What is Metasploit?• A collaboration between the open source community and Rapid7, Metasploit software helps security and IT professionals identify security issues, verify vulnerability mitigations, and manage expert-driven security assessments, providing true security risk intelligence.• Capabilities include smart exploitation, password auditing, web application scanning, and social engineering.• Teams can collaborate in Metasploit and present their findings in consolidated reports.• Metasploit editions range from a free edition to professional enterprise editions, all based on the Metasploit Framework, an open source software development kit with the worlds largest, public collection of quality-assured exploits.
Metasploit is a hacking framework written in ruby. It isdesigned to help make writing and executing exploits assimple as possible.
History of the Metasploit Project•MetasploitProject –HD Moore & Friends –A community-driven project since 2003 •Rapid7 –Maker of NeXposeVulnerability Management –Purchase the Project from HD •MetasploitFramework –The original open-source exploit framework
Metasploit Versions •1.0 released in 2003 (Perl) •2.0 released in 2004 (Better Perl) –2.7 released in late 2006 •3.0 released in 2007 (Ruby) –3.2 released in late 2008 –3.3 released in late 2009 –3.4 released in early 2010 –3.4.1 is the most recent release•Metasploitnow has 567 exploits and 283 auxiliary modules (up from 551 and 261 in v3.4)
Metasploit Framework Overview Open source tool Used for Penetration testing IDS Signature Development Exploit Research Consists of Web server Console Signatures
Runs on any operating system Source code for Linux/Unix/MacOS X Portable to Windows via CYGWINAllows anyone to exploit & usually “root” certain machineswith only an IP address and a basic background of the systemRequires no knowledge of the software bug, or exploitmachine code
Metasploit Framework Overview Versions Open source tool Used forPenetration testingIDS Signature DevelopmentExploit Research Consists ofWeb serverConsoleSignatures
Penetration Testing OverviewActive evaluation of a system or network of systemsAssume the role of a black hat hacker or “bad guy”Often uses the same tools as hackers
Metasploit brings together many of the tools and techniques used by hackers
What is penetration testing? Penetration testing, oftencalled “pentesting”,“pen testing”, or “security testing”, is thepractice of attacking your own or your clients’ IT systems inthe same way a hacker would to identify security holes. Ofcourse, you do this without actually harming the network.The person carrying out a penetration test is called apenetration tester or pentester.Let’s make one thing crystal clear: Penetration testingrequires that you get permission from the person who ownsthe system. Otherwise, you would be hacking thesystem, which is illegal in most countries – and trust me, youdon’t look good in an orange jump suit.
You can become a penetration tester at home by testing yourown server and later make a career out of it. At Rapid7, wehave a team of professionals that pentest government andenterprise IT systems for a living. And let me tell you, theyenjoy their job!To better understand penetration testing, you first need tounderstand the basic security concepts ofvulnerabilities, exploits, and payloads.
What is a vulnerability?• A vulnerability is a security hole in a piece of software, hardware or operating system that provides a potential angle to attack the system. A vulnerability can be as simple as weak passwords or as complex as buffer overflows or SQL injection vulnerabilities.• To test if you have any vulnerabilities in your systems, you typically use a vulnerability management solution, also known as a vulnerability scanner or vulnerability assessment solution. If you would like to get your hands on a free vulnerability scanner, try NeXpose Community Edition, one of Metasploit’s sister projects.• Vulnerability Scanning• Vulnerability scanning will allow you to quickly scan a target IP range looking for known vulnerabilities, giving a penetration tester a quick idea of what attacks might be worth conducting. When used properly, this is a great asset to a pen tester, yet it is not without its draw backs. Vulnerability scanning is well known for a high false positive and false negative rate. This has to be kept in mind when working with any vulnerability scanning software.• Lets look through some of the vulnerability scanning capabilities that the Metasploit Framework can provide.
What is security research?• Vulnerabilities are typically found by security researchers, which is a posh term for smart people who like to find flaws in systems and break them. At Rapid7, we have a team of vulnerability researchers that do nothing else all day. Trust us, this can be a lot of fun.• Like penetration testing, security research can be used for good and evil. Some countries don’t make the distinction and outlaw security research completely, so make sure you check your country’s legislation before you start researching and especially before you publish any research.
What is an exploit?• To take advantage of a vulnerability, you often need an exploit, a small and highly specialized computer program whose only reason of being is to take advantage of a specific vulnerability and to provide access to a computer system. Exploits often deliver a payload to the target system to grant the attacker access to the system.• The Metasploit Project host the world’s largest public database of quality-assured exploits. Have a look at our exploit database – it’s right here on the site.• Even the name Metasploit comes from the term “exploit”. Metasploit was the first software to provide a common framework for a large selection of exploits. Think of it as an abstraction layer (“Meta”) for exploits (abbreviated “sploits”). Get it?
WARNINGS : Metasploit is very powerful, and very dangerous This is a briefing of a demo I did on my own systems & network, not a “live” demo I used VMWare to isolate the operating system from other systems and the internet Use of this an any unauthorized way will get you fired/arrested/deported/smited by God, etc...
InstallationInstalled on both Windows and Linux with sameresults/ease of useUses a web server as interfaceSignature updates downloaded automaticallyStarted the web server & logged in
Linux system - Port scan Nmap reveals several things Services – SSH, rpcbind, filesharing Operating System – Linux, kernel version – 2.4.6 – 2.4.26, or 2.4.9, 2.6.5 – 2.6.11 Doesn’t tell us the distribution, but we can guess
Demo Filesharing (port 139) is running on a linux machine Assume samba is running Choose “samba trans2open” from list of exploits
What is a payload?• A payload is the piece of software that lets you control a computer system after it’s been exploited. The payload is typically attached to and delivered by the exploit. Just imagine an exploit that carries the payload in its backpack when it breaks into the system and then leaves the backpack there. Yes, it’s a corny description, but you get the picture.• Metasploit’s most popular payload is called Meterpreter, which enables you to do all sorts of funky stuff on the target system. For example, you can upload and download files from the system, take screenshots, and collect password hashes. You can even take over the screen, mouse, and keyboard to fully control the computer. If you’re feeling particularly bad-ass, you can even turn on a laptop’s webcam and be a fly on the wall.
Demo Payloads Add User Bind – shell Exec – execute one command And many more Chose “linux_ia32_bind”
Demo I had little success with “check” option. Most of the time, metasploit would say it was not vulnerable, however, it was Run Exploit
Demo Shell access opens up the doors to any other service Steal passwords Add/delete users Alter/disrupt services Download files Change files Change logs Full access to any other privilege services on other machines
Summary Metasploit is very easy to use, and very powerful Web interface allows the scans to be run from any system, on any operating system Evidence may or may not be left behind on the system IDS/IPS will sense these exploits Only contains old & well known exploits