Metasploit basics
This post will explain basics of using metasploit framework. Metasploit framework offers a wide variety of exploits, payloads and tools for information gathering about potential targets. Terms exploit and payload have been explained here. It consists of various data, libraries, plugins and scripts which make the core of the framework, but the most interesting part of framework, from the user perspective, are modules which contain actual exploits and payloads used for penetration testing. As it has been said, except exploits and payloads metasploit also contains auxiliary tools, such as fuzz testers. Those tools are contained within modules which are referred to as auxiliary modules. Function of both exploit modules and auxiliary modules is simillar, they both try to breach systems security, but important difference is that exploit modules have to contain payload field which will get executed when security is breached and auxiliary modules dont contain payload field. So, auxiliary module are used to test systems security before trying to exploit it. All exploits available in metasploit are written in Ruby and are actually Ruby classes. Big advantage of metasploit framework is its modular architecture, it enables you to use different payloads with different exploits very easily, as it will be seen further in the post. Also, with the purpose of how to use metasploits framework Rapid7 has released an intentionally vulnerable Linux virtual machine called Metasploitable, so that you can learn how to perform exploitation using metasploit framework in safe, legal way. Another useful feature in metasploit is its built-in database system support. While performing penetration testing its useful to save information about your target, such as vulnerabilities found.
Installation
Metasploit comes preinstalled on Linux distributions Kali and Backtrack. To install metasploit on some other platform, such as Windows, visit Rapid7s page, choose which edition you wish to use and download it. After following installation instructions metasploit will be installed on your computer, along with database system and Ruby interpreter. As alternative, you can fork metasploit framework from GitHub. Detailed instructions on how to perform forking on Linux Ubuntu system are available here.Basics
There are four ways of interacting with metasploit framework: msfconsole, msfcli, Web graphical interface, which is available in metasploit pro and community edition, and desktop graphical interface Armitage. In this text msfconsole will be used because it offers the most comprehensive approach to using metasploit framework.
To start msfconsole just type msfconsole in your terminal and wait a short period while metasploit loads. Also, you can use bash commands while running msfconsole.
As always, first extremely useful command for learning is help command (you can also type ?). Typed without any parameters it will show you all available commands in metasploit.
You can also type help followed by some command. Then it will show you available information about command passed in as parameter.
Basic exploitation
For the purpose of demonstration of performing simple exploitation using metasploits basic commands exploit which causes memory corruption (CVE 2013-2465) in Java virtual machine is chosen.So we know vulnerability CVE number but we dont know where its exploit is located or even if there is exploit which uses mentioned vulnerability. As seen in previous figure metasploit has command by which you can search through metasploit modules and find the module that suites your needs. Command search gives back as result a path to module which corresponds to search parameters. So now lets see if there is exploit which uses mentioned vulnerability (its usual to code in metasploit exploits CVE number of vulnerability which it exploits).
As it can be seen there is a module corresponding to our search and its location is exploit/multi/browser/ and its name is java_storeimagearray - storeImageArray is name of vulnerable function in Java. Command use is available for selecting which module we want to use in metasploit. Commands pattern is use path_to_module/module_name. Lets select desired module.
Options available for selected module are shown. Selected exploit is a passive type exploit, which means it waits for user interaction before exploit code starts. In this example server is created which awaits for incoming connection and then it sends code which exploits target - in this case Java applet. SRVHOST option says where is our server to which targets will be connecting and it should always be set to your local ip address. You can also specify several other option such as URIPATH option which will be set to random if you dont specify it. Command set is used for assigning values to options.
Now you need to set which system you are attacking, different payloads are available for different systems. As it has been said earlier in the post, you can assign various payloads to various exploits very easily in metasploit.
We will choose meterpreter payload and specify it to give us remote access to target. Before executing exploit we need to set payload options. Option LHOST specifies address of local machine which will gain access to targets system.
Exploit is started by running exploit command.
Simple HTTP server has been launched on localhost and URI to which target should connect is shown. Shown URI should be sent to target you wish to exploit. When someone connects to server Java bytecode will be sent and request will be shown in msfconsole.
After target has connected, exploitation will be performed and access to targets computer will be gained. By using sessions command you can see IP addresses you can interact with. To perform interaction use sessions -i session_ID. You can now perform commands on targets computer. In this example pwd command is performed on targets computer.
download file now
alternative link download