Book Image

Metasploit Penetration Testing Cookbook, Second Edition

By : Monika Agarwal, Abhinav Singh
Book Image

Metasploit Penetration Testing Cookbook, Second Edition

By: Monika Agarwal, Abhinav Singh

Overview of this book

<p>Metasploit software helps security and IT professionals identify security issues, verify vulnerability mitigations, and manage expert-driven security assessments. Capabilities include smart exploitation, password auditing, web application scanning, and social engineering. Teams can collaborate in Metasploit and present their findings in consolidated reports. The goal of the software is to provide a clear understanding of the critical vulnerabilities in any environment and to manage those risks.</p> <p>Metasploit Penetration Testing Cookbook, Second Edition contains chapters that are logically arranged with an increasing level of complexity and thoroughly covers some aspects of Metasploit, ranging from pre-exploitation to the post-exploitation phase. This book is an update from version 4.0 to version 4.5. It covers the detailed penetration testing techniques for different specializations like wireless networks, VOIP systems, and the cloud.</p> <p>Metasploit Penetration Testing Cookbook, Second Edition covers a number of topics which were not part of the first edition. You will learn how to penetrate an operating system (Windows 8 penetration testing) to the penetration of a wireless network, VoIP network, and then to cloud.</p> <p>The book starts with the basics, such as gathering information about your target, and then develops to cover advanced topics like building your own framework scripts and modules. The book goes deep into operating-systems-based penetration testing techniques and moves ahead with client-based exploitation methodologies. In the post-exploitation phase, it covers meterpreter, antivirus bypass, ruby wonders, exploit building, porting exploits to the framework, and penetration testing, while dealing with VOIP, wireless networks, and cloud computing.</p> <p>This book will help readers to think from a hacker's perspective to dig out the flaws in target networks and also to leverage the powers of Metasploit to compromise them. It will take your penetration skills to the next level.</p>
Table of Contents (18 chapters)
Metasploit Penetration Testing CookbookSecond Edition
Credits
About the Authors
About the Reviewers
www.PacktPub.com
Preface
Index

Pentesting in the cloud with hackaserver.com


If our assets are in the cloud, we can apply penetration tests on them like any other system with an IP address. But setting up a penetration testing lab can be time-consuming and expensive (unless you have the hardware already). So we will be using a free service called Hack A Server, which offers vulnerable machines to pwn in the cloud. We will be using an instance of Metasploit Pro here in this experiment.

Getting ready

To pentest in the cloud, the following will be required:

  1. Download and launch a VPN configuration to connect to the vulnerable machines.

  2. Go to Hack A Server (www.hackaserver.com) and sign up for a free account. Once signed up, click on Training Arena on the toolbar, as shown in the following screenshot:

  3. Then click on Training Arena in your own space. You will get list of all the vulnerable machines as shown in the following screenshot:

How to do it...

  1. We can see lots of vulnerable machines. We will be selecting Metasploitable and then clicking on the Hack it! button on the right-hand side.

    Note

    Metasploitable

    IP address: 10.3.33.132

    Host name: Metasploitable.hackaserver.local

  2. You must set up your VPN connection to the arena. Download your connection certificate here. Unzip the certificate bundle, then run the openvpn client.conf command and submit a vulnerability.

  3. Now, we will download the connection certificate and then run the following commands:

    unzip monika-connectionpack.zip
    openvpn client.conf
    
  4. Open a second terminal window and ping the Metasploitable server on 10.3.33.132.

  5. Now, let's exploit the machine with the following commands:

    • Open your Firefox browser and browse to https://localhost:3790.

    • Go into the default project and click on the Scan button. Enter 10.3.33.132 and click on Launch Scan.

    • Once the scan has completed, go to the Analysis menu and click on the Hosts option.

  6. Click on Exploit. It will now match up the right exploits with the operating system and services fingerprinted on the Metasploitable machine, and then the smart exploitation process will be launched. When using Metasploitable, it is preferable to use exploit/unix/misc/distcc_exec.

  7. Once the exploitation process has completed, click on the Sessions button in the toolbar. You should see one open session with the ping 10.3.33.132.

  8. We can now proceed with various scripts after the session is complete.

  9. Click on Collect and check the box next to Session 1. Then click on the Collect System Data button on the bottom right. This will now collect passwords, screenshots, and other evidence from the machine. If you go back to the Hosts screen in the Analysis menu, you'll see that the machine is marked as looted.

There's more...

There is a research paper on the internet called Cloud Penetration Testing by Ralph LaBarge and Thomas McGuire that presents the results of a series of penetration tests performed on the OpenStack Essex Cloud Management Software. This paper discusses penetration testing of the OpenStack Essex Cloud Management Software package. The paper is organized into nine sections as follows:

  • INTRODUCTION

  • OPENSTACK CLOUD MANAGEMENT SOFTWARE

  • SELECTION OF PENETRATION TESTING SOFTWARE

  • DESIGN & IMPLEMENTATION OF THE TEST CLOUD

  • DESIGN & IMPLEMENTATION OF THE PENETRATION TEST ENVIRONMENT

  • DESCRIPTION OF THE PENETRATION TESTS PERFORMED

  • TEST RESULTS

  • SUMMARY and CONCLUSIONS

  • REFERENCES

You can read it at http://cryptome.org/2013/07/cloud-pentest.pdf link.

Note

Metasploit Pro is available as an Amazon Machine Image (AMI), so it can easily be run in the Amazon cloud to carry out external penetration tests.

In addition, some other tools are available for cloud-focused pentesting. Core CloudInspect was recently released by Core Security Technologies, a well-known provider of professional pentesting products. Core CloudInspect is a cloud-based pentesting platform that integrates with Amazon's EC2 cloud environment, which greatly simplifies scheduling and testing.

Note

As Amazon has endorsed CloudInspect as a convenient and effective way to schedule and perform pentests against Amazon-hosted cloud resources, many Amazon customers may adopt CloudInspect for penetration tetsing.