.

Click on the installer disk image option and import the ISO image file for Kali Linux from
the computer. To browse Kali Linux and for importing the file,
We have opened the Kali Linux image file from the computer and same has to be imported to
the file.

Give a title to the virtual machine and then select the location to store the data.
To select the maximum disk space, choose the store virtual disk on a single file then click
next button.

Click the finish button.
The Kali Linux page automatically opens after installation is finished.

Click the install option for installing Kali Linux.
Choose the language from given options,

Choose the location from the given options to install Kali Linux.
Select the option to configure the keyboard and press the enter button.

Give the host name for configuring the network and then click the continue option.
Give the domain name for configuring the network and then click the continue button,

Set the root password and click the continue button.
Again re-enter the password and then click the continue button.

Choose the central option to configure the clock/time.
Next, it displays the portioning method and here select the manual option. Press the enter
button,

It will display four options for portioning class. Select the finish portioning and then write
changes to write.
It displays the root file portioning menu. Click the continue button,

Again select the portioning class option and press enter button.
Crate the new portioning table on this device and click the no option.

Choose the guided portioning option and press enter button.
Again choose the portioning method as guided and use the entire disk option. Press enter
button next,

Select the disk to portioning option and press enter button.
The files are separated and press the option as all files to be in one partition. Next press enter
button.

Finally click the option as partioning is finished and write changes to disk and press the enter
button.

Press the “yes” option for writing change to disk.
The file data are copied from system to disk and it initializes the system

Click the “No” option for network mirror.
It retrieves all the files and then it configures it to the network.

Press the yes option for installing the GRUB boot loader to the master boot record.
It automatically finishes the installation.

Click the continue button for finishing the installation.
It will display the packages that have been installed and remove the live package.

Kali Linux is opened and next click the other option.

Give the username and password for login page. If the username or password is incorrect then
it will not open.
It shows Kali Linux for running the program. It has the application option, places and
terminal.

Installing Windows XP
Second step is to install the Windows XP on the virtual machine and this will be used to run
the Nessus.
Open the virtual machine and click on create new virtual machine. This shows the new virtual
machine wizard. Choose the typical option then click the next button (Vuletić & Nojković,
2018).

Choose the installer disk and import the disk image file from the computer and then click the
next button.
It will display the product key option for Windows XP and then enter the user name and
password. Next click the “next” button.

Give the virtual machine name and choose the location for storing the data, then click on the
next button.
Choose the disk image size and click the store data on a single file. The data are stored on the
single file (Yin, 2013).

It will display the location, hard disk size, operating system and other device information and
then click the finish button.
It initializes all the files and then loads all the files.

The files are retrieved from the computer and it is ready to start windows.
The Windows XP is ready to start and it shows the loading the page.

It displays the initialization option for windows. It initializes the windows file and then is
shows all the options.

Again it shows the license product key for Windows XP. If you will give the correct product
key then it is ready to start windows. If you will give the incorrect product key then it will not
open Windows.
After the correct Product Key has been entered, Windows XP will open on the virtual
machine.

Attack against a Windows XP SP2 System
Part a)
To open the Kali Linux terminal for root and then set the path.
To give the config command on Kali Linux for displaying the IP address.

It scans all the IP addresses and port’s using the command nmap –PN –Ss –p 135, 445
192.168/.58.4-250. The IP address is 192.168.58.4 and port number is 250. This will be
displayed as the port number 135 to 445 scan report.
It displays the port number, state and service type for the particular IP address.

Part b)
It displays the vulnerability for servers using Nessus which includes the information about
high, low, medium vulnerability.
Part c)
Set the directory for ohen using mkdir ohen. The ohen directory is set and access is tye
msfconsole.

Give the command as msfconsole and then it displays your host and services. It has 1256
exploits, 762 auxiliary, 212 post, 324 payloads, 32 encoders and 8 nops. Give the command
as search netapi for searching the network API. It shows the name which is exploited,
disclosure date, rank and description.
Part d)
To set the path for msf exploit for tcp connection. It shows the module options for tcp
connection and it has name, current setting, required and description information. The
payload options are name, current setting, required and description.

It started the reverse handler using IP address and port number. Set the RHOST address and
LHOST address for opening the meterpreter session.

Part e)
The meterpreter session is opened giving the sysinfo command for gathering all the system
information. It has the computer name, architecture, domain name, Logged on users and
server username.
Open Windows XP command prompt for getting all the information about the IP address.
Give the IP configuration command and it will display the IP address, subnet mask and
default gateway.

Set the path for Windows XP on Kali Linux. Enter the password and set the path for
documents and settings.
Part f)
It will display the mode, size, type for file directory, modified data/ time, and name of the
modified file.

Part g)
We shall remove techpanther from the directory by using the rmdir command. Then list out
all the files.
Again open Windows XP command prompt and give the command for the IP address. It
displays the IP address, subnet task and default gateway.

It displays the elevate commands on Linux, password database commands and timestamp
commands.
To run the meterpreter for accessing the node, file and execute file.

Part h)
Adding the user password on command prompt and this command will be completed
successfully.
Finally it displays the user account information on Windows XP.
Conclusion
In this project we have successfully completed conducting a vulnerability of a Window XP-
SP2 system by using Nessus and then gaining access into the system by using Metasploit.
First step was to install Kali Linux and Windows XP on virtual machine. The Nessus was
connected to Windows XP for security purpose. It is an open source security tool and it is

used for hacking all the malicious threats on any computer. It has features for all the
computers and for any servers size compatibility, updates the missing security, detects the
missing security, Local or remote hosts are detected by Nessus, execution of security tests
and security audits. It is available for UNIX, FreeBSD and Linux. It scans a computer and
raises alert that access to any computer that has been connected to a network is vulnerable to
hacking and malicious threats. It accesses different remote clients and servers. It has
information such as last name, IP address, process ID, cracked password etc. This was how to
hack the password using Kali Linux and Windows XP on virtual machine. Finally, we have
successfully implemented on how to prevent attacks on Windows XP.
Reference
Höhl, R. (2013). Schlusspfiff für Windows XP — Arztpraxen sollten zügig reagieren. DNP -
Der Neurologe Und Psychiater, 14(9), 37-38. doi: 10.1007/s15202-013-0395-0
Kali Linux – Assuring Security by Penetration Testing. (2014). Network Security, 2014(8), 4.
doi: 10.1016/s1353-4858(14)70077-7
Nsouli-Lalardrie, S. (2010). Lettre ouverte à mes concitoyens et à nos responsables. Les
Cahiers De L'orient, 100(4), 87. doi: 10.3917/lcdlo.100.0087
Vuletić, D., & Nojković, N. (2018). Realization of a TCP Syn Flood Attack using Kali
Linux. Vojnotehnicki Glasnik, 66(3), 640-649. doi: 10.5937/vojtehg66-16419
Yin, G. (2013). Moving Icons on Windows XP Desktop Efficiently, Exactly and Eliminating
Icons Bounce after Releasing. Advanced Materials Research, 791-793, 1699-1703. doi:
10.4028/www.scientific.net/amr.791-793.1699