![Metasploit Framework
Current stable version is v4.13.X
• Written in ruby, https://github.com/rapid7/metasploit-framework.git,
• [ 1610 exploits, 914 auxiliary, 279 post ,471 payloads , 39 encoders , 9 nops ]
Ready in kali - used in this demo.
Available as windows installer. (Never really tried!..)](https://image.slidesharecdn.com/metasploitforbeginnersatnull-170121140307/85/Metasploit-For-Beginners-5-320.jpg)
Metasploit For Beginners
- 2. Whoami Ramnath Shenoy • Engineering @ FireEye • https://www.linkedin.com/in/ramnathshenoyk • @Ramnathsk
- 3. Metasploit for Beginners ●Why Metasploit? ●Demo Setup ●Auxiliary Module ●Exploit Module ●Payloads ●Demo 1 - Elastic Search exploit ●Demo 2 - Jenkins exploit
- 4. Why Metasploit? ● Published independently ● Different programming languages ● Targeted limited to a specific platform ● No evasion techniques ● No clear documentation ● No coding style and difficult to embed /modify
- 5. Metasploit Framework Current stable version is v4.13.X • Written in ruby, https://github.com/rapid7/metasploit-framework.git, • [ 1610 exploits, 914 auxiliary, 279 post ,471 payloads , 39 encoders , 9 nops ] Ready in kali - used in this demo. Available as windows installer. (Never really tried!..)
- 6. Metasploit Architecture Libraries Interfaces Modules nops payloads exploits Auxiliary Encoder Post msfconsole Rex MSF::Core MSF::Base Tools Plugins
- 7. Visualising an attack Target Vulnerable software PayloadExploitAuxiliary Windows/Shell Windows/add user Remote exploit Local exploit Scan and enumerate Rogue Servers Post Enum credentials Exploit suggest Exploit Payload Post msfconsole
- 8. Demo Setup! Target Windows 2008 R2 – Metasploitable3 Designed vulnerable to test payload Setup instructions https://github.com/rapid7/metasploitable3 172.28.128.4 Metasploit/kali Attacker 172.28.128.3 Victim Windows 2k8 Virtual Box
- 9. Msfconsole Navigation cheat sheet! Msfupdate - update Msfconsole – initialize metasploit >help - example: help search >search – example: search name:pcman type:exploit >show - example show info, show options and show advanced >use - example use exploit/.., use aux/.., use payload/.. >set, unset, setg & unsetg - set payload/.. set exitfunc >back,previous Exploit ,POST and Payload specifics >set RHOST : Victim IP >set RPORT: Victim port >set LHOST: Attacker IP >set LPORT: Attacker Port on Reverse Connect or Victim Port on Bind >set SESSION: The Session id of an earlier attack to attempt Local priv esc
- 10. Commands Prior Demo! • Start the PostgreSQL, initialize database for metasploit and then proceed with starting msfconsole • Setup a workspace within metasploit to store enumeration result • Initialise a scan with nmap to store its results. Results in db will be accessible via “services”
- 11. Auxiliary Module - Demo • Brute Force access tests on different protocols. • Enumerate and gather more information with limited access. • Check for misconfigured or default Web Portals. • Set up a rogue- ftp,http,smb,imap servers
- 12. Auxiliary Module - “use auxiliary/scanner/snmp/snmp_enum”
- 13. Exploit Module Searching remote exploits are typically -> exploit/Platform/protocol/Application_or_service Searching local exploits are typically -> exploit/Platform/local/Application_or_service
- 14. Payload Module Bind Shell TCP • Successful exploitation leads to a new port on Victim with shell access. Reverse Shell TCP • Successful exploitation makes to client connect to Attack and provide its shell. BindShell-Listener Reverse Shell-Listener Exploit Exploit
- 15. Exploit Module -Demo exploit/multi/elasticsearch/script_mvel_rce ElasticSearch ->1.1.1 Payload -> java/shell/reverse_tcp
- 16. Exploit Module 2 In these cases we will need to use the attacker machine as a server, servicing the delivery of the exploit. We will need 2 more options, SRVHOST and SRVPORT Meterpreter Payload ,provides an interactive environment with functionalities likes • Getsystem, clearnenv, migrate, hashdump, post, up/download,edit • Run portrecorder , load mimikatz..
- 17. Exploit Module -Demo 2 • exploit/multi/http/jenkins_script_console • windows/meterpreter/reverse_tcp
- 18. Thanks.
Editor's Notes
- #6: Why ruby? https://dev.metasploit.com/pipermail/framework/2006-October/001325.html On ubuntu? http://www.darkoperator.com/installing-metasploit-in-ubunt/