The Complete Metasploit Guide

Explore effective penetration testing techniques with Metasploit

Sagar Rahalkar, Nipun Jaswal

• Publisher: Packt Publishing
• Year: 2019
• Print ISBN: 9781838822477
• eBook ISBN: 9781838826901
• Edition: 1
• Topic: Informatique
• Subtopic: Cybersécurité

Master the Metasploit Framework and become an expert in penetration testing.

Key Features

• Gain a thorough understanding of the Metasploit Framework
• Develop the skills to perform penetration testing in complex and highly secure environments
• Learn techniques to integrate Metasploit with the industry's leading tools

Book Description

Most businesses today are driven by their IT infrastructure, and the tiniest crack in this IT network can bring down the entire business. Metasploit is a pentesting network that can validate your system by performing elaborate penetration tests using the Metasploit Framework to secure your infrastructure.

This Learning Path introduces you to the basic functionalities and applications of Metasploit. Throughout this book, you'll learn different techniques for programming Metasploit modules to validate services such as databases, fingerprinting, and scanning. You'll get to grips with post exploitation and write quick scripts to gather information from exploited systems. As you progress, you'll delve into real-world scenarios where performing penetration tests are a challenge. With the help of these case studies, you'll explore client-side attacks using Metasploit and a variety of scripts built on the Metasploit Framework.

By the end of this Learning Path, you'll have the skills required to identify system vulnerabilities by using thorough testing.

This Learning Path includes content from the following Packt products:

• Metasploit for Beginners by Sagar Rahalkar
• Mastering Metasploit - Third Edition by Nipun Jaswal

What you will learn

• Develop advanced and sophisticated auxiliary modules
• Port exploits from Perl, Python, and many other programming languages
• Bypass modern protections such as antivirus and IDS with Metasploit
• Script attacks in Armitage using the Cortana scripting language
• Customize Metasploit modules to modify existing exploits
• Explore the steps involved in post-exploitation on Android and mobile platforms

Who this book is for

This Learning Path is ideal for security professionals, web programmers, and pentesters who want to master vulnerability exploitation and get the most of the Metasploit Framework. Basic knowledge of Ruby programming and Cortana scripting language is required.

Reinventing Metasploit

We have covered the basics of Metasploit, so now we can move further into the underlying coding part of the Metasploit framework. We will start with the basics of Ruby programming to understand various syntaxes and its semantics. This chapter will make it easy for you to write Metasploit modules. In this chapter, we will see how we can design and fabricate various Metasploit modules with the functionality of our choice. We will also look at how we can create custom post-exploitation modules, which will help us gain better control of the exploited machine.

Consider a scenario where the number of systems under the scope of the penetration test is massive, and we crave a post-exploitation feature such as downloading a particular file from all the exploited systems. Manually, downloading a specific file from each system is not only time-consuming, but inefficient. Therefore, in a scenario like this, we can create a custom post-exploitation script that will automatically download the file from all of the compromised systems.

This chapter kicks off with the basics of Ruby programming in the context of Metasploit, and ends with developing various Metasploit modules. In this chapter, we will cover:

• The basics of Ruby programming in the context of Metasploit
• Exploring modules in Metasploit
• Writing custom scanners, brute force, and post-exploitation modules
• Coding Meterpreter scripts
• Understanding the syntaxes and semantics of Metasploit modules
• Performing the impossible with RailGun by using DLLs

Now, let's understand the basics of Ruby programming and gather the required essentials we need to code the Metasploit modules.

Before we delve deeper into coding Metasploit modules, we must have knowledge on the core features of Ruby programming that are required to design these modules. Why do we need Ruby for Metasploit? The following key points will help us understand the answer to this question:

• Constructing an automated class for reusable code is a feature of the Ruby language that matches the needs of Metasploit
• Ruby is an object-oriented style of programming
• Ruby is an interpreter-based language that is fast and reduces development time

Ruby - the heart of Metasploit

Ruby is indeed the heart of the Metasploit framework. However, what exactly is Ruby? According to the official website, Ruby is a simple and powerful programming language and was designed by Yokihiru Matsumoto in 1995. It is further defined as a dynamic, reflective, and general-purpose object-oriented programming language with functions similar to Perl.

You can download Ruby for Windows/Linux from: https://rubyinstaller.org/downloads/.

You can refer to an excellent resource for learning Ruby practically at: http://tryruby.org/levels/1/challenges/0.

Creating your first Ruby program

Ruby is an easy-to-learn programming language. Now, let's start with the basics of Ruby. Remember that Ruby is a broad programming language, and covering all of the capabilities of Ruby will push us beyond the scope of this book. Therefore, we will only stick to the essentials that are required in designing Metasploit modules.

Interacting with the Ruby shell

Ruby offers an interactive shell, and working with it will help us understand the basics. So, let's get started. Open the CMD/Terminal and type irb to launch the Ruby interactive shell.

Let's input something into the Ruby shell and see what happens; suppose I type in the number 2, as follows:

irb(main):001:0> 2 => 2 

The shell simply returns the value. Let's give another input, such as one with the addition operator, as follows:

irb(main):002:0> 2+3 => 5 

We can see that if we input numbers in an expression style, the shell returns the result of the expression.

Let's perform some functions on the string, such as storing the value of a string in a variable, as follows:

irb(main):005:0> a= "nipun" => "nipun" irb(main):006:0> b= "loves Metasploit" => "loves metasploit" 

After assigning values to both variables, a and b, let's see what happens when we issue a and a+b on the console:

irb(main):014:0> a => "nipun" irb(main):015:0> a+b => "nipun loves metasploit" 

We can see that when we typed in a as the input, it reflected the value stored in the variable named a. Similarly, a+b gave us a and b concatenated.

Defining methods in the shell

A method or a function is a set of statements that will execute when we make a call to it. We can declare methods easily in Ruby's interactive shell, or we can declare them using scripts. Knowledge of methods is important when working with Metasploit modules. Let's see the syntax:

def method_name [( [arg [= default]]...[, * arg [, &expr ]])] expr end 

To define a method, we use def followed by the method name, with arguments and expressions in parentheses. We also use an end statement, following all of the expressions to set an end to the method's definition. Here, arg refers to the arguments that a method receives. Also, expr refers to the expressions that a method receives or calculates inline. Let's have a look at an example:

irb(main):002:0> def xorops(a,b) irb(main):003:1> res = a ^ b irb(main):004:1> return res irb(main):005:1> end => :xorops 

We defined a method named xorops, which receives two arguments named a and b. Furthermore, we XORed the received arguments and stored the results in a new variable called res. Finally, we returned the result using the return statement:

irb(main):006:0> xorops(90,147) => 201 

We can see our function printing out the correct value by performing the XOR operation. Ruby offers two different functions to print the output: puts and print. When it comes to the Metasploit framework, the print_line function is primarily used. However, symbolizing success, status, and errors can be done using print_good, print_status, and print_error statements, respectively. Let's look at some examples here:

print_good("Example of Print Good") print_status("Example of Print Status") print_error("Example of Print Error") 

These print methods, when used with Metasploit modules, will produce the following output that depicts the green + symbol for good, the blue * for denoting status messages, and the red - symbol representing errors:

[+] Example of Print Good [*] Example of Print Status [-] Example of Print Error 

We will see the workings of various print statement types in the latter half of this chapter.

Variables and data types in Ruby

A variable is a placeholder for values that can change at any given time. In Ruby, we declare a variable only when required. Ruby supports numerous variable data types, but we will just discuss the ones relevant to Metasploit. Let's see what they are.

Working with strings

Strings are objects that represent a stream or sequence of characters. In Ruby, we can assign a string value to a variable with ease, as seen in the previous example. By merely defining the value in quotation marks or a single quotation mark, we can assign a value to a string.

It is recommended to use double quotation marks because if single quotations are used, it can create problems. Let's have a look at the problems that may arise:

irb(main):005:0> name = 'Msf Book' => "Msf Book" irb(main):006:0> name = 'Msf's Book' irb(main):007:0' ' 

We can see that when we used a single quotation ...

Table of contents

• Title Page
• Copyright
• About Packt
• Contributors
• Preface
• Introduction to Metasploit and Supporting Tools
• Setting up Your Environment
• Metasploit Components and Environment Configuration
• Information Gathering with Metasploit
• Vulnerability Hunting with Metasploit
• Client-side Attacks with Metasploit
• Web Application Scanning with Metasploit
• Antivirus Evasion and Anti-Forensics
• Cyber Attack Management with Armitage
• Extending Metasploit and Exploit Development
• Approaching a Penetration Test Using Metasploit
• Reinventing Metasploit
• The Exploit Formulation Process
• Porting Exploits
• Testing Services with Metasploit
• Virtual Test Grounds and Staging
• Client-Side Exploitation
• Metasploit Extended
• Evasion with Metasploit
• Metasploit for Secret Agents
• Visualizing with Armitage
• Tips and Tricks
• Other Books You May Enjoy