Download as PDF, PPTX
Uploaded byegypt
The State of the Metasploit Framework.pdf
This document provides an overview and update on the Metasploit Framework. Some key points: - 229 new modules were added since September 2015. Over 800 pull requests were merged from 176 unique authors with 4765 total commits. - Rex is being broken up into smaller components. New msfconsole commands and a reorganization of the tools directory were introduced. - New modules, payloads, and exploits were added for platforms like Linux, Windows, Android and mainframes. Module documentation is now in markdown. - Features added include tools for downloading Microsoft patches, a portable POSIX payload called Mettle, and improved Meterpreter functionality like XOR obfuscation and new extensions.
The State of the Metasploit Framework.pdf
- 1. The State ofthe Metasploit Framework @egyp7
- 2. James Lee @egyp7 Metasploit Developer CommunityManager $ whoami 2
- 3.
- 4. 229 New Modules git log--name-only --diff-filter A --since='2015-09-25' | grep '^modules' | wc -l 4
- 5.
- 6. Over 800 PullRequests merged github.com/rapid7/metasploit-framework/pulls?q=is:pr+merged:<2015-09-26 6
- 7. 176 unique authors git log--since 2015-09-26 --format=%aE | sort | uniq -c 7
- 8. 4765 Commits git log --since2015-09-26 --format=%aE | sort | wc -l 8
- 9.
- 10. 1588 Dead References toOSVDB git grep OSVDB modules/ | wc -l 10
- 11.
- 12. Breaking up ishard to do Rex is huge and old We’re slowly but surely breaking it up into smaller pieces 12
- 13. New msfconsole commands options(alias of `show options`) advanced (alias of `show advanced`) 13
- 14.
- 15. msu_finder tools/exploit/msu_finder.rb Grabs download linksfor Microsoft patches ruby msu_finder.rb -q ms15-100 15
- 16. Mettle Portable POSIX payload Runson MIPS routers, Android phones, and desktop Linux Uses Meterpreter protocol Brent and Adam will cover this more Sunday at 13:00 16
- 17. Mainframes Lots of workby Soldier of Fortran and Bigendian Smalls Payloads Auth’d RCE via job system 17
- 18. Module Documentation Write inmarkdown Lives in documentation/modules/ View with info -d 18
- 19. New Modules git log--since 2015-09-26 --name-status | grep '^As*modules'
- 20.
- 21. encoder/x64/zutto_dekiru Similar in formto shikata_ga_nai 21
- 22. Not a traditionalencoder Embeds x86 shellcode in an existing BMP image XOR’d and Stego’d across all the bits Modifies the header so the BMP itself is executable shellcode encoder/x86/bmp_polyglot 22
- 23. SMB Delivery Works likeweb_delivery 23
- 24. ImageTragick exploit/unix/fileformat/imagemagick_delegate You probably alreadyforgot about this one 24
- 25. Shellshock IPFire Advantech Switches Legend IRCBot Xdh IRC bot 25
- 26. Malware Phoenix Exploit Kit DarkComet LegendIRC bot Xdh IRC bot 26
- 27. Security Stuff Fortinet SSHbackdoor Chkrootkit LPE Metasploit Pro authenticated RCE Metasploit Pro pre-auth cookie deserialization 27
- 28. Pageant Jacker post/windows/manage/forward_pageant Creates alocal unix socket like ssh-agent(1) Forwards to remote Pageant (PuTTY’s ssh-agent(1) equiv) 28
- 29. Privilege Escalation onWindows ms16_016_webdav ms16_032_secondary_logon_handle_privesc windows/local/applocker_bypass windows/misc/regsvr32_applocker_bypass_server 29
- 30. Privilege Escalation onLinux/Unix chkrootkit Exim Docker daemon 30
- 31. Privilege Escalation onOSX libmalloc ● Fun oldschool env cleaning fail ● write-file-as-root bug 31
- 32. Persistence on Linux ssh at,cron 32
- 33.
- 34. XOR packet obfuscation Getsrid of the ~static strings in TLVs 34
- 35.
- 36. Reverse Listener Comm Seta handler listening on a Meterpreter session 36
- 40. Reverse Port Forwarding portfwdadd -R -L 10.0.0.40 -l 22 -p 22 40
- 41.
- 42.
- 43.
- 44. Windows: show_mount command Listsall mounted filesystems Including network shares 44
- 45. Android: sqlite_query command sqlite_query-d <path> -q <query> sqlite_query -d /data/data/com.android.browser/databases/webviewCookiesChromium.db -q 'SELECT * from cookies' 45
- 46. Android Registers itself asa service to run in the background 46
- 47.
- 48. Where FreeNode #metasploit community.rapid7.com @metasploit ontwitter Github Projects 48
- 49. Hackathon? Come to Austinand hang out with us Hack all the things ● Maybe in the early summer? ● A week or so? 49
- 50.
- 51.