Introduction

Welcome! I am your instructor Mr. Dev. In this blog, we are going to set up Metasploitable 2 on my virtual box.

In this section, I am using Parrot Security Operating System (From where we are going to target the Vulnerable Machine). You can use Kali Linux also.

If you don't know what is ParrotSec, and also don't know about Kali Linux OS then click the below links:

• Parrot Security
• Kali Linux  
• Kali Live USB persistence
  
• Parrot vs Kali
• Best Operating System for Ethical Hacking and Penetration testing

Setting Up Metasploitable 2 on Virtual Machine

The easiest way to get a target machine is to use Metasploitable 2, which is an intentionally vulnerable Ubuntu Linux virtual machine that is designed for testing common vulnerabilities. This virtual machine (VM) is compatible with VMWare, VirtualBox, and other common virtualization platforms.

In this section, we are going to use VirtualBox, which is a free and open-source software for virtualizing the x86 computing architecture.

Follow the below steps to get Metasploitable2 VMs on your VirtualBox:

Step 1: Download and install VirtualBox

Condition 1: If you are a Windows User?

Visit VirtualBox.org and click on the "Download button" to download the latest VirtualBox. Once downloaded, install it and then run.

If You are using Kali or ParrotSec?

It is easy to install any tool when you are a Linux user. You just have to input the appropriate command:

Step 2: Add Extension Pack

Once You install VirtualBox you have to add the extension pack. You can download the extension pack from VirtualBox.org.

• Launch VirtualBox > Preferences > Extention. Now add Extention by clicking the Plus sign and Accept The Licence.

Step 3: Download Metasploitable 2

Download the Metasploitable2 virtual machine from Sourceforge:

Although there are new versions of Metasploitable available, we will be using this version because it is easier to set up.

Step 4: Extract the Downloaded File

Once the Download is complete click on Extract here to unzip the file ( You can do similar with Linux).

Step 5: Create a VM

• Go to VirtualBox → Click on "New". 
• Change name: Metasploit
• Type: Linux
• Version: Other Linux 64 bit
• Allocate Memory size
• Use an exciting Disk Machine size
• Import from the "Metasploitable.vmdx" file.
• Click on Start.

Congratulations! You have successfully managed to install Metasploitable 2 on VirtualBox.

Step 6: Configure the Metasploitable machine network settings

It is most important for you to get a proper connection from the server without any errors.

Remember: the Metasploit server network and the Parrot security must be in the same network.

Click on File > Host Network Manager (ctrl + H):

If you have no Host-only adapter listed click on Create and enable DHCP (It will automatically allocate you a stable IP address):

If you are a Windows user then you might have installed any instance (Kali or ParrotSec) on your VirtualBox.

Change the Network Adapter setting to Host-only Adapter on both instances (Settings > Network):

Metasploitable Settings

Kali Settings

If you are using Kali or ParrotSec as the host machine then modify network settings on Metasploit 2:

Step 7: Log in to Metasploitable Virtual Machine

Once you Launch your VM, you have to wait for the terminal to finish loading. Your virtual machine should display the Metasploitable logo. ( IMPORTANT: Your mouse pointer may disappear, this is because the VM has captured it. Press the Ctrl+Alt keys together to get your mouse back).

Log in using the username: msfadmin and password: msfadmin

Great you have now successfully set up your environment. Let’s execute your first hack. Each hack in this manual will start with a goal.

The first step of most hacks is identifying the machine that we want to connect to. Each machine is identified by a unique IP address. In this section, we will discover the IP address of the Metasploitable 2 server using NetDiscover.

What is NetDiscover?

Netdiscover is an active/passive ARP reconnaissance tool, initially developed to gain information about wireless networks without DHCP servers in wardriving scenarios. It can also be used on switched networks. Built on top of libnet and libpcap, it can passively detect online hosts or search for them by sending ARP requests.

Furthermore, it can be used to inspect your network's ARP traffic or find network addresses using the auto-scan mode, which will scan for common local networks.

NetDiscover comes pre-installed with the ParrotSec Operating system. Use the help command to find out more information about its usage.

Using NetDiscover

Follow the below instructions to find out the IP address of your target machine with the help of NetDiscover:

Step 1: Find out the interface name

To know the interface name run the ifconfig command on your terminal:

You can see 4 interfaces connected to your network:

• eth0: If your network is connected through an Ethernet cable.
• lo0: This signifies that you are connected with a local network i.e., 127.0.0.1
• vboxnet0: If your network is within the VirtualBox.
  
• wlan0: If you are connected with wifi.
  

Note: This may vary with your computer. In real-world hacking, it is important to know the working structure of a network. To learn more about networks to understand them in a better way.

As our Metasploitable 2 is installed within Virtualbox so the interface is vboxnet0.

Step 2: Discover the network

If you have found out your interface name then, run the following command on your terminal:

Great now that you have the IP Addresses, but the confusion is which is the Metasploit server. You can find out your answer in the next chapter.

If you are a hacker or any security researcher then it is important to analyze different different types of vulnerabilities and bugs and find out a way to gain access to the server. In this way, you earn some knowledge of how an exploit works.

Only gaining access is not important, As you are an ethical Hacker, you have to understand how to fix any vulnerability or bug.

There are multiple ways to enumerate a server. 

What is Enumeration?

Enumeration is a process of extracting machine information like usernames, machine names, network resources, port information, shares, and services of a system. In this phase, the attacker creates an active connection to the system and performs directed queries to gain more information about the target.

For this purpose, the best tools can be used:

• Nikto
• Nmap
• Zenmap
• Maltego
• Gobuster
• WPScan
• DNS enum
  
• Netdiscover, and many more.
  

Scan the Network using Nmap

Nmap is one of the most widely used and most popular tools among cybersecurity professionals, security researchers, hackers & network engineers, and learners as well. It is an open-source licensed tool mainly used for performing discovery such as ports, operating systems, etc., and auditing or determining security over the network. (Learn More).

Follow the below steps to scan the machine.

Step 1: Find a Real one

In my previous, we have found two IP addresses and we don't know which one is our target. 

The best way to know which is our target is by scanning. It will give us the OS information and network information. Let's see how.

Open your terminal and run the following commands:

From the above, we can't find out a lot more information. We can't find out the OS information. It means it is not our target.

Let's try the second one:

From the above scan, we can find out that the running Operating system is a UNIX or Linux-based Operating System.

We can successfully find out our target!

Step 2: Note Down the Vulnerabilities and Open Ports

From Step 1, we have found out the target information and open ports with their running services with their versions.

You can use Google for each of the versions to find out if there are any vulnerabilities available on this version.

In our previous article, we covered the basics of OpenVAS and its installation on Kali Linux. 

In this article, I'll walk you through the process of scanning a vulnerable web application.

Now, let's delve into how OpenVAS can help scan vulnerable web applications. For this demonstration, I'll be using Metasploitable2. 

The IP address of my Metasploitable2 server is 192.168.56.104. 

I won't delve into the step-by-step process of discovering the IP address here. To initiate a vulnerability scan, navigate to OpenVAS. 

On the OpenVAS dashboard, locate and click on the "Scan" tab. From the context menu, select "Task." 

Here, I encounter a welcome message, simply disregard it.

Here, there are two ways to initiate a scan. 

The purple-colored wizard icon guides you through the process in a step-by-step manner, asking for details at each stage. 

Alternatively, we'll opt for the non-wizard method. 

Click on "New task" to create a new scan task.

Clicking on "New Task," A form will appear. 

Here, you need to provide a name for the task. Since we're scanning Metasploitable2 in this example, let's name the task "Metasploitable2."

Click on it. It will open a new form, where we can add a new target.

In the "Name" section, give it a name. In the "Host" section, input the IP address you wish to scan. No other changes are needed. Click "Create" to proceed. 

It will automatically return to the previous form. If you wish to schedule scanning, you can configure it here. 

Additionally, there's another important aspect in the scanning section of the form. You can choose between OpenVAS default and CVE. In this instance, I've selected OpenVAS default.

Next, you'll need to configure the scan settings. This will help determine the type of scan you want to perform. For this demonstration, I've opted for "Full and Fast." 

No further adjustments are necessary. Click on "Create" to finalize the task creation.

Once the task is created, you'll need to take action to start it. 

On the left side of the task, you'll find various options such as start, stop, move to trashcan, edit task, clone, and export task. Choose the appropriate action to proceed.

Click on "Start", to initiate the task. 

It may take some time to scan the entire host. 

An important feature to note is OpenVAS's auto-refresh function, which updates the progress automatically. Let's set it to refresh every 30 seconds.

After Scan Completed:

Select the Metasploitable2 task, to view details such as, what scan was attempted, how much time it took, what is the result, and many more.

Navigate back to the "Task" tab and select "Results." 

Here, you'll find a diagram chart and color-coded pie chart representing different severity levels. 

Click on any colored area to view the discovered vulnerabilities and their severity level.

At the bottom of the results page, you'll see the vulnerabilities listed along with the affected machines. 

Since only one machine was scanned in this instance, only its results are displayed. Keep in mind, that results will expand as more tasks are run.

Selecting any of these results will give you in-depth information about the vulnerability. 

Additionally, you can consult the CVE details in the reference section for further insights.

By clicking on any of these CVEs, you'll be redirected to detailed information about the specific vulnerability. 

For further insights, you can also utilize search engines or AI tools. You can sort the severity levels by clicking here.

On the scan tab, click on “reports” to get the detailed report based on the date when you scan. Click on it. 

Upon clicking on a report will display a chart diagram depicting the severity of the vulnerabilities. Beneath the diagram, you'll find a list of vulnerabilities that occurred, when you start scanning on the same date.

Click on it, and it will show you a list of a list of vulnerabilities that occurred when you start scanning on the same date.

Clicking any of these vulnerabilities will display detailed information about it.

Similar to what I've previously shown you on the results page, you also have the option to download the reported data in various formats. 

Select your preferred format and click on the download icon to save the report. 

The Anonymous XML format is recommended as it is compatible with popular web scanners and can also be used with msfconsole.

This data can be utilized in different applications for thorough analysis.

In both articles, we covered a lot of ground. We utilized the Docker program to swiftly and seamlessly install OpenVAS, a program that can be challenging to set up. Toward the end, I demonstrated the most efficient way to use OpenVAS. With practice, you'll become more accustomed to it.

If you have any doubts or questions related to this article, feel free to leave them in the comments section.

The way hackers gain access to machines is through vulnerabilities. You can think of these vulnerabilities as open doors to your system. Hackers leverage these open doors (vulnerabilities) to gain access to systems. The Metasploitable server has an FTP vulnerability (vsftpd 2.3.4). 

In this section of the lab, you will exploit this vulnerability to gain access to the server.

Vulnerability: The Vulnerability that we are going to exploit in this lab is a malicious developer to an open-source UNIX FTP server called vsftpd. The back door allowed the attacker to gain access to the terminal on the vulnerable machine. The attack was activated when the attacker logged into the username ending in :) and an invalid password. Once the attack was activated it opened a reverse shell on port 6200.

Reverse Shell: A reverse shell is a malicious program that connects to an attacker’s machine, allowing the attacker to execute terminal commands on the compromised machine. In a later lab, we will write a reverse shell.

Background: A FTP (File Transfer Protocol) server is a program that allows users to upload and download files from a machine.

In this section, I will demonstrate you in 3 different ways:

Method 1: Manually Exploit

Follow the below instructions to get a backdoor connection:

Step 1: Connect to the FTP server using telnet

Open the terminal, and type the following command:

• Remember to add the port number towards the end:  [Important: telnet is an old technology, no backspace]

This is a part of a vulnerability that was placed in the open-source FTP server, by an unknown user. This user created this vulnerability by modifying the opensource code for the vsFTP server, to include a check for :) in the username field if a user included a :) in the username, the backdoor was activated.

So you might be wondering. What is a backdoor? 

A backdoor is a program, that an attacker places on a machine that gives the hacker access to that machine’s terminal.

In the step above, the attacker is activating the backdoor. In the subsequent steps, the attacker connects to the backdoor running on port 6200 and issues a command to the terminal.

Step 2: Connect the backdoor using Netcat

Now that you activated the back door you can log in to get access to the terminal (Get Shell). By connecting to the “ backdoor ” that is running on 6200. 

Connect the backdoor using Netcat.

Notice: Executes the ls command in the terminal of the compromised machine and returns the directory listing on the machine. 

Method 2: Using msfconsole (Metasploit Framework)

Using Metasploit is quite the easiest to exploit a machine. This will work if the exploit is within the search list.

Remember: If you want to be an Elite Hacker then you have to study coding and find out your own path to get a backdoor connection.

Follow the below steps to get exploit the server:

Step 1: Start the Metasploit Framework

Metasploit Framework comes preinstalled with ParrotSec and also in Kali. You can run it from Application → Pentesting → Exploitation Tools → Metasploit Framework → Metasploit Framework's console.

Step 2: Seach Exploit

Run the search command to find if is there any exploit available or not:

Step 3: Use Exploit

Run the "use" command to use the exploit to get interact with our target: You can also use the path (use eploit/unix/ftp/vsftpd_234_backdoor).

Step 4: Configure exploit options

Run show options and check the needed parameters.

• Here it only needs RHOSTS (Remote Hosts).

Step 5: Gain Access

Once All done! run exploit to get the shell:

Method 3: Using Armitage

Armitage also comes pre-installed with ParrotSec (Learn More).

Follow the below steps to exploit using Armitage:

Step 1: Setting up Armitage

You can run it from Application → Pentesting → Exploitation Tools → Metasploit Framework →  Armitage.

Once started click Connect:

Step 2: Quick Scan

Once you get connected you need to scan the hosts [Hosts→Scan→Quick Scan or Quick Scan(OS Scan)]. Enter the scan range to the vboxnet0 IP address on your machine in my case 192.168.56.1/24.

Step 3: Find Attacks

Once You find out your target then click on Attacks → find Attacks.

Note: Some time it may not work. Click on Armitage → Set Exploit Rank → Poor.

Step 4: Attack using vsftpd 2.3.4

Right-click on the target machine → Attack → ftp → vsftpd_234_backdoor.

Once everything ok click on Launch. If the exploit is successful then the look will be changed to attack mode:

Step 5: Get shell interaction

Right-click on the target machine → Shell 1 → interact. Now you can run commands in the below shells:

How to fix it?

So how do we fix this vulnerability? Newer versions of the vsftpd FTP server, have identified and patched these vulnerabilities, so the best way to secure this server is an updated version of vsftpd. sudo apt-get update vsftpd.(The Metasploitable machine is designed to be vulnerable so it is not configured to support updates.)

Goal: Gain root shell using telnet.

In my previous blog, we exploited the target using a Brute-force attack. In this chapter, we are going to gain root access from the bind shell.

From Nmap scanning, we have found that the bind shell service opens on port no: 1524.

It is easy to gain access to the Linux shell by the following command:

NFS is a Network File Sharing protocol that allows users to share directories and files over the network across different operating systems. In addition, it will enable remote systems to be accessible locally when the shares are mounted. The accessibility of the NFS shares is based on whatever privileges are assigned to the share.

Goal: Gain unauthorized access to sensitive data or obtain a shell on the system.

From the previous chapter, we have found out that ports: 111 and 2049 ports are open.

Let's again, examine the Metasploitable 2 server with the help of the Nmap scripting engine:

We see that both of them are open, and on port 111, a “/” directory is shown under NFS mount that we can try to mount. The “/” file system is usually owned by the root. If we are allowed to mount to the “/” path, we will be able to read root files and maybe write as well.

Mounting the '/' share

Let’s start mounting the “/” share and see what type of privileges we have. 

1. We will first start with creating a new directory locally in the “/mnt” directory, and I’ll call it metasploitable_share for the sake of this demo.

2. Mount the remote the NFS share “/” locally with the mount utility on Linux. Before that make sure you have enabled the superuser privileges:

An authorized key in SSH is a public key used for granting login access to users. The authentication mechanism is called public-key authentication. Authorized keys are configured separately for each user - usually in the . ssh/authorized_keys file in the user's home directory.

5. Open a terminal and run the below command to generate SSH key pair.

Prevention

• Place the appropriate restrictions on all NFS shares like restricting the IP addresses which can mount the exposed shares. 
• Allow read-only access to the exported shares if possible. 
• Do not export home directories. 
• Use the “root_squash” option in the NFS setting to prevent remote root users from accessing the share with high privileges. 

Samba is a software package that gives network administrators flexibility and freedom in terms of setup, configuration, and choice of systems and equipment.

Goal:Exploitation SMB(Server Message Block) port 139 and port 445 running on Metasploitable server.

Using msfconsole

The is quite easy to set up and easy to launch on Metasploit Framework. Let's run it on ParrotSec OS.

A wordlist is essentially a list of passwords that are collected in plain text. It's a text file that has a list of possible passwords that can be used to help someone crack passwords when necessary.

Usually, a wordlist helps for Brute forcing and Password Cracking Attacks. In ParrotSec and Kali Linux have their own inbuilt wordlists stored under /usr/share/wordlists/.

In the previous lesson, I demonstrated to you the easy way to exploit and server and get the shell intersection. In this lesson, you are going to learn a complicated and pretty powerful way to get the shell intersection is Brute-forcing.

At an earlier stage, if an authenticated user tries to access the FTP server, they need an appropriate username and password to get into the FTP server. 

Goal:  Try to perform a brute-force attack on the SSH, FTP, and Telnet services to get the login username and password.

What if a hacker tries to get into the server then they must need a proper authenticated username and password, otherwise, the login failed.

At this place, a Brute-force attack comes to work.

What is the meaning of Brute Force Attack?

A brute force attack is a hacking method that uses trial and error to crack passwords, login credentials, and encryption keys. It is a simple yet reliable tactic for gaining unauthorized access to individual accounts and organizations' systems and networks.

Brute-force the FTP server

What if you don't find any vulnerability on the target machine, then what we should do? The answer is you have to perform a brute-force attack on the target machine and try to crack the passwords.

While this is good, it’s not really practical to manually test every possible password. That’s why Hydra takes wordlists. You can specify a WordList instead of a single password.

Note: A brute-force attack can take lots of time, so keep calm and wait for the end.

There are lots of Brute-forcing tools available among then few are listed below:

• hydra
• Xhydra
• Ncrack
• medusa
• Patator

Brute-forcing using Hydra

According to Wiki:

Hydra is a parallelized network login cracker built in various operating systems like Kali Linux, Parrot, and other major penetration testing environments. Hydra works by using different approaches to perform brute-force attacks in order to guess the right username and password combination.

To find out helpful information about Hydra just run the help command:

From the above help command, we found that

• -l LOGIN or -L FILE         login with LOGIN name, or load several logins from FILE
• -p PASS or -P FILE            try password PASS, or load several passwords from FILE
• -v / -V / -d                            verbose mode / show login+pass for each attempt / debug mode

After all, these, let's perform a Brute-force Attack:

From above, we found that the username and password that marked in bold. Now, we can try to get into the FTP server using the below commands:

Brute Forcing the SSH services

The Secure Shell Protocol (SSH) is a cryptographic network protocol for operating network services securely over an unsecured network. Its most notable applications are remote login and command-line execution. SSH applications are based on a client–server architecture, connecting an SSH client instance with an SSH server.

To get a Proper connection you must have a proper username and password credentials. This is also similar to FTP services.

Let's try brute-forcing using Hydra:

• -l LOGIN or -L    : FILE login with LOGIN name, or load several logins from FILE
• -p PASS or -P       : FILE try password PASS, or load several passwords from FILE
• -t                           : TASKS run TASKS number of connects in parallel per target (default: 16)

In my previous lab, I demonstrated to you, how A Brute-Force Attack works on a server.

Goal: Brute forcing the Metasploitable server and gain SSH session.

Follow the below steps to get a login session:

Step 1: Start the msfconsole

Use the below command to start the Metasploit console in a proper way:

Step 2: Search the Auxiliary module

Next, we load up the scanner module in Metasploit:

From the Nmap scan result, we found that port 80 is running that means, it is an HTTP service running on port 80, signaling that this target might be hosting some explorable web content.

To look at the contents ourselves, we can open a web browser of our choice and navigate to the target's IP address in the URL bar at the top of the window. This will automatically address the target's port 80 for the client-server communication and load the web page's contents.

From the above screenshot, we observe that the running website shows us a few other pages that are accessible, and also a few are not listed on this website. At this place directory busting (dir busting) comes to work. For this purpose, we will be using the tool called gobuster, which is written in Go (Click here to learn more).

In order to start our dir busting, we will need to discover what capabilities gobuster has and which ones can assist us. By looking at the tool's help page, and by typing in the gobuster dir -h command in our terminal, we receive a list of all possible switches for the tool and their description.

In our case, we will only need to use the following:

• gobuster dir : specify we are using the directory busting mode of the tool
• -w: specify a wordlist, a collection of common directory names that are typically used for sites
• -u: specify the target's IP address
• -x : File extension(s) to search for

Let's perform Brute force the directories and files provided in the WordList of our choice (/usr/share/wordlists/dirbuster/path for wordlist).

Now that we have received the result we needed (phpinfo.php) from gobuster. By navigating to the newly found link manually through our web browser can be done by inputting the following address in our URL search bar. Once we proceed with this, we are met with the installed PHP information page:

From the above page, we found an exploit i.e., CGI.

Exploit The PHP_CGI

Step 1: Start the MSF console

Use the following command to start the Metasploit framework:

Step 2: Search exploit and configure the exploit

Use the below commands to configure the exploit.

Remember: The RHOST automatically uses your system IP address, so you have to check your vboxnet0 IP address using ifconfig vboxnet0.

Step 3: Execute the exploit

Once setup complete run "exploit" to get the meterpreter session:

Defend Against PHP_CGI Argument Injection

Keep updated your server to be free from exploitation.

Next:

Prev:

Goal:  Exploit Java Remote Method Invocation (java_rmi) to Get Root access.

Java Remote Method Invocation, or Java RMI, is an object-oriented RPC mechanism that allows an object located in one Java virtual machine to call methods on an object located in another Java virtual machine. This enables developers to write distributed applications using an object-oriented paradigm.

Auxiliary scanning using msfconsole

Start the Metasploit database and console by typing the below command in the terminal:

Exploiting Java_RMI

Back in our previous search results, locate the "exploit/multi/misc/java_rmi_server" module, and type use exploit/multi/misc/java_rmi_server to load it. 

Goal: Gain root privileges misconfigured Apache Tomcat/Coyote JSP engine 1.1 without msfconsole.

1. From the Nmap scan result, we found that port 80 is running which means, it is an HTTP service running on port 80, signaling that this target might be hosting some explorable web content.

2. To look at the contents ourselves, we can open a web browser of our choice and navigate to the target's IP address in the URL bar at the top of the window. This will automatically address the target's port 8180 for the client-server communication and load the web page's contents.

Tomcat Apache Default Page

JSP stands for JavaServer Pages. All this means is, web pages accessed through port 8180 will be assembled by a Java web application.

3. We can see above that the Apache Tomcat default page is shown when we access the target machine IP through the browser. 

This is a default page and it shows that Apache Tomcat is configured on the system. There are a lot of default functionalities that are used to configure Apache. I clicked on the “Tomcat Manager” option. It prompted for a username and password, as you can see below.

Coyote is a stand-alone web server that provides servlets to Tomcat applets. That is, it functions like the Apache web server, but for JavaServer Pages (JSP).

A prompt appears on my screen that asks me to input the username and password details to gain access to the Tomcat Web Application Manager.

4. Since the Apache default page was running, it might be a good idea to try login in with Tomcat default username and password. 

You can find the default credential by searching on the web. The results can be seen in the highlighted area of the following screenshot.

Default Credential for Apache Tomcat

5. From the Search result, I have tried the username and password combinations and I got success on tomcat:tomcat combination:

Tomcat Web Application Manager

6. Scroll down to see if there any upload option is available or not and you can find an upload option where you can deploy a WAR file. This is a good idea to take advantage of this to deploy a malicious war file to gain a reverse shell.

A WAR file (Web application ARchive) is a file used to distribute a collection of JAR-files, JavaServer Pages, Java Servlets, Java classes, XML files, tag libraries, static web pages (HTML and related files) and other resources that together constitute a web application.

7. To craft a malicious war file use the below command:

 where, 

• LHOST    : Listing Host (if don't remember your IP run ifconfig vboxnet0)
• LPORT    : Listining port (Give any port).
• -p              : Specifies Payload
• hack.war  : File name

8. A war file(hack.war) of 1098 bytes is created, and you can find it from /home directory. Once everything is fine run a listing host with the help of NetCat:

9. port 4444 is starting to list connections, once I run the hack.war file. To do this we have to upload the file to Tomcat Web Application Manager:

10. Once Deploy is successful you can locate the file from "Application Path". Click on /hack to get a connection to port 4444:

11. If everything is fine, you got a reverse shell connection on your Netcat:

12. To take a stable TTY shell on the target machine, run the below Python script:

13. Let's try to gain root access with the help of the sudo command:

To gain root access you might be required a valid root password.

Nmap Privilege Escalation