How was pentest performed in the era with no frameworks like Metasploit?

Question

I have been interested in security lately, I have been reading mainly cookbooks on Metasploit framework, how social engineering has been employed exhaustively, I have started reading some IA-32 concepts, but then I get confused at some point. If I take into account an attack with no user interaction - no possibility of client-side attack - , no framework like Metasploit available, no nmap, no nessus. What and how does a pentest happen? What's in the core?

Hypothetically speaking, a friend of mine runs an amateurish webserver he coded, full of flaws and vulnerability. This server is running on port 80. I went his home, I got a copy of the software with no permission and write out his network infos. At home I scrutinized the code and I found a stack overflow vulnerability.

But what's next? Here I can barely concatenate. My exploit, as a client(browser), needs to connect to his webserver on port 80 in order to exploit the vulnerability and deploy the payload(a reverse one)? The latter is going to need to act as a server to connect back to my another client that is listening, waiting for a shell? I am quite confused about "naked pentest", I feel there are misunderstandings I unfortunately made that I would like some explanations to fill in the gaps in order for me to move on. Besides that, english is not my first language. Thanks in advance.

Answer 1

Before Metasploit and other frameworks, we used separate tools, wrote our own tools, or did things manually.

Port scanners and network service identifier tools have been around for a long time - almost as long as the field of computer security itself. Even if you didn't have access to nmap, you could script up a simple port scanner in most languages within a couple of hours.

A framework makes little difference as to how you would develop and use an exploit for a new vulnerability. The only change when using a framework is that you have to make the exploit module compatible with that framework.

First, you would identify the buffer offset for controlling EIP. In a framework, you might use a tool like pattern_create.rb to generate a special data blob and then calculate the offset based on EIP. Without such a tool, you just have to use trial and error - make a blob of data that starts with a bunch of 0x41414141 values and switches to 0x42424242 values later on. Run the exploit, check the stack, then re-calculate your number of 0x41414141 values. Keep going until you find the right number of bytes before the EIP offset. From there you can control EIP, and set it up to run a ROP chain to VirtualProtect, or just a jmp esp if DEP is disabled. Your payload could be a reverse shell, or whatever you want. You would set up a script that listens on a TCP port for your incoming connection and pipe it through to stdin/stdout so you can interact with the shell.

Complicated, but that's still how it's done today - we just take the results of that process and stick them into a metasploit module at the end.

---

P.S. For more info on exploit writing for native code on the Windows platform, I highly recommend checking out the CoreLAN Exploit Writing Tutorials.

Answer 2

The same way a Capture The Flag challenge happens, you craft everything yourself.

In the end metasploit, nessus and nmap are all tools or a collection of tools to perform some tasks more easily. But you can "easily" write them yourself. A basic port scanner is quite easy to write. The thing is that Nessus and Metasploit reduce the time you have to spend as a pentester and the exploits are ready for use, this means you do not need a lot of skill to apply the exploits.

What you are trying to do requires some very deep understanding and I fear that we cannot explain you how to craft such an exploit in just a few steps. I advice you to study this a bit further. Books like the Shellcoders Handbook are really good at explaining this, but it's not for the faint hearted.