Metasploit framework, часть вторая

Содержание:

Установка приложения для Android

Metasploit termux — это приложение для Android, поддерживающее среду Linux.

Чтобы установить ПО, выполняют такие действия:

Устанавливают Termux Google Play-Store.
Вводят команду «apt update».
Обновляют команду «apt install curl».
Вводят «cd $ HOME».
После завершения загрузки вышеуказанного файла вводят «ls», откроется файл «.sh».
Вводят эту команду «chmod + x metasploitTechzindia.sh».
Запускают скрипт по команде типа «sh metasploitTechzindia.sh».
Вводят «ls».
Находят папку «Metasploit-framework».
Открывают папку «cd yourfoldername».
Вводят команду «ls».
Вводят «./msfconsole» для запуска MSF.

Metasploit commands

We will go through the Metasploit basic commands quickly so we can get started with the fun part and learn how to use the exploits on a vulnerable machine like Metasploitable 2. The basics command consist of help, back, exit and info.

Use, back and exit commands

The use command in Metasploit is used to activate a particular module and changes the context of the msfconsole to that particular module. The exploit name will be mentioned in red on the command line as following:

In this example we have changed the context of the command line to the exploit called realvnc_client. From here on we can retrieve information about this exploit, set the required exploit parameters and run it against a target.

If we want to leave the exploit context and switch back to the msfconsole we need to use the back command. The back command will take us back to the msfconsole in the general context. From here on we can issue the use command again to switch to another Metasploit module.

The exit command will close the msfconsole and will take you back to the Kali Linux terminal.

Help command

As we’ve seen earlier in this tutorial the help command will return a list of possible commands together with a description when typed at the msfconsole. When there is an active exploit selected we can use the help command to get a list of exploit commands:

Info command

When an exploit is selected with the use command we can retrieve information like the name, platform, author, available targets and a lot more by using the info command. In the following screenshot we’ve use the info command on an exploit named ie_execcommand_uaf:

Search command

As of this writing Metasploit contains over 1.500 different exploits and new ones are added regularly. With this number of exploit the search function, and knowing how to use it, becomes very important. The easiest way of using the search function is by issuing the command search followed by a search term, for example flash to search for exploits related to Flash player. By using the search command Metasploit will search for the given search term in the module names and description as following:

As expected there are a lot of exploits related to the often vulnerable Flash player software. The list also includes CVE-2015-5122 Adobe Flash opaqueBackground Use After Free zero-day which was discovered in the Hacking Team data breach last year.

Searching with exploits with keywords

You can also use the search command with a keyword to search for a specific author, an OSVDB ID or a platform. The ‘help search’ command displays the available keywords in the msfconsole as following:

The usage of the search command with a keyword is pretty straight forward and displayed at the bottom of the help text. The following command is used to search for modules with a CVE ID from 2016:

msf > search cve:2016

This returns us all exploits with a CVE ID from 2016 including and auxiliary module scanner for the very recent Fortinet firewall SSH backdoor:

Metasploit commands for exploits

In the previous chapter we’ve learned the Metasploit commands to activate an exploit on the msfconsole and change the command line context to the exploit with the use command. Now we will be looking at how to show the exploit parameters and how to change them with the set command. We will also be looking at how to show the payloads, targets, advanced and evasion options. The help show command will display the available parameters for the show command:

Show options

The show options command will show you the available parameters for an exploit if used when the command line is in exploit context. Let’s use the adobe_flash_shader_drawing_fill exploit and have a look at the options with the following command:

msf > Use exploit/multi/browser/ adobe_flash_shader_drawing_fill

Followed by the show options command:

msf > show options

The Flash exploit contains a total of 6 options from which only 2 are required:

Retries
SRVHOST (Required)
SRVPORT (Required)
SSL
SSLCert
URLPath

Note that the show options command is returning the current selected target below the module options. The default target is 0 which is Windows for the selected exploit.

Use the set command followed by the option name and the new value to change the default values:

Set SRVHOST 192.168.0.100 to change the SRVHOST value to 192.168.0.100

Set SRVPORT 80 to change the port from 8080 to 80

By using the show options command again you can verify that the SRVHOST and SRVPORT values have been changed. You can change Boolean values by using the set command with option name and true or false.

Show payloads

When we use the show payloads command the msfconsole will return a list of compatible payloads for this exploit. In our flash player exploit example it will return quite a few compatible payloads:

An overview of compatible exploits

To use a certain payload you need to use the set command followed by the payload name:

Set payload linux/x86/exec

Show targets

The show targets command will return a list of operating systems which are vulnerable to the selected exploit. When we run the command we get the following output for the adobe_flash_shader_drawing_fill exploit:

An overview of available targets for the selected exploit.

This exploit targets both Windows and Linux operating systems. Note that we can use the info command to get additional info about this exploit and targets.

To set a target we can use the command set followed by the target ID:

set target 1

By setting the target the list of payloads will be reduced a lot because only payloads will be shown which are compatible with the target:

Show advanced

By using the show advanced command we can have a look at the advanced options for the exploit.

Use the set command followed by the advanced parameter and the new value to change the advanced settings:

Set displayablepayloadhandler true

Show encoders

The show encoders command will return the compatible encoders. Encoders are used to evade simple IDS/IPS signatures that are looking for certain bytes of your payload. We will be looking at encoders in detail in a later chapter of the Metasploit tutorials.

To use an encoder use the set command followed by the name of the encoder.

Show nops

The show nops command will return a list of NOP generators. A NOP is short for No Operation and is used to change the pattern of a NOP sled in order to bypass simple IDS/IPS signatures of common NOP sleds. The NOP generators start with the CPU architecture in the name. We will be looking at NOPS in a later chapter of this tutorial.

To use a NOP generator use the set command followed by the name of the NOP generator. When the exploit is launched the NOP sleds will be taken from the NOP generator.

Show evasion

The show evasion command returns a list of available evasion techniques.

To change evasions settings use the set command followed by the evasion parameter and the new value.

Metasploit commands for exploit execution

When all the required options have been set for the exploit, including a payload and advanced settings like a NOP generator, evasion options and encoding, the exploit is ready to be executed. The exploit can be executed using two commands: run and exploit. Just type run or exploit in the msfconsole and the exploit will run.

This will conclude the Metasploit commands tutorial for now. If you have questions regarding any of the mentioned or non mentioned commands, please ask them using the comment functionality below this post. In the next Metasploit tutorial we will enumerating the Metasploitable 2 machine. After that we will be doing a vulnerability assessment with the gathered information. If you haven’t installed Metasploitable 2 yet, you can follow the Metasploitable 2 installation tutorial first.

Tips and tricks

Searching from the database

Since everything in Metasploit is stored in a database, it is easy to make powerful search queries without the need of the frontend command.

To start the database interface, run:

$ psql msf

The information about modules is stored in 8 tables:

Table Name	Contents
	The «main» table, describes various details of each module
	The action names of auxiliary modules
	The target hardware architecture or software platform
	Names and emails of module author
	Empty (???)
	The target operating system. See also
	References to various online exploit databases and reports
	The target program name and version of the exploit

Tip: To see what type of details (columns) a table contains, run . For example: .

Almost all tables have 3 columns: , and , except for table which has 16 columns.

The values are pointers to the rows of table.

To see the all the contents of a table, run:

SELECT * FROM table_name;

Multiple:

Architecture
Platform
Target

Module options:

module type
stance
privileged
path
name
refname
rank
privileged
disclosure date

Database search examples

The table contains multiple columns and viewing them all at once is not convenient. To show only basic information about the modules:

SELECT id, mtype, refname, disclosure_date, rank, stance, name
FROM module_details;

Show some information about available modules, include platform information from :

SELECT module_details.id, mtype, module_platforms.name as platform, refname, DATE(disclosure_date), rank, module_details.name
FROM module_details JOIN module_platforms ON module_details.id = module_platforms.detail_id;

Show all client (aggressive) exploits for Windows platform:

SELECT module_details.id, mtype, module_platforms.name as platform, refname, DATE(disclosure_date), rank, module_details.name
FROM module_details JOIN module_platforms ON module_details.id = module_platforms.detail_id
WHERE module_platforms.name = 'windows'
AND mtype = 'exploit'
AND stance = 'aggressive';

Show all exploits for Windows platform with rank >= 500 disclosed after 2013:

SELECT module_details.id, mtype, module_platforms.name as platform, refname, DATE(disclosure_date), rank, module_details.name
FROM module_details JOIN module_platforms ON module_details.id = module_platforms.detail_id
WHERE module_platforms.name = 'windows'
AND mtype = 'exploit'
AND rank >= 500
AND disclosure_date >= TIMESTAMP '2013-1-1';

Show all aggressive (client) exploits for Windows platform with rank >= 500 and include additional information about module’s target:

SELECT module_details.id, mtype, module_platforms.name as platform, module_details.name, DATE(disclosure_date), rank, module_targets.name as target
FROM module_details JOIN module_platforms ON module_details.id = module_platforms.detail_id JOIN module_targets on module_details.id = module_targets.detail_id
WHERE module_platforms.name = 'windows'
AND mtype = 'exploit'
AND stance = 'aggressive'
AND rank >= 500
order by target;

Popularity of a platform by number of exploits

To view the possible values, and number of available exploits, run from :

SELECT name, count(*)
FROM module_platforms
GROUP BY name
ORDER BY count DESC;

To disable the banner, run with / argument:

$ msfconsole --quiet

Preserve variable values between sessions

If you do not want the variables to reset when selecting another module and when rerunning then set it globally via , for example:

msf > setg RHOST 192.168.56.102

Basic Msfconsole commands

Assuming you are on Kali Linux 2016 rolling edition we can start the Metasploit framework and msfconsole by clicking the Metasploit icon in the dock. This will start the PostgreSQL service and Metasploit service automatically.

Updating Metasploit with msfupdate

Let’s start with updating Metasploit by using the following command in a terminal session (not in msfconsole):

msfupdate

This command should update the Metasploit framework to the latest version. The updates says that we should be expecting updates weekly(ish). Beware: Running msfupdate might break your Metasploit installation. After running this command for this tutorial we ran into errors like:

An error occurred while installing pg (0.18.3), and Bundler cannot continue.
Make sure that succeeds before bundling.

This error had something to do with PostgreSQL and to fix this problem first try to run the following commands:

apt-get update

apt-get upgrade

apt-get dist-upgrade

This solved to problem on our side, it probably had something to do with an outdated version of a package. Is your Metasploit installation broken after running an update and you need some help to fix it? Use the comment function below and we’ll try to help you as best as we can. Let’s continue with the msfconsole.

Metasploit msfconsole

When Metasploit has booted and the msfconsole is available we can type ‘help’ to get an overview of the Metasploit core and backend commands with a description:

Обзор веб-интерфейса MSF

Веб-интерфейс на основе браузера содержит рабочее пространство, которое используют для настройки проектов и выполнения задач пентестирования и предоставляет навигационные меню для доступа к страницам конфигурации модуля. Пользовательский интерфейс работает в следующих браузерах.

С его помощью выполняется запуск сканирования обнаружения, запуск эксплойта против цели, создание отчета, настройка системных настроек и выполнение административных задач. Каждая имеет свою собственную страницу конфигурации, которая отображает все параметры и настройки. В пользовательском интерфейсе отображаются поля, необходимые для ввода данных, параметры флажков, которые можно включить или отключить в зависимости от требований теста, и раскрывающиеся меню.

Страница обзора демонстрирует статистическую информацию для проекта, такую как количество обнаруженных хостов и служб, а также количество полученных сеансов и учетных данных. Проект не будет отображать статистику или панель инструментов, пока не будет отсканирована цель или импортированы данные хоста, после чего отобразится панель мониторинга, которая предоставляет высокоуровневую графическую разбивку данных, хранящихся в проекте и журнал последних событий.

History

Metasploit was created by H. D. Moore in 2003 as a portable network tool using Perl. By 2007, the Metasploit Framework had been completely rewritten in Ruby. On October 21, 2009, the Metasploit Project announced that it had been acquired by Rapid7, a security company that provides unified vulnerability management solutions.

Like comparable commercial products such as Immunity’s Canvas or Core Security Technologies’ Core Impact, Metasploit can be used to test the vulnerability of computer systems or to break into remote systems. Like many information security tools, Metasploit can be used for both legitimate and unauthorized activities. Since the acquisition of the Metasploit Framework, Rapid7 has added two open core proprietary editions called Metasploit Express and Metasploit Pro.

Metasploit’s emerging position as the de facto exploit development framework led to the release of software vulnerability advisories often accompanied by a third party Metasploit exploit module that highlights the exploitability, risk and remediation of that particular bug. Metasploit 3.0 began to include fuzzing tools, used to discover software vulnerabilities, rather than just exploits for known bugs. This avenue can be seen with the integration of the lorcon wireless (802.11) toolset into Metasploit 3.0 in November 2006. Metasploit 4.0 was released in August 2011.

Установка

Установите пакет из AUR.

Для использования нестабильной версии установите AUR.

Для использования Armitage необходима . Также обязательно использование файла .

Примером файла является .

RVM

Msfconsole нуждается в Ruby и некоторых .

Используя статьи и , установите Ruby версии 2.1.5 и сделайте её стандартной. (прим.ред.: если честно, пакет metasploit при установке сам делает эти операции. Не знаю точно, необходимо это делать или нет, но, используя этот гайд, мне пришлось переустанавливать всё 3-4 раза, чтобы оно заработало. Возможно, фреймворк заработает и без выполнения этого пункта инструкции)

Завершите установку RVM:

$ source ~/.rvm/scripts/rvm

и установите все гемы Msfconsole, используя :

$ gem install bundler

$ bundle install

(прим.ред.: лично я в гемфайле указал стандартные гемы и metasploit-concern)

Примечание: Использование версии Ruby старше чем 2.1.5 приведёт к ошибке установки гема .

Metasploit interfaces

There are several interfaces for Metasploit available. The most popular are maintained by Rapid7 and Strategic Cyber LLC.

Metasploit Framework Edition

The free version. It contains a command line interface, third-party import, manual exploitation and manual brute forcing. This free version of the Metasploit project also includes Zenmap, a well known port-scanner, and a compiler for Ruby, the language in which this version of Metasploit was written.

Metasploit Pro

In October 2010, Rapid7 added Metasploit Pro, an open-core commercial Metasploit edition for penetration testers. Metasploit Pro adds onto Metasploit Express with features such as Quick Start Wizards/MetaModules, building and managing social engineering campaigns, web application testing, an advanced Pro Console, dynamic payloads for anti-virus evasion, integration with Nexpose for ad-hoc vulnerability scans, and VPN pivoting.

Discontinued editions of Metasploit

Metasploit Community Edition

On July 18, 2019, Rapid7 announced the end-of-sale of Metasploit Community Edition. Existing users were able to continue using it until their license expired.

The edition was released in October 2011, and included a free, web-based user interface for Metasploit. Metasploit Community Edition was based on the commercial functionality of the paid-for editions with a reduced set of features, including network discovery, module browsing and manual exploitation. Metasploit Community was included in the main installer.

Metasploit Express Edition

On June 4, 2019, Rapid7 discontinued Metasploit Express Edition.

The edition was released in April 2010, and was an open-core commercial edition for security teams who need to verify vulnerabilities. It offers a graphical user interface, It integrated nmap for discovery, and added smart bruteforcing as well as automated evidence collection.

Armitage

Armitage is a graphical cyber attack management tool for the Metasploit Project that visualizes targets and recommends exploits. It is a free and open source network security tool notable for its contributions to red team collaboration allowing for shared sessions, data, and communication through a single Metasploit instance.

Cobalt Strike is a collection of threat emulation tools provided by Strategic Cyber LLC to work with the Metasploit Framework. Cobalt Strike includes all features of Armitage and adds post-exploitation tools, in addition to report generation features.