Hot answers tagged metasploit
13
To be very honest, I feel that most of the books out there on Metasploit are outdated, as it gets updated very often.
To learn more about the two, I would first download Metasploitable. This is an old configuration of Ubuntu with security holes for learning purposes.
The Metasploit and Backtrack FAQs are good places to start. Learn what each tool does, ...
10
In assembly code, NOP is short for No OPeration. This is most popularly known for x86 chips as 0x90. When a processor loads that instruction, it simply does nothing (at least useful) for the one cycle and then advances the register to the next instruction.
NOPs keep the payload sizes consistent
... by ensuring that any space not used by other code ...
8
There's a couple of ways you could do this, that spring to mind
First up would be using search which will show exploits matching the search term, (eg, search fileformat would return modules matching that term. The other was would be to use the tab completion, so if you type:
use exploit/windows/fileformat/ and then hit Tab. It'll scroll through all the ...
7
In msf console,
you can use the autocomplete feature (as Rory suggests)
you can use the search command: search windows/fileformat -t exploit
If not restrained to the console, another idea is to browse them online here http://www.metasploit.com/modules/exploit/windows/fileformat/
You can also use things like Armitage to browse exploits in a nicer way or ...
6
The thing is that metasploit infact is a framework, so a collection of exploits. The beautiful thing about a framework is that you don't need to understand what's happening behind the scenes.
I think that if you want to learn more about exploits and how they work, you pick yourself up some basic books like The Shellcoder's Handbook. If you want a more ...
5
As long as you install it from a known source, then there should not be any risk to you or your computer.
However, if you mean 'office computer' by 'daily-use' computer, then your employer's network administrators may have a few questions for you if you use it and they detect the activity.
5
Metasploit is meant to be run under a linux environment.
Wrong. Metasploit is simply a collection of Ruby scripts, so all you need is Ruby installed. Also, Metasploit has a Windows installer so go crazy with it...
4
For one, it might not work at all. I tried recently (April 2012) on two Windows machines (7 and 2008 R2), and some aspect of the PostgreSQL setup invariably fails. I spoke to a Rapid7 account manager about it, and he confirmed that the Windows version is flaky. He also recommended against using it in a production environment.
4
When I use VirtualBox I set the network to "Bridged adapter", that way I can get a ip from the DHCP server on the network. And once I have that I can us the tools that are built in the OS (ifconfig/ipconfig) to get the ip I am assigned right now.
And in order to connect to the Machine I either start the machine from VirtualBox directly so I get a "head" ...
4
Congratulations JMK, both of us are exactly in the same boat! You may want to check few questions i have asked on this site about using Metasploit.
In addition to the excellent answers by @Terry-chia and others, I wish to add that one excellent reference which I found for Metasploit is Metasploit unleashed by Offensivesecurity.com. These guys also offer ...
4
Consider what reflective DLL injection is: You exploit an application to get it to execute arbitrary code and this shell code loads a DLL into memory as a blob of data (all standard shell code stuff so far...) and then gives it execution such that the DLL loads itself properly as a DLL via a PE loader. The purpose of this whole idea: Let you write a full ...
4
You have set up the system with the intent that it will attempt running metasploit attacks, therefore by proxy you are actively running metasploit attacks. Basically you're just playing word games and trying to pretend you aren't doing what you've designed the system to do.
It's no different than setting up one of those infection servers crackers currently ...
4
From looking at the source, I am going to wager that one potential reason is due to the fact that the user has the option to spoof the source IP address that is sending the malicious DNS requests and responses.
If one was using the target name server to retrieve information, they would need to make requests from their true IP in order to receive responses. ...
3
The short answer is that you need to talk to the port to see who answers. Two things can come from this:
banners
protocol traffic
The problem is that banners can be faked, so you need a tool to analyze the traffic in order to get an accurate picture.
Tools:
netcat/nc/ncat - useful for basic banner grabbing
sbd - like nc, but encrypted - useful for ...
3
nmap.
nmap can test for what services are running on a particular port, using information such as packet headers returned.
nmap uses its own library of common ports and services which covers many of the most common and sometimes not so common services. Of course, there might be some services which nmap does not recognize, but you can remedy that by ...
3
Metasploitable was recently upgraded - here's the link. This newer version is more stable and includes several updates afaik.
So that you don't nuke something permanently, I'd recommend first playing with Backtrack on a USB key as live install. Here's a good how-to link from the BT5 wiki.
3
If you're looking to list certain properties of the exploits (for instance, targets), have a look at the tools directory:
user@disko:~/framework/tools$ ./module_rank.rb
Module Ranks
============
Module Rank
------ ----
...
3
They have video series on developing exploits with metasploit here
http://www.securitytube.net/groups?operation=viewall&groupId=0
Here are some other links
http://www.offensive-security.com/metasploit-unleashed/Useful_API_Calls
http://www.offensive-security.com/metasploit-unleashed/Exploit_Development
...
3
While installing metasploit on your machine will not directly casue any issues you should be aware of the following
metasploit, like all other software, can introduce vulnerabilities as a result of the underlying components that make it work, the database listener and Ruby service are installed as well as a web framework depending on the version installed. ...
3
I'd recommend that you don't install Metasploit on your production OS. To make Metasploit run without issues, it's recommended that you switch off your firewall and anti-virus, which may not be a good idea for your production system. My recommendation: Install Metasploit on a virtual machine (e.g. VirtualBox) in Bridged Mode (so the payloads can connect ...
2
Nessus Filter Options:
"exploit available" = true (filters plug-ins to those with public exploits)
"metasploit exploit framework" = true (filters plug-ins to those with Metasploit vulnerabilities)
The explanations of these filters can be found in the user guide.
But, I assume that you also want the plugin list to automatically update when the Nessus ...
2
I have been using the Windows port of Metasploit for a while now and it is working great. Also, the development team have done a great job in packaging Metasploit for Windows, installing it is a breeze.
However, some Metasploit modules are not supported on the Windows platform, like sniffer ones (pSnuffle for example).
2
VM's are certainly a good option, there's plenty of out of the box vunerable systems you can fire up (e.g. Metasploitable). That combined with a TCPdump of the traffic should yield most of the information you need.
That being said, you may have more luck creating signatures for the Metasploit Payloads. There are fewer of them, they change less frequently ...
2
I'd actually disagree with most here and advise you to go to host only mode. This means go to File > Preferences > Network and click on the add adapter button. This creates a virtual network interface on your computer.
At that point you can go to your vulnerable VM > settings > network > Host-only adapter. This means only your main PC which is running the ...
2
Set the connection to bridged.
Depending on the OS..
Type "ifconfig" in unix to get the IP
Type "ipconfig" in windows to get the ip
You now have the IP to connect to :)
=====================
Or do it like in a proper penetration test and scan the network to find the box you are looking for.
nmap -sP 192.168.2.1/24
Replace the IP with the corresponding ...
2
Not really a security related question but here you go:
Depending on the configuration, you may find it hard to connect to your VM if it's configured as NAT. NAT insulates your VM from the outside world but it's a layer of complexity you probably don't want to deal with when learning.
If you're using something like Metasploitable it comes with so many ...
2
Reusing the existing channel requires additional complexity, its also important to note that not every metasploit module uses a socket to exploit the host. The shellcode would have to search memory (egghunt...) and find the socket and then use it. Shellcode is all about being small and simple.
That being said there are other methods of influencing a host ...
2
What you are looking for is Karmetasploit. It is the integration of Karma with MSF to offer a variety of network services to wifi clients.
Several tutorials and videos are available.
In addition, there are hardware solutions, like the wifi-pineapple from Hak9.
2
In terms of finding the corresponding exploits for Nessus output, there's a couple of good techniques.
Firstly, Nessus puts a flag in each report item for "exploitable" which indicates that there is exploit code available.
Once you've got that you can use the CVE number which will likely be listed in the finding (or the MS number for Microsoft vulns) as ...
2
The book Metasploit: The Penetration Testers Guide was quite good (http://www.amazon.com/Metasploit-The-Penetration-Testers-Guide/dp/159327288X). It was written by people very close to the project (the creator of SET, the creator of BackTrack, to name two) and the forward was written by HD Moore, the creator of Metasploit. It is certainly not out of date, as ...
Only top voted, non community-wiki answers of a minimum length are eligible
