Usage guide on using Metasploit auxiliary modules for information gathering. Some modules are used as examples to show functionality. The need for cyber investigators are booming and the tools available to perform investigations already exist, in most circumstances. While the majority of tools are open source, paid applications exist as well.

1. Auxiliary modules
For cybercrime investigations
Usage guide
Created by Chris Harrington

2.  There are several interfaces
◦ gui
◦ console
◦ web
 Auxiliary modules are in 3 categories
◦ Admin
◦ Scanner
◦ Server

3.  Using Kali Linux
◦ Start Postgresql
 Metasploit uses postgresql to speed up searching
/etc/init.d/postgresql start
◦ Start metasploit
/etc/init.d/metasploit start

4.  Run command: msfconsole
 Inside Metasploit console

5.  Ensure Metasploit is connected to the
postgresql database
◦ This speeds up search significantly
Command: db_status

6.  Searching the auxiliary database
Command: search auxiliary
◦ All auxiliary modules are shown
 Filter search and search for mysql
Command: search mysql
 More refined search only for auxiliary

7.  Selecting module for information gathering

8.  Use the probe module
Command: use auxiliary/scanner/mysql/mysql_version
 Show options that can be set
Command: show options

9.  Required options must be set
list of options that can be set using set command
currently assigned value to option
required or not required option to set
description of option

10.  Set required parameters
set command to set parameters
option to set called RHOSTS
host of suspect running mysql
Command: set <OPTION> <VALUE>
 Set RPORT if default port is different
 Threads can be changed for multiple hosts

11.  Command: run
 Suspect host running MySQL 5.1.73-community

12.  Metasploit comes with several scanners
◦ identifying open ports
◦ Service identification
◦ and more
Command: search auxiliary/scanner

13.  Use arp_sweep module to discovery other
hosts on the same network
Command: use auxiliary/scanner/discovery/arp_sweep
 Show options and set required values

14.  Use tcp portscan module to identify open
ports on the suspect’s machine
Command: use auxiliary/scanner/portscan/tcp
 Show options and set required values

15.  Set RHOSTS and other options
 Run the scan

16.  Contains many tools and modules
◦ Auxiliary
◦ Exploits
◦ Payloads
 Easy to use and multiple interfaces
 Cost and time saving
 Remember to set OPTIONS appropriate to
your situation
 Other tools exist for port and service
identification
 Know what you are doing. Don’t get
compromised

17.  My contact details
 C.k.harrington@gmail.com