About generating Exe files from Metasploit scripts

Question

I'm a newbie to Metasploit framework. I want to create a standalone application (an exe file) exploiting MS08-067 vulnerability. Is that possible for me to have the application generated from Metasploit Exploit Scripts?

I've read an article at http://www.offensive-security.com/metasploit-unleashed/Backdooring_EXE_Files but it seemingly apply payloads only.

Answer 1

In short, not easily. It's a good question for someone getting started with the framework.

To see why, take a look at the exploit code here: https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/smb/ms08_067_netapi.rb and see how functionality of the exploit is abstracted into disparate libraries.

Put another way, because MS08-067 is a remote SMB/DCERPC vulnerability, and the exploitation of that vulnerability requires interacting with a target via the SMB protocol, a standalone exploit would need to include, at a minimum: Ruby, the Ruby exploitation (rex) library, all network libraries necessary to trigger the bug, any error-handling code available in libraries, and the exploit / payload to be executed.

It's certainly possible to bundle just the necessary components of the framework to exploit a single vulnerability, but isn't the typical use case (and a somewhat more portable solution is to use the built-in libraries on windows - as standalone exploits often do), so most folks don't use the framework this way.

Answer 2

I think the simplest way is to find the MS08-067 exploit code, which is available in exploit-db. Its written in several programming languages, compile the C code to standalone EXE then execute the msfpayload and msfencode to obfuscate the code from AV (change the putty.exe to your exe file).

by the way, you need to add the exe file in metasploit root directory and shell directory

BUT.. this code can be executed remotely so you don't need to use it with the example above. The backdoor method is useful for exploits that has to be executed locally (then follow the method above) or to open up a connection from the system to connect back to the hacker.