|
I work on creating signatures for all metasploit modules. I need to stimulate pretty much all the attacks (exploits) in metasploit without actually targeting a real victim (I don't think autopwn can help here). Most of the modules in metasploit verifies that there's a victim on the other side, is there a way to bypass it? API? it's impossible to create a vulnerable machine for all the metasploit modules. Your help will be appreciated. |
|||
|
|
|
VM's are certainly a good option, there's plenty of out of the box vunerable systems you can fire up (e.g. Metasploitable). That combined with a TCPdump of the traffic should yield most of the information you need. That being said, you may have more luck creating signatures for the Metasploit Payloads. There are fewer of them, they change less frequently and you can be sure that if you detect it, that's traffic you want to identify or block. Will also work when new exploits are added to Metasploit which is very often. Metasploit does include some abilities for beating signature-based detection so that's something you need to take into account as well. |
|||
|
|
|
Consider Glastopf. I have had experience with Metasploit running against glastopf, and msf thought that the target was vulnerable to everything. You could host glastopf on the local machine and point msf to it. Glastopf is a unique honeypot that is designed to appear to be the most vulnerable computer and software possible. It answers every request for data with whatever the requester wants. |
|||
|
|
|
I built the first official Rapid7 Metasploit QA program, so perhaps i can be of assistance. Yes, it is seemingly impossible to create VMs for all modules. There's a lot of them. Luckily for you, nobody uses most of them. I'd focus on the top 50. You should clarify what type of signature you're trying to build (AV, IDS, etc) or at least the perspective of the attack you'd be able to see. For this exercise, i'll assume you're on the network. You can capture at least the initial sig of the attack without a victim, assuming a remote exploit, in some cases this would be enough. Client sides are a little trickier, mainly because there's built-in targeting in many of the modules that will prevent an exploit from being sent if certain conditions aren't fulfilled. We solved this at R7 by focusing on the top exploits and aux modules, and by building VMs that could be used in testing. We toyed with the idea of replaying traffic from the victim, which would allow us to remove it from the equation, but never got that far. It's only an optimization anyhow, as you still need to capture the initial interaction in order to replay it. In short, you have to get your hands dirty and understand what the module's doing in order to quickly build signatures. Sorry there's no easy answer :/. |
|||
|
|
|
Consider setting up a virtual machine (VM) running appropriate software to serve as your victim, and point Metasploit at it. |
|||
|
|
