Slightly NSFW, be careful

1. Metasploitation 4 Adults
it’s not family affair…
Murtuja Bharmal

2. Disclaimer
Courtesy http://entertainment.desktopnexus.com_get_4642 1

3. About Me
• Now Work Busy Man….
• Unemployed….
• Interest…. /dev/random….
• Co-founder of null…. :-D
• X-IBMer’s …..
• Dal, Roti ka jugad, Security Consulting/Training

4. Agenda
Courtesy http://asonchua.com

5. Agenda
• Basics
• Metasploit Auxiliary
• Database Integration & Exploit Automation
• Client Side Exploit & Extended Usage
• Post Exploitation Fun
• Metasploit Add-ons

6. Basics
• What is vulnerability?
• What is Exploit?
• What is Payload?
• What is encoder?

7. Vulnerability
Courtesy http://harryjerry.com

8. Exploit
Courtesy http://entertainment.in.msn.com

9. Payload
• Use your imagination

10. Encoder
• Still Thinking? Ask me offline

11. Basics
• Vulnerability – Opportunity Window
• Exploit – En-cashing Opportunity
• Payload – En-cashment Window
• Encoder – Masking

12. How it works?
• Input malicious code Instead of Data
• Malicious code = Exploit Code + Payload

13. Payload + Exploit
Sanitized
You should be at ClubHACK
Courtesy http://guardian.co.uk Courtesy http://ivillage.com

14. Exploit Code
1 2
3 4
Courtesy 1. advice.eharmony.com 2. superstock.com 3. good-times.webshots.com 4. sheknows.com

15. Metasploit Framework
• Open Source
• Developed in Ruby
• Easy to Use
• 600+ Exploits
• 200+ payloads
• 25+ encoders
• 300+ auxiliary

16. Metasploit Auxiliary
Courtesy http://www.flickr.com

17. Metasploit Architecture
Courtesy http://www.offensive-security.com

18. Directory Structure

19. Filesystem And Libraries
• lib: the 'meat' of the framework code base
• data: editable files used by Metasploit
• tools: various useful command-line utilities
• modules: the actual MSF modules
• plugins: plugins that can be loaded at run-time
• scripts: Meterpreter and other scripts
• external: source code and third-party libraries
Courtesy http://www.offensive-security.com/metasploit-unleashed

20. msfconsole

21. msfconsole
• It is the only supported way to access most of the
features within Metasploit.
• Provides a console-based interface to the
framework
• Contains the most features and is the most stable
MSF interface
• Full readline support, tabbing, and command
completion
• Execution of external commands in msfconsole is
possible:
Courtesy http://www.offensive-security.com/metasploit-unleashed

23. Exploit Modules
Confused how to explain technically?
Courtesy http://www.sunpacmortgage.com

24. Metasploit – Exploit & Payloads
• Exploit
– Active
– Passive
• Payload Types
– Inline ( Non Staged)
– Staged
– Meterpreter
– PassiveX
– NoNX
– Ord
– IPv6
– Reflective DLL injection

25. Exploit DEMO

26. Metasploit Auxiliary
• Helper modules for pre-exploitation phase
– Admin, DOS, Fuzzers, Gather, Scanner, Server,
Spoof, SQLi, Sniffer, Test etc.
• 300+ Auxiliary modules

27. We will cover
• SCANNER
• MSSQL
• SNMP
• FTP

28. Auxiliarry DEMO

29. Database Integration and Exploit
Automation

30. Data
Courtesy http://www.joy2day.com

31. Need of Database
Sanitized
You should be at ClubHACK

32. Need of Database
• Network Penetration Testing
• Easy management/storage of result
• Report Generation

33. Database Integration& Exploit
Automation
• Database Support
• Nmap
• Nessus Bridge

34. Supported Database
• Mysql - BackTrack 4 r2, MYSQL and Metasploit work
together "out of the box“
• Postgres
• Sqlite3 – file based database, might be pull-off in future

36. Nmap
• db_nmap command to scan host/network
• Result will be stored in database
• Can view the result using db_hosts and
db_services command

37. NMAP Demo

38. Nessus Bridge
• Can perform vulnerability scan inside
msfconsole
• Supported using nessus bridge plugin
• Use xmlrpc to connect with nessusd

41. Nessus Bridge Demo

42. In a Finger tip
• db_autopwn
– Automate exploitation process
– Take target /service/vulnerability info from
database
– Spawns a meterpeter shell on success
– Noisy

44. db_autopwn Demo

45. Client Side Exploit & Extended
Usage

46. Client Side Exploit

47. Client Side Exploit & Extended Usage
• Browser autopwn
• Exploiting PDF
• Payload Generation & Back-dooring EXE
• Linux Backdoor

48. Browser autopwn
• Automate browser based vulnerability
exploitation
• Perform browser finger printing
• Auxiliary module server/browser_autopwnle

49. Browser autopwn Demo

50. Exploiting PDF
• Most exploited software since last 2 years
• Universally used software for document
format
• Favorite carrier for commercial malware
toolkit

51. What all PDF do?
• JavaScript runs under the context of App
Object Model
• File Attachment
• XML, SOAP capabilities
• Forms
• Web Services
• Database connections(ADBC)

52. What’s cracking up?
• Vulnerable APIs
– util.printf() (CVE-2008-2992)
– getIcons() (CVE-2009-0927)
– getAnnots() (CVE-20091492)
– customDictionaryOpen() (CVE-2009-1493)
– Doc.media.newPlayer (CVE-2009-4324)
• File parsing vulnerabilities
– JBIG2( Over a dozen CVE)
– libTiff (CVE-2010-0188)
• Social engineered arbit. command execution
– PDF escape by Didier Stevens
– Not a bug (feature)
– Exploitation in the wild
• Embedded Files
– libTiff (CVE-2010-0188)

53. PDF exploitation Demo

54. Payload Generation and Backdooring
EXE
• Payload can be converted to various file
format i.e. exe, dll, javascript etc.
• Encode payload to evade antivirus
• Can be embed with third party
software/utility

55. msfpayload & msfencode

56. Linux Backdoor
• Back-dooring payload with linux package
• Embed payload with deb installation package

57. Linux Backdooring Demo

58. Metasploit Add-ons

59. Metasploit Add-ons
Courtesy http://draftblogmm.blogspot.com

60. Fast-Track
• Easy Automation
• Utilize Metaspolit Framework on Backend
• Modes
– Interactive
– Web interface

61. Fast-Track Demo

62. SET(Social Engineering Toolkit)
• Weakest link in the information security chain
is the natural human willingness to accept
someone at their word.
• SET focuses on attacking the human element
• Develop in python
• Very easy to use
• Utilize Metaspolit Framework on Backend

63. SET(Social Engineering Toolkit)
• Operational Mode
– Interactive
– Web Interface
• Configuration file - config/set_config

64. SET Demo

65. Post Exploitation Fun

66. Post Exploitation Fun

67. What next after getting a Shell?
• One can run the command supported by
command prompt/shell.
• So what extra bit control needed to en-cash
the opportunity?

68. Meterpreter
• Meta Interpreter
• Post exploitation payload(tool)
• Uses in-memory DLL injection stagers
• Can be extended over the run time
• Encrypted communication

69. What can be done?
• Command execution
• File Upload/Download
• Process migration
• Log Deletion
• Privilege escalation
• Registry modification
• Deleting logs and killing antivirus
• Backdoors and Rootkits
• Pivoting
• …..etc.

70. Demo Meterpreter

71. Channels
• Communication using TLV (Type-Length-Value)
• Tagging of data with channel number
• Multiple program can be run at victim
machine using different channel

72. Pivoting
2 1
LAN INTERNET
Local Lan
Firewall/IPS
4
3
Web Database
Server DMZ Server

73. Demo Pivoting

74. Courtesy
• http://www.metasploit.com/
• http://www.backtrack-linux.org
• http://www.offensive-security.com/metasploit-
unleashed/
• http://www.secmaniac.com/
• http://securitytube.net/
• http://vimeo.com/
• http://www.irongeek.com/
• http://www.windowsecurity.com/whitepapers/Social-
Engineering-The-Weakest-Link.html
• http://www.google.co.in

75. Thank You
Murtuja Bharmal
void@null.co.in
Courtesy http://blingboo.com