The Metasploit Framework is an open-source modular penetration testing platform used to attack systems to test for security exploits. It is one of the most commonly used penetration testing tools and comes built-in in Kali Linux.

Metasploit consists of datastore and modules. Datastore enables the user to configure the aspects within the framework, whereas modules are self-contained snippets of codes from which Metasploit derives its features. Since we’re focusing on executing an attack for pen testing, we’ll keep the discussion to module

A Brief History of Metasploit

The Metasploit Project was undertaken in 2003 by H.D. Moore for use as a Perl-based portable network tool, with assistance from core developer Matt Miller. It was fully converted to Ruby by 2007, and the license was acquired by Rapid7 in 2009, where it remains as part of the Boston-based company’s repertoire of IDS signature development and targeted remote exploit, fuzzing, anti-forensic, and evasion tools.

Portions of these other tools reside within the Metasploit framework, which is built into the Kali Linux OS. Rapid7 has also developed two proprietary OpenCore tools, Metasploit Pro, Metasploit Express.

This framework has become the go-to exploit development and mitigation tool. Prior to Metasploit, pen testers had to perform all probes manually by using a variety of tools that may or may not have supported the platform they were testing, writing their own code by hand, and introducing it onto networks manually. Remote testing was virtually unheard of, and that limited a security specialist’s reach to the local area and companies spending a fortune on in-house IT or security consultants.

Metasploit Uses and Benefits

All you need to use Metasploit once it’s installed is to obtain information about the target either through port scanning, OS fingerprinting or using a vulnerability scanner to find a way into the network. Then, it’s just a simple matter of selecting an exploit and your payload. In this context, an exploit is a means of identifying a weakness in your choice of increasingly harder to defend networks or system and taking advantage of that flaw to gain entry.

The framework is constructed of various models and interfaces, which include msfconsole interactive curses, msfcli to alls msf functions from the terminal/cmd, the Armitag graphical Java tool that’s used to integrate with MSF, and the Metasploit Community Web Interface that supports remote pen testing.

White hat testers trying to locate or learn from black hats and hackers should be aware that they don’t typically roll out an announcement that they’re Metasploiting. This secretive bunch likes to operate through virtual private network tunnels to mask their IP address, and many use a dedicated VPS as well to avoid interruptions that commonly plaque . These two privacy tools are also a good idea for white hats who intend to step into the world of exploits and pen testing with Metasploit.

As mentioned above, Metasploit provides you with exploits, payloads, auxiliary functions, encoders, listeners, shellcode, post-exploitation code and nops.

You can obtain a Metasploit Pro Specialist Certification online to become a credentialed pen-tester. The passing score to obtain the certification is 80 percent, and the open book exam takes about two hours. It costs $195, and you can print your certificate out once you’re approved.

Prior to the exam, it’s recommended that you take the Metasploit trainning course and have proficiency or working knowledge:

• Windows and Linux OS
• Network protocols
• Vulnerability management systems
• Basic pen testing concepts

Obtaining this credential is a desirable achievement for anyone who wants to become a marketable pen-tester or security analyst.

Finding Modules

Modules are the core components of the Metasploit Framework. A module is a piece of software that can perform a specific action, such as scanning or exploiting. Each task that you can perform with the Metasploit Framework is defined within a module.

You can locate modules in the following directory: /path/to/metasploit/apps/pro/msf3/modules if you installed Metasploit using the binaries or /path/to/metasploit-framework-repo/modules if you cloned the repository from GitHub. The modules are categorized by type and then by protocol.

There are a few types of modules. The module type depends on the purpose of the module and the type of action that the module performs. The following are module types that are available in the Metasploit Framework:

• Exploit – An exploit module executes a sequence of commands to target a specific vulnerability found in a system or application. An exploit module takes advantage of a vulnerability to provide access to the target system. Exploit modules include buffer overflow, code injection, and web application exploits.
• Auxiliary – An auxiliary module does not execute a payload. It can be used to perform arbitrary actions that may not be directly related to exploitation. Examples of auxiliary modules include scanners, fuzzers, and denial of service attacks.
• Post-Exploitation – A post-exploitation module enables you to gather more information or to gain further access to an exploited target system. Examples of post-exploitation modules include hash dumps and application and service enumerators.
• Payload – A payload is the shell code that runs after an exploit successfully compromises a system. The payload enables you to define how you want to connect to the shell and what you want to do to the target system after you take control of it. A payload can open a Meterpreter or command shell. Meterpreter is an advanced payload that allows you to write DLL files to dynamically create new features as you need them.
• NOP generator – A NOP generator produces a series of random bytes that you can use to bypass standard IDS and IPS NOP sled signatures. Use NOP generators to pad buffers.

Where to download Metasploit

Metasploit ships as part of Kali Linux, but you can also download it separately at the Metasploit website. Metasploit runs on *nix and Windows systems. The Metasploit Framework source code is available on GitHub.

Like Coca-Cola, Metasploit comes in different flavors. In addition to the free/libre Metasploit Framework, Rapid7 also produces the Metasploit Community Edition, a free web-based user interface for Metasploit, and Metasploit Pro, the big daddy with the non-free add-ons for pentesters who prefer a GUI or MS Office-like wizards to perform baseline audits, and want to phish their clients as part of an engagement. Rapid7 offers a

How to learn Metasploit

Many free and cheap resources are available to learn Metasploit. The best place to start for many is probably downloading and installing Kali Linux, along with a vulnerable virtual machine (VM) for target practice. (Don’t learn Metasploit by pointing it at other people’s networks without their permission. That would be illegal.)

Offensive Security, the folks who maintain Kali and run the OSCP certification, also offer Metasploit Unleashed, a free training course that asks only for a donation to hungry children in Africa in return. The No Starch Metasploit book is also an indispensable resource that, like all No Starch Press books, comes with a DRM-free ebook.

The Metasploit project offers detailed documentation and its YouTube channel is another good resource for the beginning penetration tester

How to use Metasploit

During the information gathering phase of a pentest, Metasploit integrates seamlessly with Nmap, SNMP scanning and Windows patch enumeration, among others. There’s even a bridge to Nessus, Tenable’s vulnerability scanner. Pretty much every reconnaissance tool you can think to integrate with Metasploit, making it possible to find the chink in the armor you’re looking for.

Once you’ve identified a weakness, hunt through Metasploit’s large and extensible database for the exploit that will crack open that chink and get you in. For instance, NSA’s EternalBlue exploit, released by the Shadow Brokers in 2017, has been packaged for Metasploit and is a reliable go-to when dealing with unpatched legacy Windows systems.

Like fine wine and cheese, pair the exploit with a payload to suit the task at hand. Since what most folks are wanting is a shell, a suitable payload when attacking Windows systems is the ever-popular Meterpreter, an in-memory-only interactive shell. Linux boxes get their own shellcode, depending on the exploit used.

Once on a target machine, Metasploit’s quiver contains a full suite of post-exploitation tools, including privilege escalation, pass the hash, packet sniffing, screen capture, keyloggers, and pivoting tools. You can also set up a persistent backdoor in case the machine in question gets rebooted.

More and more features are being added to Metasploit every year, include a fuzzer to identify potential security flaws in binaries, as well as a long list of auxiliary modules too long to list here.

This is only a high-level view of what Metasploit can do. The framework is modular and easily extensible and enjoys an active community. If it doesn’t do exactly what you want it to do, you can almost certainly tweak it to suit.

METASPLOIT FRAMEWORK COMMANDS

Here is a list with the most often used commands of Metasploit Framework console.

METASPLOIT FRAMEWORK CONSOLE COMMANDS LIST

show exploits

Show all exploits of the Metasploit Framework

show payloads

Show all payloads

show auxiliary

Show all auxiliary modules of the Metasploit Framework

search name

Search for exploits or modules

info

Load information about a specific exploit or module

use name

Load an exploit or module

LHOST

Your local IP address if you are on the same network with the target or  the public IP address when you are not

RHOST

The IP address of the target

set function

Set a specific value (for example RHOST or LHOST)

setg function

Set a specific value globally (for example RHOST or LHOST)

show options

Shows the options that are available for module or exploit

show targets

shows which platforms can be attacked by the exploit

set target num

specify a target index if you know the OS and the service pack

set payload payload

Specify the payload that it will be used

show advanced

Show advanced options

set autorunscript migrate -f

Automatically migrate a separate process upon exploit completion

check

Determine if the target is vulnerable to an attack

exploit

Execute the module or exploit and attack the target

exploit -j

Run the exploit under the context of the job

exploit -z

Do not interact with the session after successful exploitation

exploit -e encoder

specify the payload encoder to use (example:exploit -e shikata_ga_nai)

exploit -h

Display help for the exploit command

sessions -i

List available sessions

sessions -i -v

List all available sessions and show verbose fields,such as which vulnerability was used when exploiting the system

sessions -s script

Run a specific Meterpreter script on all Meterpreter live sessions

sessions -K

Kill all live sessions

sessions -c cmd

Execute a command on all live Meterpreter sessions

sessions -u sessionID

Upgrade a normal Win32 shell to a Meterpreter console

db_create name

Create a database to use with database-driven attacks (example:db_create autopwn)

db_connect name

Create and connect to a database for driven attacks (example:db_connect autopwn)

db_nmap

Use nmap and place results in database

db_autopwn -h

Display help for using db_autopwn

db_autopwn -p -r -e

Run db_autopwn against all ports found,use a reverse shell and exploit all systems

db_destroy

Delete the current database

db_destroy user:password@host:port/database

Delete database using advanced options

Drop your comment