Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've played around with metasploit simply as a hobby but am wondering if actual pentesters and/or hackers actually use metasploit to get into systems or do they write their own post exploitation modules or their own programs entirely?

Reason I ask is because metasploit does not seem to be able to selectively clear windows event logs and such, or perhaps I just couldn't find it.(the nearest I can find is clearev but that simply wipes out everything which isn't very sneaky) Besides, even if it is able to selectively clear the event logs there will be places like the prefetch queue in ring 0 where forensics will be able to find what I did from the system image...

share|improve this question
1  
Not only do pen testers use Metasploit, but in many cases it is the only thing they know how to do. –  jwg Jun 11 at 10:31

5 Answers 5

up vote 38 down vote accepted

As far as forensics is concerned, Metasploit have payloads which are specifically designed to make the work of forensic analysis more difficult. For example, the most famous payload which is selected by default with a lot of exploit modules is the meterpreter payload. It completely runs in-memory and don't touch the disk for any operations (unless specifically asked by the user). Which means there will be no evidence in the prefetch folder or any other place on the disk.

You don't have to clear all the event logs. You can selective clear any event log you want through the meterpreter script event_manager.

Meterpreter has a tool called timestomp which can change the modification, access, creation, and execution time of any file on the hard disk to any arbitrary value. You can securely wipe out any file with the sdel (safe delete) module which not only securely wipe the file contents but rename the file to a long random string before the deletion which makes the forensic recovery of not only the contents but the file meta data very difficult as well.

Now comes to your second part of the use of Metasploit by actual malicious attackers in real world attacks. There have been reports that Metasploit was used in one of the attacks on the Iranian nuclear facility. The reason you don't see Metasploit more often is due the open source nature of the product. Since the exploits and payloads are available to everyone, by default every security product such as antivirus, IDS/IPS etc consider these files as malicious. The defense industry has gone to an extent that even if one create a completely benign file with Metasploit, it will be detected by almost all the AV solutions. Generate an empty payload like:

echo -n | msfencode -e generic/none -t exe > myn.exe

Upload it to VirusTotal and you will see that more than half of the AV solutions detect it as malicious. More details can be found on the Matt Weeks' blog here.

With this behavior no attacker will risk using Metasploit for actual attacks due to the very high detection rate. The modules can be easily customized and bypassing AV and other security controls through Metasploit is quite easy as well. However, at that point it is difficult to determine if the payload is written from the scratch or the Metasploit module has been modified. Therefore, it is difficult to say for sure how many attackers have used or continue to use Metasploit in their operations.

share|improve this answer

Yes, Metasploit is very commonly used by industry professionals.

See for example this link.

share|improve this answer

I don't know about malicious attackers/hackers, but I do know several pentesters (myself included) that include Metasploit in their toolboxes. It's by far not the only tool used, but it certainly has its uses. That being said, your question seems to be about "covering your tracks" which is naturally something more useful to the malicious attacker. On my pentest engagements, we rarely tamper with logs, except when detecting log tampering is one of the "blue team" goals. (Then we do it to see if it gets detected.)

share|improve this answer

Yes, I do use Metasploit to exploit a known vulnerabilities which has exploit written in Metasploit. In my case, we exploited using Metasploit just to prove the risk of the vulnerability. Show the risk to the client. So basically, the client knows when we want to exploit this vulnerability.

share|improve this answer

Yes pentesters do use Metasploit. With custom exe templates and shikata_ga_nai you are able to fool nearly every AV solution (google for av evasion to learn more about this) and the meterpreter payload is really handy to escalate privileges in Windows domains.

That beeing said Metasploit is only one tool of many and a good pentester should know and use the right tool for the right task.

Clearing specific entries out of the event log might come in handy for a pentest when the goal is to be undetected and fool siem systems. However just because this feature is missing from Metasploit (yet) does not mean that you cannot use all the usefull modules that are already there.

Regarding custom toolkits i would imagine that it would be more effective to fork Metasploit or to simple just write your own post exploitation modules (like selective event log deletion).

Thats the beauty of open source/software.

share|improve this answer
    
Small additional Note: shikata_ga_nai (or any other encoder) should not be used to in order to avoid av-software. It works often, but encoders are primarily ment to avoid-badchars etc. Metasploit Pro has a true anti-virus evasion technique implemented that generates a truely random program. –  Stolas Jun 11 at 8:47

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.