Tag Info

Hot answers tagged

41

As far as forensics is concerned, Metasploit have payloads which are specifically designed to make the work of forensic analysis more difficult. For example, the most famous payload which is selected by default with a lot of exploit modules is the meterpreter payload. It completely runs in-memory and don't touch the disk for any operations (unless ...


21

I don't know about malicious attackers/hackers, but I do know several pentesters (myself included) that include Metasploit in their toolboxes. It's by far not the only tool used, but it certainly has its uses. That being said, your question seems to be about "covering your tracks" which is naturally something more useful to the malicious attacker. On my ...


15

To be very honest, I feel that most of the books out there on Metasploit are outdated, as it gets updated very often. To learn more about the two, I would first download Metasploitable. This is an old configuration of Ubuntu with security holes for learning purposes. The Metasploit and Backtrack FAQs are good places to start. Learn what each tool does, ...


10

Yes pentesters do use Metasploit. With custom exe templates and shikata_ga_nai you are able to fool nearly every AV solution (google for av evasion to learn more about this) and the meterpreter payload is really handy to escalate privileges in Windows domains. That beeing said Metasploit is only one tool of many and a good pentester should know and use the ...


9

There's a couple of ways you could do this, that spring to mind First up would be using search which will show exploits matching the search term, (eg, search fileformat would return modules matching that term. The other was would be to use the tab completion, so if you type: use exploit/windows/fileformat/ and then hit Tab. It'll scroll through all the ...


9

In assembly code, NOP is short for No OPeration. This is most popularly known for x86 chips as 0x90. When a processor loads that instruction, it simply does nothing (at least useful) for the one cycle and then advances the register to the next instruction. NOPs keep the payload sizes consistent ... by ensuring that any space not used by other code ...


8

In msf console, you can use the autocomplete feature (as Rory suggests) you can use the search command: search windows/fileformat -t exploit If not restrained to the console, another idea is to browse them online here http://www.metasploit.com/modules/exploit/windows/fileformat/ You can also use things like Armitage to browse exploits in a nicer way or ...


8

The thing is that metasploit infact is a framework, so a collection of exploits. The beautiful thing about a framework is that you don't need to understand what's happening behind the scenes. I think that if you want to learn more about exploits and how they work, you pick yourself up some basic books like The Shellcoder's Handbook. If you want a more ...


7

Yes, certainly. Malware that affects network accessible services very rarely require user interaction. A worm such as SQL Slammer is a prime example, which propagated across the Internet looking for exposed SQL Servers that had a blank password for the sa account. Client machines may also expose vulnerable services, but even if they don't, they can ...


6

Congratulations JMK, both of us are exactly in the same boat! You may want to check few questions i have asked on this site about using Metasploit. In addition to the excellent answers by @Terry-chia and others, I wish to add that one excellent reference which I found for Metasploit is Metasploit unleashed by Offensivesecurity.com. These guys also offer ...


6

http://www.offensive-security.com/metasploit-unleashed/Meterpreter_Basics#execute The 'execute' command runs a command on the target http://www.offensive-security.com/metasploit-unleashed/Meterpreter_Basics#shell The 'shell' command will present you with a standard shell on the target system. If you want to run the command on the attacker host ...


6

There are strategies to improve the chances of evading a target's AV. The overall strategy is to try to develop a backdoor that is unique as possible. Writing your own backdoor from scratch will be the most successful. A protected, or "encrypted" envelope around malware is a common strategy. However, AV's will sometimes flag the envelope and assume ...


5

The short answer is that you need to talk to the port to see who answers. Two things can come from this: banners protocol traffic The problem is that banners can be faked, so you need a tool to analyze the traffic in order to get an accurate picture. Tools: netcat/nc/ncat - useful for basic banner grabbing sbd - like nc, but encrypted - useful for ...


5

For one, it might not work at all. I tried recently (April 2012) on two Windows machines (7 and 2008 R2), and some aspect of the PostgreSQL setup invariably fails. I spoke to a Rapid7 account manager about it, and he confirmed that the Windows version is flaky. He also recommended against using it in a production environment.


5

As long as you install it from a known source, then there should not be any risk to you or your computer. However, if you mean 'office computer' by 'daily-use' computer, then your employer's network administrators may have a few questions for you if you use it and they detect the activity.


5

In order to evade the antivirus solution, first you need to understand how the antivirus flag your particular backdoor. First method the AV engine use is its vast set of malicious file signatures to search for particular patterns and signatures in an executable. In case of Metasploit, the AV solutions have signatures for the default exe template ...


5

Yes, Metasploit is very commonly used by industry professionals. See for example this link.


4

When I use VirtualBox I set the network to "Bridged adapter", that way I can get a ip from the DHCP server on the network. And once I have that I can us the tools that are built in the OS (ifconfig/ipconfig) to get the ip I am assigned right now. And in order to connect to the Machine I either start the machine from VirtualBox directly so I get a "head" ...


4

If you're looking to list certain properties of the exploits (for instance, targets), have a look at the tools directory: user@disko:~/framework/tools$ ./module_rank.rb Module Ranks ============ Module Rank ------ ---- ...


4

They have video series on developing exploits with metasploit here http://www.securitytube.net/groups?operation=viewall&groupId=0 Here are some other links http://www.offensive-security.com/metasploit-unleashed/Useful_API_Calls http://www.offensive-security.com/metasploit-unleashed/Exploit_Development ...


4

Metasploitable was recently upgraded - here's the link. This newer version is more stable and includes several updates afaik. So that you don't nuke something permanently, I'd recommend first playing with Backtrack on a USB key as live install. Here's a good how-to link from the BT5 wiki.


4

From looking at the source, I am going to wager that one potential reason is due to the fact that the user has the option to spoof the source IP address that is sending the malicious DNS requests and responses. If one was using the target name server to retrieve information, they would need to make requests from their true IP in order to receive responses. ...


4

You have set up the system with the intent that it will attempt running metasploit attacks, therefore by proxy you are actively running metasploit attacks. Basically you're just playing word games and trying to pretend you aren't doing what you've designed the system to do. It's no different than setting up one of those infection servers crackers currently ...


4

I'd recommend that you don't install Metasploit on your production OS. To make Metasploit run without issues, it's recommended that you switch off your firewall and anti-virus, which may not be a good idea for your production system. My recommendation: Install Metasploit on a virtual machine (e.g. VirtualBox) in Bridged Mode (so the payloads can connect ...


4

Metasploit is meant to be run under a linux environment. Wrong. Metasploit is simply a collection of Ruby scripts, so all you need is Ruby installed. Also, Metasploit has a Windows installer so go crazy with it...


4

The most reliable source, is probably Metasploit's vulnerability & exploits DB - But some alternate sources do exist: You can use Exploit-DB search to search by CVE exploits by "metasploit" e.g.: ...


4

You have contradictory information: nmap says the port is filtered but nessus says that the vulnerability is present on the system. They cannot both be true, one of these must be wrong. Given that metasploit is unable to connect it is likely that nessus is reporting incorrectly, or is basing the vulnerability report on information gleaned from other open ...


4

Yes, I do use Metasploit to exploit a known vulnerabilities which has exploit written in Metasploit. In my case, we exploited using Metasploit just to prove the risk of the vulnerability. Show the risk to the client. So basically, the client knows when we want to exploit this vulnerability.


4

The vulnerability is just the weakness in the software that allows an attacker to gain control. For example (since you mentioned buffer overflows), an unchecked buffer copy via strcpy, or using memcpy with an attacker-controlled length. An exploit is the actual process of leveraging a vulnerability. For buffer overflows, this is the process of overwriting ...


3

Consider what reflective DLL injection is: You exploit an application to get it to execute arbitrary code and this shell code loads a DLL into memory as a blob of data (all standard shell code stuff so far...) and then gives it execution such that the DLL loads itself properly as a DLL via a PE loader. The purpose of this whole idea: Let you write a full ...



Only top voted, non community-wiki answers of a minimum length are eligible