The Metasploit Framework is an open-source modular penetration testing platform used to attack systems to test for security exploits. It is one of the most commonly used penetration testing tools and comes built-in in Kali Linux.
Metasploit consists of datastore and modules. Datastore enables the user to configure the aspects within the framework, whereas modules are self-contained snippets of codes from which Metasploit derives its features. Since we’re focusing on executing an attack for pen testing, we’ll keep the discussion to module
A Brief History of Metasploit
The Metasploit Project was undertaken in 2003 by H.D. Moore for use as a Perl-based portable network tool, with assistance from core developer Matt Miller. It was fully converted to Ruby by 2007, and the license was acquired by Rapid7 in 2009, where it remains as part of the Boston-based company’s repertoire of IDS signature development and targeted remote exploit, fuzzing, anti-forensic, and evasion tools.
Portions of these other tools reside within the Metasploit framework, which is built into the Kali Linux OS. Rapid7 has also developed two proprietary OpenCore tools, Metasploit Pro, Metasploit Express.
This framework has become the go-to exploit development and mitigation tool. Prior to Metasploit, pen testers had to perform all probes manually by using a variety of tools that may or may not have supported the platform they were testing, writing their own code by hand, and introducing it onto networks manually. Remote testing was virtually unheard of, and that limited a security specialist’s reach to the local area and companies spending a fortune on in-house IT or security consultants.
Metasploit Uses and Benefits
All you need to use Metasploit once it’s installed is to obtain information about the target either through port scanning, OS fingerprinting or using a vulnerability scanner to find a way into the network. Then, it’s just a simple matter of selecting an exploit and your payload. In this context, an exploit is a means of identifying a weakness in your choice of increasingly harder to defend networks or system and taking advantage of that flaw to gain entry.
The framework is constructed of various models and interfaces, which include msfconsole interactive curses, msfcli to alls msf functions from the terminal/cmd, the Armitag graphical Java tool that’s used to integrate with MSF, and the Metasploit Community Web Interface that supports remote pen testing.
White hat testers trying to locate or learn from black hats and hackers should be aware that they don’t typically roll out an announcement that they’re Metasploiting. This secretive bunch likes to operate through virtual private network tunnels to mask their IP address, and many use a dedicated VPS as well to avoid interruptions that commonly plaque . These two privacy tools are also a good idea for white hats who intend to step into the world of exploits and pen testing with Metasploit.
As mentioned above, Metasploit provides you with exploits, payloads, auxiliary functions, encoders, listeners, shellcode, post-exploitation code and nops.
You can obtain a Metasploit Pro Specialist Certification online to become a credentialed pen-tester. The passing score to obtain the certification is 80 percent, and the open book exam takes about two hours. It costs $195, and you can print your certificate out once you’re approved.
Prior to the exam, it’s recommended that you take the Metasploit trainning course and have proficiency or working knowledge:
- Windows and Linux OS
- Network protocols
- Vulnerability management systems
- Basic pen testing concepts
Obtaining this credential is a desirable achievement for anyone who wants to become a marketable pen-tester or security analyst.
Modules are the core components of the Metasploit Framework. A module is a piece of software that can perform a specific action, such as scanning or exploiting. Each task that you can perform with the Metasploit Framework is defined within a module.
You can locate modules in the following directory:
/path/to/metasploit/apps/pro/msf3/modules if you installed Metasploit using the binaries or
/path/to/metasploit-framework-repo/modules if you cloned the repository from GitHub. The modules are categorized by type and then by protocol.
There are a few types of modules. The module type depends on the purpose of the module and the type of action that the module performs. The following are module types that are available in the Metasploit Framework:
- Exploit – An exploit module executes a sequence of commands to target a specific vulnerability found in a system or application. An exploit module takes advantage of a vulnerability to provide access to the target system. Exploit modules include buffer overflow, code injection, and web application exploits.
- Auxiliary – An auxiliary module does not execute a payload. It can be used to perform arbitrary actions that may not be directly related to exploitation. Examples of auxiliary modules include scanners, fuzzers, and denial of service attacks.
- Post-Exploitation – A post-exploitation module enables you to gather more information or to gain further access to an exploited target system. Examples of post-exploitation modules include hash dumps and application and service enumerators.
- Payload – A payload is the shell code that runs after an exploit successfully compromises a system. The payload enables you to define how you want to connect to the shell and what you want to do to the target system after you take control of it. A payload can open a Meterpreter or command shell. Meterpreter is an advanced payload that allows you to write DLL files to dynamically create new features as you need them.
- NOP generator – A NOP generator produces a series of random bytes that you can use to bypass standard IDS and IPS NOP sled signatures. Use NOP generators to pad buffers.
Where to download Metasploit
Metasploit ships as part of Kali Linux, but you can also download it separately at the Metasploit website. Metasploit runs on *nix and Windows systems. The Metasploit Framework source code is available on GitHub.
Like Coca-Cola, Metasploit comes in different flavors. In addition to the free/libre Metasploit Framework, Rapid7 also produces the Metasploit Community Edition, a free web-based user interface for Metasploit, and Metasploit Pro, the big daddy with the non-free add-ons for pentesters who prefer a GUI or MS Office-like wizards to perform baseline audits, and want to phish their clients as part of an engagement. Rapid7 offers a
How to learn Metasploit
Many free and cheap resources are available to learn Metasploit. The best place to start for many is probably downloading and installing Kali Linux, along with a vulnerable virtual machine (VM) for target practice. (Don’t learn Metasploit by pointing it at other people’s networks without their permission. That would be illegal.)
Offensive Security, the folks who maintain Kali and run the OSCP certification, also offer Metasploit Unleashed, a free training course that asks only for a donation to hungry children in Africa in return. The No Starch Metasploit book is also an indispensable resource that, like all No Starch Press books, comes with a DRM-free ebook.
How to use Metasploit
During the information gathering phase of a pentest, Metasploit integrates seamlessly with Nmap, SNMP scanning and Windows patch enumeration, among others. There’s even a bridge to Nessus, Tenable’s vulnerability scanner. Pretty much every reconnaissance tool you can think to integrate with Metasploit, making it possible to find the chink in the armor you’re looking for.
Once you’ve identified a weakness, hunt through Metasploit’s large and extensible database for the exploit that will crack open that chink and get you in. For instance, NSA’s EternalBlue exploit, released by the Shadow Brokers in 2017, has been packaged for Metasploit and is a reliable go-to when dealing with unpatched legacy Windows systems.
Like fine wine and cheese, pair the exploit with a payload to suit the task at hand. Since what most folks are wanting is a shell, a suitable payload when attacking Windows systems is the ever-popular Meterpreter, an in-memory-only interactive shell. Linux boxes get their own shellcode, depending on the exploit used.
Once on a target machine, Metasploit’s quiver contains a full suite of post-exploitation tools, including privilege escalation, pass the hash, packet sniffing, screen capture, keyloggers, and pivoting tools. You can also set up a persistent backdoor in case the machine in question gets rebooted.
More and more features are being added to Metasploit every year, include a fuzzer to identify potential security flaws in binaries, as well as a long list of auxiliary modules too long to list here.
This is only a high-level view of what Metasploit can do. The framework is modular and easily extensible and enjoys an active community. If it doesn’t do exactly what you want it to do, you can almost certainly tweak it to suit.
METASPLOIT FRAMEWORK COMMANDS
Here is a list with the most often used commands of Metasploit Framework console.
METASPLOIT FRAMEWORK CONSOLE COMMANDS LIST
Show all exploits of the Metasploit Framework
Show all payloads
Show all auxiliary modules of the Metasploit Framework
Search for exploits or modules
Load information about a specific exploit or module
Load an exploit or module
Your local IP address if you are on the same network with the target or the public IP address when you are not
The IP address of the target
Set a specific value (for example RHOST or LHOST)
Set a specific value globally (for example RHOST or LHOST)
Shows the options that are available for module or exploit
shows which platforms can be attacked by the exploit
set target num
specify a target index if you know the OS and the service pack
set payload payload
Specify the payload that it will be used
Show advanced options
set autorunscript migrate -f
Automatically migrate a separate process upon exploit completion
Determine if the target is vulnerable to an attack
Execute the module or exploit and attack the target
Run the exploit under the context of the job
Do not interact with the session after successful exploitation
exploit -e encoder
specify the payload encoder to use (example:exploit -e shikata_ga_nai)
Display help for the exploit command
List available sessions
sessions -i -v
List all available sessions and show verbose fields,such as which vulnerability was used when exploiting the system
sessions -s script
Run a specific Meterpreter script on all Meterpreter live sessions
Kill all live sessions
sessions -c cmd
Execute a command on all live Meterpreter sessions
sessions -u sessionID
Upgrade a normal Win32 shell to a Meterpreter console
Create a database to use with database-driven attacks (example:db_create autopwn)
Create and connect to a database for driven attacks (example:db_connect autopwn)
Use nmap and place results in database
Display help for using db_autopwn
db_autopwn -p -r -e
Run db_autopwn against all ports found,use a reverse shell and exploit all systems
Delete the current database
Delete database using advanced options
Drop your comment