Tag Info

Hot answers tagged

15

To be very honest, I feel that most of the books out there on Metasploit are outdated, as it gets updated very often. To learn more about the two, I would first download Metasploitable. This is an old configuration of Ubuntu with security holes for learning purposes. The Metasploit and Backtrack FAQs are good places to start. Learn what each tool does, ...


9

There's a couple of ways you could do this, that spring to mind First up would be using search which will show exploits matching the search term, (eg, search fileformat would return modules matching that term. The other was would be to use the tab completion, so if you type: use exploit/windows/fileformat/ and then hit Tab. It'll scroll through all the ...


9

In assembly code, NOP is short for No OPeration. This is most popularly known for x86 chips as 0x90. When a processor loads that instruction, it simply does nothing (at least useful) for the one cycle and then advances the register to the next instruction. NOPs keep the payload sizes consistent ... by ensuring that any space not used by other code ...


8

In msf console, you can use the autocomplete feature (as Rory suggests) you can use the search command: search windows/fileformat -t exploit If not restrained to the console, another idea is to browse them online here http://www.metasploit.com/modules/exploit/windows/fileformat/ You can also use things like Armitage to browse exploits in a nicer way or ...


6

The thing is that metasploit infact is a framework, so a collection of exploits. The beautiful thing about a framework is that you don't need to understand what's happening behind the scenes. I think that if you want to learn more about exploits and how they work, you pick yourself up some basic books like The Shellcoder's Handbook. If you want a more ...


6

http://www.offensive-security.com/metasploit-unleashed/Meterpreter_Basics#execute The 'execute' command runs a command on the target http://www.offensive-security.com/metasploit-unleashed/Meterpreter_Basics#shell The 'shell' command will present you with a standard shell on the target system. If you want to run the command on the attacker host ...


6

There are strategies to improve the chances of evading a target's AV. The overall strategy is to try to develop a backdoor that is unique as possible. Writing your own backdoor from scratch will be the most successful. A protected, or "encrypted" envelope around malware is a common strategy. However, AV's will sometimes flag the envelope and assume ...


5

Congratulations JMK, both of us are exactly in the same boat! You may want to check few questions i have asked on this site about using Metasploit. In addition to the excellent answers by @Terry-chia and others, I wish to add that one excellent reference which I found for Metasploit is Metasploit unleashed by Offensivesecurity.com. These guys also offer ...


5

For one, it might not work at all. I tried recently (April 2012) on two Windows machines (7 and 2008 R2), and some aspect of the PostgreSQL setup invariably fails. I spoke to a Rapid7 account manager about it, and he confirmed that the Windows version is flaky. He also recommended against using it in a production environment.


5

As long as you install it from a known source, then there should not be any risk to you or your computer. However, if you mean 'office computer' by 'daily-use' computer, then your employer's network administrators may have a few questions for you if you use it and they detect the activity.


5

In order to evade the antivirus solution, first you need to understand how the antivirus flag your particular backdoor. First method the AV engine use is its vast set of malicious file signatures to search for particular patterns and signatures in an executable. In case of Metasploit, the AV solutions have signatures for the default exe template ...


4

When I use VirtualBox I set the network to "Bridged adapter", that way I can get a ip from the DHCP server on the network. And once I have that I can us the tools that are built in the OS (ifconfig/ipconfig) to get the ip I am assigned right now. And in order to connect to the Machine I either start the machine from VirtualBox directly so I get a "head" ...


4

If you're looking to list certain properties of the exploits (for instance, targets), have a look at the tools directory: user@disko:~/framework/tools$ ./module_rank.rb Module Ranks ============ Module Rank ------ ---- ...


4

The short answer is that you need to talk to the port to see who answers. Two things can come from this: banners protocol traffic The problem is that banners can be faked, so you need a tool to analyze the traffic in order to get an accurate picture. Tools: netcat/nc/ncat - useful for basic banner grabbing sbd - like nc, but encrypted - useful for ...


4

Metasploitable was recently upgraded - here's the link. This newer version is more stable and includes several updates afaik. So that you don't nuke something permanently, I'd recommend first playing with Backtrack on a USB key as live install. Here's a good how-to link from the BT5 wiki.


4

You have set up the system with the intent that it will attempt running metasploit attacks, therefore by proxy you are actively running metasploit attacks. Basically you're just playing word games and trying to pretend you aren't doing what you've designed the system to do. It's no different than setting up one of those infection servers crackers currently ...


4

I'd recommend that you don't install Metasploit on your production OS. To make Metasploit run without issues, it's recommended that you switch off your firewall and anti-virus, which may not be a good idea for your production system. My recommendation: Install Metasploit on a virtual machine (e.g. VirtualBox) in Bridged Mode (so the payloads can connect ...


4

From looking at the source, I am going to wager that one potential reason is due to the fact that the user has the option to spoof the source IP address that is sending the malicious DNS requests and responses. If one was using the target name server to retrieve information, they would need to make requests from their true IP in order to receive responses. ...


4

Metasploit is meant to be run under a linux environment. Wrong. Metasploit is simply a collection of Ruby scripts, so all you need is Ruby installed. Also, Metasploit has a Windows installer so go crazy with it...


4

You have contradictory information: nmap says the port is filtered but nessus says that the vulnerability is present on the system. They cannot both be true, one of these must be wrong. Given that metasploit is unable to connect it is likely that nessus is reporting incorrectly, or is basing the vulnerability report on information gleaned from other open ...


3

In terms of finding the corresponding exploits for Nessus output, there's a couple of good techniques. Firstly, Nessus puts a flag in each report item for "exploitable" which indicates that there is exploit code available. Once you've got that you can use the CVE number which will likely be listed in the finding (or the MS number for Microsoft vulns) as ...


3

Consider what reflective DLL injection is: You exploit an application to get it to execute arbitrary code and this shell code loads a DLL into memory as a blob of data (all standard shell code stuff so far...) and then gives it execution such that the DLL loads itself properly as a DLL via a PE loader. The purpose of this whole idea: Let you write a full ...


3

The book Metasploit: The Penetration Testers Guide was quite good (http://www.amazon.com/Metasploit-The-Penetration-Testers-Guide/dp/159327288X). It was written by people very close to the project (the creator of SET, the creator of BackTrack, to name two) and the forward was written by HD Moore, the creator of Metasploit. It is certainly not out of date, as ...


3

nmap. nmap can test for what services are running on a particular port, using information such as packet headers returned. nmap uses its own library of common ports and services which covers many of the most common and sometimes not so common services. Of course, there might be some services which nmap does not recognize, but you can remedy that by ...


3

I have been using the Windows port of Metasploit for a while now and it is working great. Also, the development team have done a great job in packaging Metasploit for Windows, installing it is a breeze. However, some Metasploit modules are not supported on the Windows platform, like sniffer ones (pSnuffle for example).


3

They have video series on developing exploits with metasploit here http://www.securitytube.net/groups?operation=viewall&groupId=0 Here are some other links http://www.offensive-security.com/metasploit-unleashed/Useful_API_Calls http://www.offensive-security.com/metasploit-unleashed/Exploit_Development ...


3

While installing metasploit on your machine will not directly casue any issues you should be aware of the following metasploit, like all other software, can introduce vulnerabilities as a result of the underlying components that make it work, the database listener and Ruby service are installed as well as a web framework depending on the version installed. ...


3

This won't work with reverse payloads unless you can do portforwarding on the system which is NATing your traffic. Hence it's better to generate a payload which allows you to connect to it rather than a payload which connects back (but if your target is also using NAT, then this becomes obsolete as well). For instance: shell/bind_tcp This does give ...


3

To answer whether the sniffer module runs in promiscuous mode by default I am doing a test in my lab right now and will update it here when its done. UPDATE The answer finally comes out to be YES. The sniffer module does its capturing in promiscuous mode. To test I set up a win-xp-sp2 (10.10.10.101) vm on proxmoxVE (kvm virtual env). I added it to a bridge ...


3

The most reliable source, is probably Metasploit's vulnerability & exploits DB - But some alternate sources do exist: You can use Exploit-DB search to search by CVE exploits by "metasploit" e.g.: ...



Only top voted, non community-wiki answers of a minimum length are eligible