Metasploit
Things it can do
Exploit known vulnerabilities
Attack passwords over Telnet, SSH and HTTP
Metasploit Actions
1.Select exploit
2.Configure options
3.Select target
4.Select Payload
5.Launch exploit
Metasploit Architecture
Framework base - Accepts inputs from custom plug-ins
Interfaces - How you interact with the framework
Security Tools
Web Services
Modules - Holds the actual exploits
Payloads - combines the arbitrary code executed if the exploit is successful
Auxiliary - used to run one-off actions (like a scan)
NOPS - used mainly for buffer-overflow-type operations
REX - library for most tasks, such as handling sockets, protocols, and text transformations
Metasploit Modules
Exploit - Holds all of the exploit code
Payload - Holds the various bits of shellcode sent to have execute after exploitation
Auxiliary - Used in scanning and verification are exploitable
Post - Provides capabilities of looting and pivoting
Encoder - Used for payload obfuscation and avoid signature detection
NOP - used with buffer overflow and ROP attacks
Payload Types
Singles: self-contained payloads (add user, launch notepad.exe, etc.) that do not need to download an additional component to run
Stagers:
Responsible for setting up a connection channel between Metasploit and the target system.
Useful when working with staged payloads.
Staged payloads will first upload a stager on the target system then download the rest of the payload.
Provides some advantages as the initial size of the payload will be relatively small compared to the full payload sent at once
Stages: Downloaded by the stager, allows us to use larger sized payloads
How to identify single payloads vs staged payloads
Single payloads have a
_between "shell" and "reverse" (Ex.generic/shell_reverse_tcp)Staged payloads have a
/(Ex.windows/x64/shell/reverse_tcp)
Exploit Ranking
Exploits are rated based on their reliability
Ranking
Description
Excellent Ranking
The exploit will never crash the service. No typical memory corruption exploits should be given this ranking unless there are extraordinary circumstances.
Great Ranking
The exploit has a default target AND either auto-detects the appropriate target or uses an application specific return address AFTER a version check
Good Ranking
The exploit has a default target and it is the "common case" of this type of software
Normal Ranking
The exploit is otherwise reliable, but depends on a specific version and can't reliably autodetect
Average Ranking
The exploit is generally unreliable or difficult to exploit
Low Ranking
The exploit is nearly impossible to exploit (or under 50% success rate) for common platforms
Manual ranking
The exploit is unstable or difficult to exploit and is basically a DoS. This ranking is also used when the module has no use unless specifically configured by the user
Metasploit Utilities
Utilities are direct interfaces to particular features of the Framework that can be useful in some situation, especially in exploit development.
MSFpayload
Allows you to generate shellcode, executables and more
Use
msfpayload -hto see which options the utility takesAppend the letter O for a list of required and optional variables -
msfpayload windows/shell_reverse_tcp O
MSFencode
Helps avoid bad characters and evade antivirus and IDSs by encoding the original payload
Enter
msfencode -hto see a list of optionsCan't go wrong with
x86/shikata_ga_nai
Nasm Shell
Useful when you need to make sense of assembly code and need to identify the
opcodes(assembly instructions) for a given assembly command
Command Cheat Sheet
Last updated
