Metasploit Basic

​

Sanjay Makwana

​

https://www.linkedin.com/in/ersanjay/

Introduction Metasploit Framework

is a collection of exploits, shellcodes, fuzzing tools, payloads, encoders etc. Moreover, we can regard it as a collection of exploitation tools bundled into a single framework.

available in all major Linux, Windows, OS X platforms.

objective is to test your/company’s/organization’s defenses by attacking them. Something like “Offense for Defense”.

​

History

The Metasploit Project is a computer security project that provides information about security vulnerabilities and aids in penetration testing and IDS signature development.

Metasploit was created by H. D. Moore in 2003 as a portable network tool using Perl. By 2007, the Metasploit Framework had been completely rewritten in Ruby.^[3] On October 21, 2009, the Metasploit Project announced^[4] that it had been acquired by Rapid7, a security company that provides unified vulnerability management solutions.

Like comparable commercial products such as Immunity's Canvas or Core Security Technologies' Core Impact, Metasploit can be used to test the vulnerability of computer systems or to break into remote systems. Like many information security tools, Metasploit can be used for both legitimate and unauthorized activities. Since the acquisition of the Metasploit Framework, Rapid7 has added two open core proprietary editions called Metasploit Express and Metasploit Pro.

​

Modules & Interfaces

Metasploit Framework comes in a variety of interfaces

• msfconsole – An interactive curses like a shell to do all tasks.
• msfcli – Calls msf functions from the terminal/cmd itself. Doesn’t change the terminal.
• msfgui – the Metasploit Framework Graphical User Interface.
• Armitag – Another graphical tool written in Java to manage pentest performed with MSF.
• Metasploit Community(or above) Web Interface – The web-based interface provided by rapid7 for easy pentesting.
• CobaltStrike – Yet another GUI with some added features for post-exploitation, reporting etc.

​

Exploit

An exploit is a method by which the attacker takes advantage of a flaw within a system, service, application etc. The attacker generally uses this to do something with the particular system/service/application which he/she is attacking which the developer/implementer never intended to do. Kind of like misusing. This is the thing which an attacker uses to gain access to a system.

​

Payload

​

A payload is the piece of code which is run in the successfully exploited system. After an exploit works successfully, the framework injects the payload through the exploited vulnerability(flaw) and makes it run it within the target system. Thus an attacker gets inside the system or can get data from the compromised system using the payload.

​

Auxiliary

Provides additional functionality like fuzzing, scanning, recon, dos attack etc. Auxiliary scans for banners or OSes fuzzes or does a DOS attack on the target. It doesn’t inject a payload like exploits. Means you won’t be able to gain access to a system using an auxiliary

Source: “Mastering Metasploit” from PacktPub

​

Encoders

Encoders are used to obfuscate modules to avoid detection by a protection mechanism such as an antivirus or a firewall. This is widely used when we create a backdoor. The backdoor is encoded (even multiple times) and sent to the victim.

Source: “Mastering Metasploit” from PacktPub

​

​

Shellcode

Shellcode is a set of instructions used as a payload when exploitation occurs. Shellcode is typically written in assembly language. In most cases, a command shell or a Meterpreter shell will be provided after the series of instructions have been performed by the target machine, hence the name.

Source: “Metasploit- A pentester’s Guide”

​

Listener

​

A listener listens for connections from a payload injected into a compromised system.

​

Post

​

As the name suggests, these modules are used for post-exploitation. After a system is been compromised, we can dig deeper into the system or set it as a pivot to attack other systems using these modules

​

block diagram - architecture of Metasploit

Information Gathering

Nmap & db_nmap

• nmap -v -sV 192.168.1.0/24 -oA subnet_1
• search mssql

How to exploit a system using Metasploit:

​

1. Choose a certain exploit and configure it by writing the appropriate code to target a system. Then, exploit a certain bug in it.
2. Check whether the target system is susceptible to the given exploit.
3. Choose a certain payload to apply on the target system when managing to exploit it and get through it.
4. Choose the appropriate encoding technique in order to deceive the intrusion-prevention system (IPS) and make it ignore the oncoming payload.
5. Finally, execute the Exploit.

​

Some Commands used:

​

search<pattern> ::=> It searches for a match for a given pattern. For example: “search xxx” will search all occurrences of “xxx”

use<exploit name> ::=> It tells the program to use a particular exploit

SET parameter ::=> It sets the value for a given parameter

SETG parameter ::=> It sets the value for a given parameter globally, to avoid resetting the parameters again and again later on.

Exploit ::=> Finally. this performs the attack on the target system.

​

Contributors

​

Metasploit Framework operates as an open-source project and accepts contributions from the community through GitHub.com pull requests.^[13] Submissions are reviewed by a team consisting of both Rapid7 employees and senior external contributors. The majority of contributions add new modules, such as exploits or scanners.^[14]

List of original developers:

• H. D. Moore (founder and chief architect)
• Matt Miller (core developer from 2004–2008)
• spoonm (core developer from 2003–2008)

​