1

I explain myself: To attack with a vulnerability & exploit it with Metasploit, you have first to find a vulnerability listed. Then once you have it, you set up the whole thing and end up with a link with the malicious file in it (to be clicked on).

So my question is: why someone would bother doing this, if he can attain the same results by getting control with a R.A.T. (downloadable through a link to be clicked on, too). With a RAT, you wouldn't have to bother searching for proper exploit. And in both cases, you have to escape the anti-virus. Can someone explain me this please ?

5

I think you are confusing a couple of different ideas. Metasploit helps you leverage vulnerabilities in order to craft exploits. Those exploits are used to deliver payloads. The resulting code can be something the user needs to install, or Metasploit can allow you to deliver the exploit directly without the user being involved (depending on the vulnerability).

The payload sent by the exploit can be many things, one of which is a RAT (called Meterpreter in Metasploit). But it can also be other kinds of payloads.

The scenario you describe for a RAT does not require an exploit or a vulnerability: you suggest the user just clicks on the malware and runs it. For that, you do not need the resources of Metasploit at all, although Metasploit could be helpful by providing the Meterpreter and the control hub.

  • Yes, so why someone would "bother" looking for vulnerabilities (and making sure they fit the configuration of the victim) to be able to deliver a paypload when he can do the same thing directly with a R.A.T.? In both cases, the victim will have to click on something; and in both cases, you will have to make it undetectable to AV. But in one case, you have to search/consult and use vulnerabilities, adding one more step to the whole process. PS: by "R.A.T.", I mean the software like "Cyabergate", "NJrat" etc... – Nick Apr 22 '15 at 7:37
  • 1
    If there are two files: employee_salary.exe and employee_salary.xls. Which file would bypass the firewall/IDS/IPS/, host based access control, email filtering policy etc? And which one would you click? That's why you need vulnerabilities in order to exploit a particular application while remaining stealthy. If you check a typical enterprise security policy, a lot of times executable code is restricted based upon publisher details, trusted locations etc while MS Office and PDFs can operate freely. – void_in Apr 22 '15 at 7:53
  • @Nick Not all vulnerabilities require user interaction to exploit. If your goal is encouraging the user to run a file, then that's more social engineering than exploitation. If your goal is exploiting a flaw in the user's OS or running services, which can usually be achieved without any user interaction, metasploit is the way to go. – AlexH Apr 22 '15 at 8:52
  • @void_in: But you can change the icon of a RAT. Or you can bind it with something else (a pdf). – Nick Apr 22 '15 at 10:30
  • 1
    @Nick Changing the icon has nothing to do with file types. IDS/IPS, AV, file type filtering etc don't take decisions based upon a file icon. User interaction is dependent on the type of application or service you are exploiting. If you are exploiting a core Windows service that listens remotely and which the attacker can interact with (e.g. SMB Server service), you don't need interaction. If you are exploiting word.exe, you require interaction since word.exe don't listen and can't be interacted with remotely. – void_in Apr 22 '15 at 10:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.