Downloaded 200 times
Uploaded byClubHack
Metasploitation part-1 (murtuja)
This document provides an overview of metasploitation and using the Metasploit framework. It discusses basics like vulnerabilities, exploits, payloads and encoders. It then covers using the msfconsole interface, exploit modules, auxiliary modules like scanners, databases integration, automation, client-side exploits, payload generation, backdooring files, Linux backdoors, Meterpreter, pivoting, and post-exploitation techniques. The document includes several screenshots and links resources for further information.
More Related Content
Similar to Metasploitation part-1 (murtuja)
Metasploitation part-1 (murtuja)
- 1. Metasploitation 4 Adults it’s not family affair… Murtuja Bharmal
- 2. Disclaimer Courtesy http://entertainment.desktopnexus.com_get_4642 1
- 3. About Me • Now Work Busy Man…. • Unemployed…. • Interest…. /dev/random…. • Co-founder of null…. :-D • X-IBMer’s ….. • Dal, Roti ka jugad, Security Consulting/Training
- 4. Agenda Courtesy http://asonchua.com
- 5. Agenda • Basics • Metasploit Auxiliary • Database Integration & Exploit Automation • Client Side Exploit & Extended Usage • Post Exploitation Fun • Metasploit Add-ons
- 6. Basics • What is vulnerability? • What is Exploit? • What is Payload? • What is encoder?
- 7. Vulnerability Courtesy http://harryjerry.com
- 8. Exploit Courtesy http://entertainment.in.msn.com
- 9. Payload • Use yourimagination
- 10. Encoder • Still Thinking?Ask me offline
- 11. Basics • Vulnerability – Opportunity Window • Exploit – En-cashing Opportunity • Payload – En-cashment Window • Encoder – Masking
- 12. How it works? •Input malicious code Instead of Data • Malicious code = Exploit Code + Payload
- 13. Payload + Exploit Sanitized You should be at ClubHACK Courtesy http://guardian.co.uk Courtesy http://ivillage.com
- 14. Exploit Code 1 2 3 4 Courtesy 1. advice.eharmony.com 2. superstock.com 3. good-times.webshots.com 4. sheknows.com
- 15. Metasploit Framework • Open Source • Developed in Ruby • Easy to Use • 600+ Exploits • 200+ payloads • 25+ encoders • 300+ auxiliary
- 16. Metasploit Auxiliary Courtesy http://www.flickr.com
- 17. Metasploit Architecture Courtesy http://www.offensive-security.com
- 18.
- 19. Filesystem And Libraries • lib: the 'meat' of the framework code base • data: editable files used by Metasploit • tools: various useful command-line utilities • modules: the actual MSF modules • plugins: plugins that can be loaded at run-time • scripts: Meterpreter and other scripts • external: source code and third-party libraries Courtesy http://www.offensive-security.com/metasploit-unleashed
- 20.
- 21. msfconsole • It isthe only supported way to access most of the features within Metasploit. • Provides a console-based interface to the framework • Contains the most features and is the most stable MSF interface • Full readline support, tabbing, and command completion • Execution of external commands in msfconsole is possible: Courtesy http://www.offensive-security.com/metasploit-unleashed
- 23. Exploit Modules Confused howto explain technically? Courtesy http://www.sunpacmortgage.com
- 24. Metasploit – Exploit& Payloads • Exploit – Active – Passive • Payload Types – Inline ( Non Staged) – Staged – Meterpreter – PassiveX – NoNX – Ord – IPv6 – Reflective DLL injection
- 25.
- 26. Metasploit Auxiliary • Helpermodules for pre-exploitation phase – Admin, DOS, Fuzzers, Gather, Scanner, Server, Spoof, SQLi, Sniffer, Test etc. • 300+ Auxiliary modules
- 27. We will cover • SCANNER • MSSQL • SNMP • FTP
- 28.
- 29. Database Integration andExploit Automation
- 30. Data Courtesy http://www.joy2day.com
- 31. Need of Database Sanitized Youshould be at ClubHACK
- 32. Need of Database •Network Penetration Testing • Easy management/storage of result • Report Generation
- 33. Database Integration& Exploit Automation • Database Support • Nmap • Nessus Bridge
- 34. Supported Database • Mysql- BackTrack 4 r2, MYSQL and Metasploit work together "out of the box“ • Postgres • Sqlite3 – file based database, might be pull-off in future
- 36. Nmap • db_nmap commandto scan host/network • Result will be stored in database • Can view the result using db_hosts and db_services command
- 37.
- 38. Nessus Bridge • Canperform vulnerability scan inside msfconsole • Supported using nessus bridge plugin • Use xmlrpc to connect with nessusd
- 41.
- 42. In a Fingertip • db_autopwn – Automate exploitation process – Take target /service/vulnerability info from database – Spawns a meterpeter shell on success – Noisy
- 44.
- 45. Client Side Exploit& Extended Usage
- 46.
- 47. Client Side Exploit& Extended Usage • Browser autopwn • Exploiting PDF • Payload Generation & Back-dooring EXE • Linux Backdoor
- 48. Browser autopwn • Automatebrowser based vulnerability exploitation • Perform browser finger printing • Auxiliary module server/browser_autopwnle
- 49.
- 50. Exploiting PDF • Mostexploited software since last 2 years • Universally used software for document format • Favorite carrier for commercial malware toolkit
- 51. What all PDFdo? • JavaScript runs under the context of App Object Model • File Attachment • XML, SOAP capabilities • Forms • Web Services • Database connections(ADBC)
- 52. What’s cracking up? •Vulnerable APIs – util.printf() (CVE-2008-2992) – getIcons() (CVE-2009-0927) – getAnnots() (CVE-20091492) – customDictionaryOpen() (CVE-2009-1493) – Doc.media.newPlayer (CVE-2009-4324) • File parsing vulnerabilities – JBIG2( Over a dozen CVE) – libTiff (CVE-2010-0188) • Social engineered arbit. command execution – PDF escape by Didier Stevens – Not a bug (feature) – Exploitation in the wild • Embedded Files – libTiff (CVE-2010-0188)
- 53.
- 54. Payload Generation andBackdooring EXE • Payload can be converted to various file format i.e. exe, dll, javascript etc. • Encode payload to evade antivirus • Can be embed with third party software/utility
- 55.
- 56. Linux Backdoor • Back-dooringpayload with linux package • Embed payload with deb installation package
- 57.
- 58.
- 59. Metasploit Add-ons Courtesy http://draftblogmm.blogspot.com
- 60. Fast-Track • Easy Automation •Utilize Metaspolit Framework on Backend • Modes – Interactive – Web interface
- 61.
- 62. SET(Social Engineering Toolkit) •Weakest link in the information security chain is the natural human willingness to accept someone at their word. • SET focuses on attacking the human element • Develop in python • Very easy to use • Utilize Metaspolit Framework on Backend
- 63. SET(Social Engineering Toolkit) •Operational Mode – Interactive – Web Interface • Configuration file - config/set_config
- 64.
- 65.
- 66.
- 67. What next aftergetting a Shell? • One can run the command supported by command prompt/shell. • So what extra bit control needed to en-cash the opportunity?
- 68. Meterpreter • Meta Interpreter • Post exploitation payload(tool) • Uses in-memory DLL injection stagers • Can be extended over the run time • Encrypted communication
- 69. What can bedone? • Command execution • File Upload/Download • Process migration • Log Deletion • Privilege escalation • Registry modification • Deleting logs and killing antivirus • Backdoors and Rootkits • Pivoting • …..etc.
- 70.
- 71. Channels • Communication usingTLV (Type-Length-Value) • Tagging of data with channel number • Multiple program can be run at victim machine using different channel
- 72. Pivoting 2 1 LAN INTERNET Local Lan Firewall/IPS 4 3 Web Database Server DMZ Server
- 73.
- 74. Courtesy • http://www.metasploit.com/ • http://www.backtrack-linux.org •http://www.offensive-security.com/metasploit- unleashed/ • http://www.secmaniac.com/ • http://securitytube.net/ • http://vimeo.com/ • http://www.irongeek.com/ • http://www.windowsecurity.com/whitepapers/Social- Engineering-The-Weakest-Link.html • http://www.google.co.in
- 75. Thank You Murtuja Bharmal [email protected] Courtesy http://blingboo.com