Hot answers tagged

59

As far as forensics is concerned, Metasploit have payloads which are specifically designed to make the work of forensic analysis more difficult. For example, the most famous payload which is selected by default with a lot of exploit modules is the meterpreter payload. It completely runs in-memory and don't touch the disk for any operations (unless ...


30

I don't know about malicious attackers/hackers, but I do know several pentesters (myself included) that include Metasploit in their toolboxes. It's by far not the only tool used, but it certainly has its uses. That being said, your question seems to be about "covering your tracks" which is naturally something more useful to the malicious attacker. On my ...


26

Bypassing AV and IPS can be done through meterpreter or any other RAT. Most of the time meterpreter is handy because first it is open source and second it is implemented as a reflective DLL which insert itself in the exploited process without touching the disk. AV solutions can be bypassed easily through the Veil Evasion project while reverse_https ...


17

PowerShellEmpire and Slingshot are the two primary considerations for implants going into 2016. However, you can get these implants easily caught by intrusion detection, advanced antivirus engines, and threat hunting practices if you don't understand the techniques. Meterpreter and Cobalt Strike Beacon also have their place. An interesting backdoor I came ...


15

To be very honest, I feel that most of the books out there on Metasploit are outdated, as it gets updated very often. To learn more about the two, I would first download Metasploitable. This is an old configuration of Ubuntu with security holes for learning purposes. The Metasploit and Backtrack FAQs are good places to start. Learn what each tool does, ...


15

Yes pentesters do use Metasploit. With custom exe templates and shikata_ga_nai you are able to fool nearly every AV solution (google for av evasion to learn more about this) and the meterpreter payload is really handy to escalate privileges in Windows domains. That being said Metasploit is only one tool of many and a good pentester should know and use the ...


11

There's a couple of ways you could do this, that spring to mind First up would be using search which will show exploits matching the search term, (eg, search fileformat would return modules matching that term. The other was would be to use the tab completion, so if you type: use exploit/windows/fileformat/ and then hit Tab. It'll scroll through all the ...


11

There are strategies to improve the chances of evading a target's AV. The overall strategy is to try to develop a backdoor that is unique as possible. Writing your own backdoor from scratch will be the most successful. A protected, or "encrypted" envelope around malware is a common strategy. However, AV's will sometimes flag the envelope and assume ...


10

Ran into the same issue when reproducing. UPDATE: When using the windows/local/ask exploit, it seems you do not need to set a payload with it. In the windows/local/ask exploit you can set a reference to the undetectabletrojan.exe, which will then be executed with elevated privileges through UAC. However, as pointed out by @SilverlightFox, the ask exploit ...


9

In msf console, you can use the autocomplete feature (as Rory suggests) you can use the search command: search windows/fileformat -t exploit If not restrained to the console, another idea is to browse them online here http://www.metasploit.com/modules/exploit/windows/fileformat/ You can also use things like Armitage to browse exploits in a nicer way or ...


9

In assembly code, NOP is short for No OPeration. This is most popularly known for x86 chips as 0x90. When a processor loads that instruction, it simply does nothing (at least useful) for the one cycle and then advances the register to the next instruction. NOPs keep the payload sizes consistent ... by ensuring that any space not used by other code ...


9

The thing is that metasploit infact is a framework, so a collection of exploits. The beautiful thing about a framework is that you don't need to understand what's happening behind the scenes. I think that if you want to learn more about exploits and how they work, you pick yourself up some basic books like The Shellcoder's Handbook. If you want a more ...


9

There are advantages to using Immunity Security or CoreSec products over Rapid7 (whether the commercial Metasploit offerings or the FOSS MetaSploit Framework aka MSF). You'll have to test them out for yourself, but it mostly has to do with being able to run canned exploits and organize plans/results. As far as I understand it, all MSF exploits can be run ...


8

http://www.offensive-security.com/metasploit-unleashed/Meterpreter_Basics#execute The 'execute' command runs a command on the target http://www.offensive-security.com/metasploit-unleashed/Meterpreter_Basics#shell The 'shell' command will present you with a standard shell on the target system. If you want to run the command on the attacker host ...


7

Consider what reflective DLL injection is: You exploit an application to get it to execute arbitrary code and this shell code loads a DLL into memory as a blob of data (all standard shell code stuff so far...) and then gives it execution such that the DLL loads itself properly as a DLL via a PE loader. The purpose of this whole idea: Let you write a full ...


7

In order to evade the antivirus solution, first you need to understand how the antivirus flag your particular backdoor. First method the AV engine use is its vast set of malicious file signatures to search for particular patterns and signatures in an executable. In case of Metasploit, the AV solutions have signatures for the default exe template ...


7

Yes, Metasploit is very commonly used by industry professionals. See for example this link.


7

Yes, certainly. Malware that affects network accessible services very rarely require user interaction. A worm such as SQL Slammer is a prime example, which propagated across the Internet looking for exposed SQL Servers that had a blank password for the sa account. Client machines may also expose vulnerable services, but even if they don't, they can ...


7

I'm scared to chime in on this thread given that the existing answers are already so good! But I'm going to give it a go anyway, and come from a slightly different angle, and that is adapting and modifying Meterpreter itself to get around the problems. I'll begin by pulling your question apart a little. Now I can bypass Anti-Virus and Firewalls easily, ...


7

The alternative is to buy all the AV which are used in virustotal.com and build a similar system for local use. Don't forget to cut it from the internet because AV might phone home not only to get new signatures but also to report interesting new findings. Apart from that there is an underground market for such checks, see ...


6

Congratulations JMK, both of us are exactly in the same boat! You may want to check few questions i have asked on this site about using Metasploit. In addition to the excellent answers by @Terry-chia and others, I wish to add that one excellent reference which I found for Metasploit is Metasploit unleashed by Offensivesecurity.com. These guys also offer ...


5

The short answer is that you need to talk to the port to see who answers. Two things can come from this: banners protocol traffic The problem is that banners can be faked, so you need a tool to analyze the traffic in order to get an accurate picture. Tools: netcat/nc/ncat - useful for basic banner grabbing sbd - like nc, but encrypted - useful for ...


5

For one, it might not work at all. I tried recently (April 2012) on two Windows machines (7 and 2008 R2), and some aspect of the PostgreSQL setup invariably fails. I spoke to a Rapid7 account manager about it, and he confirmed that the Windows version is flaky. He also recommended against using it in a production environment.


5

As long as you install it from a known source, then there should not be any risk to you or your computer. However, if you mean 'office computer' by 'daily-use' computer, then your employer's network administrators may have a few questions for you if you use it and they detect the activity.


5

The most reliable source, is probably Metasploit's vulnerability & exploits DB - But some alternate sources do exist: You can use Exploit-DB search to search by CVE exploits by "metasploit" e.g.: ...


5

You have contradictory information: nmap says the port is filtered but nessus says that the vulnerability is present on the system. They cannot both be true, one of these must be wrong. Given that metasploit is unable to connect it is likely that nessus is reporting incorrectly, or is basing the vulnerability report on information gleaned from other open ...


5

Yes, I do use Metasploit to exploit a known vulnerabilities which has exploit written in Metasploit. In my case, we exploited using Metasploit just to prove the risk of the vulnerability. Show the risk to the client. So basically, the client knows when we want to exploit this vulnerability.


5

For shellcode the only potential issue is size constraints. But assuming null bytes are bad is a bad habit. You might mistakenly think a crash is not exploitable because the only viable pop pop ret/ROP addresses start with a null byte. Determining exact bad bytes isn't too time consuming and I always recommend doing it as it can save time if you need to ...


4

In terms of finding the corresponding exploits for Nessus output, there's a couple of good techniques. Firstly, Nessus puts a flag in each report item for "exploitable" which indicates that there is exploit code available. Once you've got that you can use the CVE number which will likely be listed in the finding (or the MS number for Microsoft vulns) as ...


4

When I use VirtualBox I set the network to "Bridged adapter", that way I can get a ip from the DHCP server on the network. And once I have that I can us the tools that are built in the OS (ifconfig/ipconfig) to get the ip I am assigned right now. And in order to connect to the Machine I either start the machine from VirtualBox directly so I get a "head" ...



Only top voted, non community-wiki answers of a minimum length are eligible