Metasploitation part-1 (murtuja)
2 likes•1,618 views
This document provides an overview of metasploitation and using the Metasploit framework. It discusses basics like vulnerabilities, exploits, payloads and encoders. It then covers using the msfconsole interface, exploit modules, auxiliary modules like scanners, databases integration, automation, client-side exploits, payload generation, backdooring files, Linux backdoors, Meterpreter, pivoting, and post-exploitation techniques. The document includes several screenshots and links resources for further information.
Metasploitation part-1 (murtuja)
- 1. Metasploitation 4 Adults it’s not family affair… Murtuja Bharmal
- 2. Disclaimer Courtesy http://entertainment.desktopnexus.com_get_4642 1
- 3. About Me • Now Work Busy Man…. • Unemployed…. • Interest…. /dev/random…. • Co-founder of null…. :-D • X-IBMer’s ….. • Dal, Roti ka jugad, Security Consulting/Training
- 4. Agenda Courtesy http://asonchua.com
- 5. Agenda • Basics • Metasploit Auxiliary • Database Integration & Exploit Automation • Client Side Exploit & Extended Usage • Post Exploitation Fun • Metasploit Add-ons
- 6. Basics • What is vulnerability? • What is Exploit? • What is Payload? • What is encoder?
- 7. Vulnerability Courtesy http://harryjerry.com
- 8. Exploit Courtesy http://entertainment.in.msn.com
- 9. Payload • Use your imagination
- 10. Encoder • Still Thinking? Ask me offline
- 11. Basics • Vulnerability – Opportunity Window • Exploit – En-cashing Opportunity • Payload – En-cashment Window • Encoder – Masking
- 12. How it works? • Input malicious code Instead of Data • Malicious code = Exploit Code + Payload
- 13. Payload + Exploit Sanitized You should be at ClubHACK Courtesy http://guardian.co.uk Courtesy http://ivillage.com
- 14. Exploit Code 1 2 3 4 Courtesy 1. advice.eharmony.com 2. superstock.com 3. good-times.webshots.com 4. sheknows.com
- 15. Metasploit Framework • Open Source • Developed in Ruby • Easy to Use • 600+ Exploits • 200+ payloads • 25+ encoders • 300+ auxiliary
- 16. Metasploit Auxiliary Courtesy http://www.flickr.com
- 17. Metasploit Architecture Courtesy http://www.offensive-security.com
- 19. Filesystem And Libraries • lib: the 'meat' of the framework code base • data: editable files used by Metasploit • tools: various useful command-line utilities • modules: the actual MSF modules • plugins: plugins that can be loaded at run-time • scripts: Meterpreter and other scripts • external: source code and third-party libraries Courtesy http://www.offensive-security.com/metasploit-unleashed
- 20. msfconsole
- 21. msfconsole • It is the only supported way to access most of the features within Metasploit. • Provides a console-based interface to the framework • Contains the most features and is the most stable MSF interface • Full readline support, tabbing, and command completion • Execution of external commands in msfconsole is possible: Courtesy http://www.offensive-security.com/metasploit-unleashed
- 23. Exploit Modules Confused how to explain technically? Courtesy http://www.sunpacmortgage.com
- 24. Metasploit – Exploit & Payloads • Exploit – Active – Passive • Payload Types – Inline ( Non Staged) – Staged – Meterpreter – PassiveX – NoNX – Ord – IPv6 – Reflective DLL injection
- 25. Exploit DEMO
- 26. Metasploit Auxiliary • Helper modules for pre-exploitation phase – Admin, DOS, Fuzzers, Gather, Scanner, Server, Spoof, SQLi, Sniffer, Test etc. • 300+ Auxiliary modules
- 27. We will cover • SCANNER • MSSQL • SNMP • FTP
- 28. Auxiliarry DEMO
- 29. Database Integration and Exploit Automation
- 30. Data Courtesy http://www.joy2day.com
- 31. Need of Database Sanitized You should be at ClubHACK
- 32. Need of Database • Network Penetration Testing • Easy management/storage of result • Report Generation
- 33. Database Integration& Exploit Automation • Database Support • Nmap • Nessus Bridge
- 34. Supported Database • Mysql - BackTrack 4 r2, MYSQL and Metasploit work together "out of the box“ • Postgres • Sqlite3 – file based database, might be pull-off in future
- 36. Nmap • db_nmap command to scan host/network • Result will be stored in database • Can view the result using db_hosts and db_services command
- 37. NMAP Demo
- 38. Nessus Bridge • Can perform vulnerability scan inside msfconsole • Supported using nessus bridge plugin • Use xmlrpc to connect with nessusd
- 42. In a Finger tip • db_autopwn – Automate exploitation process – Take target /service/vulnerability info from database – Spawns a meterpeter shell on success – Noisy
- 44. db_autopwn Demo
- 45. Client Side Exploit & Extended Usage
- 47. Client Side Exploit & Extended Usage • Browser autopwn • Exploiting PDF • Payload Generation & Back-dooring EXE • Linux Backdoor
- 48. Browser autopwn • Automate browser based vulnerability exploitation • Perform browser finger printing • Auxiliary module server/browser_autopwnle
- 50. Exploiting PDF • Most exploited software since last 2 years • Universally used software for document format • Favorite carrier for commercial malware toolkit
- 51. What all PDF do? • JavaScript runs under the context of App Object Model • File Attachment • XML, SOAP capabilities • Forms • Web Services • Database connections(ADBC)
- 52. What’s cracking up? • Vulnerable APIs – util.printf() (CVE-2008-2992) – getIcons() (CVE-2009-0927) – getAnnots() (CVE-20091492) – customDictionaryOpen() (CVE-2009-1493) – Doc.media.newPlayer (CVE-2009-4324) • File parsing vulnerabilities – JBIG2( Over a dozen CVE) – libTiff (CVE-2010-0188) • Social engineered arbit. command execution – PDF escape by Didier Stevens – Not a bug (feature) – Exploitation in the wild • Embedded Files – libTiff (CVE-2010-0188)
- 54. Payload Generation and Backdooring EXE • Payload can be converted to various file format i.e. exe, dll, javascript etc. • Encode payload to evade antivirus • Can be embed with third party software/utility
- 56. Linux Backdoor • Back-dooring payload with linux package • Embed payload with deb installation package
- 59. Metasploit Add-ons Courtesy http://draftblogmm.blogspot.com
- 60. Fast-Track • Easy Automation • Utilize Metaspolit Framework on Backend • Modes – Interactive – Web interface
- 61. Fast-Track Demo
- 62. SET(Social Engineering Toolkit) • Weakest link in the information security chain is the natural human willingness to accept someone at their word. • SET focuses on attacking the human element • Develop in python • Very easy to use • Utilize Metaspolit Framework on Backend
- 63. SET(Social Engineering Toolkit) • Operational Mode – Interactive – Web Interface • Configuration file - config/set_config
- 64. SET Demo
- 67. What next after getting a Shell? • One can run the command supported by command prompt/shell. • So what extra bit control needed to en-cash the opportunity?
- 68. Meterpreter • Meta Interpreter • Post exploitation payload(tool) • Uses in-memory DLL injection stagers • Can be extended over the run time • Encrypted communication
- 69. What can be done? • Command execution • File Upload/Download • Process migration • Log Deletion • Privilege escalation • Registry modification • Deleting logs and killing antivirus • Backdoors and Rootkits • Pivoting • …..etc.
- 70. Demo Meterpreter
- 71. Channels • Communication using TLV (Type-Length-Value) • Tagging of data with channel number • Multiple program can be run at victim machine using different channel
- 72. Pivoting 2 1 LAN INTERNET Local Lan Firewall/IPS 4 3 Web Database Server DMZ Server
- 73. Demo Pivoting
- 74. Courtesy • http://www.metasploit.com/ • http://www.backtrack-linux.org • http://www.offensive-security.com/metasploit- unleashed/ • http://www.secmaniac.com/ • http://securitytube.net/ • http://vimeo.com/ • http://www.irongeek.com/ • http://www.windowsecurity.com/whitepapers/Social- Engineering-The-Weakest-Link.html • http://www.google.co.in
- 75. Thank You Murtuja Bharmal [email protected] Courtesy http://blingboo.com