⭕Metasploit
Last updated
Last updated
initiate the database before starting msfconsole
Sometimes Metasploit and ExploitDB don't share the same database, its also possible that you find some exploits that are not ported to metasploit modules. so its a good practice to search for exploits in both of theme.
search for exploits from nmap XML output.
/usr/share/metasploit-framework/modules/modules that use payloads
located in /usr/share/metasploit-framework/modules/exploits/
include port scanners, fuzzers, sniffers, and more
located in /usr/share/metasploit-framework/modules/auxiliary
payloads are codes that run remotely
located in /usr/share/metasploit-framework/modules/payloads
encoders ensure that payloads make it to their destination intact
located in /usr/share/metasploit-framework/modules/encoders
Nopes keep the payload sizes consistant across exploit attempts
located in /usr/share/metasploit-framework/modules/nops
we can add additional modules either at runtime or after msf starts. -m will tell msf to load additional modules at runtime:
for adding after msf start:
move out of module
back
display random banner
banner
check an exploit before running it (not for all)
check
disable/enable console color (for old and dummy terminals)
color -h
remote connect to a machine
connect -h
edit the loaded module
edit
search for modules
search -h (grep enabled)
info about a module
info [module]
live ruby interpreter shell
irb
manage jobs
jobs -h
kill a module or job
kill [num]
load/unload a plugin
load/unload [plugin]
load a third party module
loadpath [path/to/module]
run resource(batch) files
resource [file] u
useful in karmetasploit attacks and alone batch files can speedup a test by automating tasks
route sockets through a session or command
route -h
show/select active sessions
sessions -l
sessions [num]
set/unset options
set
unset
set/unset global variables
setg [name] [value]
unsetg
save state
save
show available options/modules
show options
show targets
show adanced
show payloads
show exploits
show auxiliary
show encoders
show nops
show evation
run and send an exploit to background
exploit -j
wait for incoming host connections and exploit them as they connect
almost always focus on clients such as web browsers, FTP clients, etc.
can be used in conjunction with email exploits
waiting for connections
report shells as they happen
can be enumerated by passing -i to the sessions command.
standalone and self-contained
can be caught with non-metasploit handlers such as netcat
sent and executed in a single part at one time
the payload comes in 2 parts, the first and the second stage
the first stage is small and is purpose is to download and run the second stage
the second stage is the main part of the payload with the important functionalities
designed to be used when size matters, small and reliable
usually more stable than a large single payload.
a single payload
containing the exploit and shellcode
more stable than staged
short for meta-interpreter
advanced multi-function payload that operates via dll injection
resides completely on the memory of victim machine (doesn't touch the disk at all)
very difficult to detect
scripts and modules can be loaded and unloaded
can help in circumventing restrictive outbound firewalls
uses an activeX control to create a hidden instance of internet explorer and communicates with the attacker over HTTP protocol
NX (no execute) bit is a feature built into some CPUs to prevent code from executing in certain areas of memory
in windows NX is implemented as data execution prevention (DEP)
nonx payloads circumvent DEP
windows stager based payloads
it works on every flavor and language of windows dating back to windows 9x without the explicit definition of a return address
extremely tiny, it relies on the fact that ws2_32.dll is loaded in the process being exploited before exploited.
a bit less stable than other stagers
reflective DLL injection : a technique wherby a stage payload is injected into a compromised host process running in memory.never touching the memory VNC and meterpreter use it.
install and run nessus:
load nessus in msfconsole:
connect to nessus host (can be remote):
nessus commands:
after importing results to msf we can use msf DB commands to search for vulns and services:
install and run openvas:
connect to host:
openvas commands:
edit tor config /etc/tor/torrc uncomment following lines:
change the hiddenserviceport ip address from 127.0.0.1 to your private ip and local port 80 to 9999
find your tor hidden service hostname
create a payload with msfvenom and set the lhost to the union address and append .link to it:
in listener set lhost to your local ip address:
run the attack:
using tor is extremely slow ad your session may timeout, play around with timeout values.
every command will be logged in a file named console.log in ~/.msf4/logs
(system, security & application logs)
example:
example:
open notepad app in a different channel
list channels
read/write data to a channel
modify the date and time of file and folder modification and access
net info, pass hashes, registry, etc.
example:
makes current meterpreter session go to sleep for specific period of time and wake up again.
Once Meterpreter shellcode has been run; whether from a phish, or some other means, it will reach out to the attacker’s Command and Control (C2) server over some network transport, such as HTTP, HTTPS or TCP. However, in an unknown environment, a successful connection is not guaranteed: firewalls, proxies, or intrusion prevention systems might all prevent a certain transport method from reaching out to the public Internet.Repeated trial and error is sometimes possible, but not always. For a phish, clicks come at a premium. Some exploits only give you one shot to get a shell, before crashing the host process. Meterpreter has the ability to have multiple “transports” in a single implant. A transport is the method by which it communicates to the Metasploit C2 server: TCP, HTTP, etc. Typically, Meterpreter is deployed with a single transport, having had the payload type set in msfvenom or in a Metasploit exploit module (e.g. meterpreter_reverse_http).
The type of transport (TCP, HTTP, etc.)
The host to connect to
The port to connect on
A URI, for HTTP-based transports
Other properties such as retry times and timeouts
Once a Meterpreter session has been set up, you can add a transport using the command transport add and providing it with parameters (type transport to see the options).
By setting up multiple transports in this initialisation script, Meterpreter will try each of them (for a configurable amount of time), before moving on to the next one.
Create a stageless meterpreter payload, which pre-loads the PowerShell extension. The transport used on the command line will be the default Include a PowerShell script as an “Extension Initialisation Script” (parameter name is extinit, and has the format of ,). This script should add additional transports to the Meterpreter session. When the shellcode runs, this script will also run If the initial transport (the one specified on the command line) fails, Meterpreter will then try each of these alternative transports in turn.
in AddTransports.ps1 :
Make sure you include the full path to the extinit parameter (relative paths don’t appear to work)
Ensure you configure how long to try each transport before moving on to the next.
RetryWait is the time to wait between each attempt to contact the C2 server
RetryTotal is the total amount of time to wait before moving on to the next transport
Note that the parameter names for retry times and timeouts are different between the PowerShell bindings and the Metasploit parameters themselves:
in the PowerShell extension, they are RetryWait and RetryTotal; in Metasploit they are SessionRetryWait and SessionRetryTotal (a tad confusing, as they relate to transports, not sessions)
enable RDP on victim machine use rdesktop to connect
example:
we can automate the whole thing too.
For example, using a standard editor, we will create a script in our home directory named setup.rc. In this script, we will set the payload to windows/meterpreter/reverse_https and configure the relevant LHOST and LPORT parameters. We also enable stage encoding using the x86/shikata_ga_nai encoder and configure the post/windows/manage/migrate module to be executed automatically using the AutoRunScript option. This will cause the spawned meterpreter to automatically launch a background notepad.exe process and migrate to it. Finally, the ExitOnSession parameter is set to “false” to ensure that the listener keeps accepting new connections and the module is executed with the -j and -z flags to stop us from automatically interacting with the session. The commands for this are as follows:
With the listener configured and running, we can, for example, launch an executable containing a meterpreter payload from our Windows VM. We can create this executable with msfvenom :
When executed, our multi/handler accepts the connection
we can specify scripts manually after getting a session:
we can write bash scripts to automate the tasks: example: a dos attack.
configure a domain in zinitiative.com and use lets enrypt to get a certificate after configuring the domain DNS servers to point to the digitalocean droplet getting a certificate with lets encrypt is very simple.
first install letsencrypt:
generate a cert
we should have a cert under /etc/letsencrypt/live/zinitiative.com directroy
before we can move on we will have to creare a unified file containng privkey.pem and cert.pem:
now in msfconsole set the cert
we have the cert now create a payload using the cert:
in handler setting:
