Porting Exploits | Mastering Metasploit

Sign In Start Free Trial

Book Overview & Buying
Table Of Contents

Mastering Metasploit

By : Nipun Jaswal

4.7 (15)

Mastering Metasploit

4.7 (15)

By: Nipun Jaswal

Overview of this book

A comprehensive and detailed, step by step tutorial guide that takes you through important aspects of the Metasploit framework. If you are a penetration tester, security engineer, or someone who is looking to extend their penetration testing skills with Metasploit, then this book is ideal for you. The readers of this book must have a basic knowledge of using Metasploit. They are also expected to have knowledge of exploitation and an indepth understanding of object-oriented programming languages.

Mastering Metasploit

Mastering Metasploit

Credits

Credits

About the Author

About the Author

About the Reviewers

About the Reviewers

www.PacktPub.com

www.PacktPub.com

Preface

Preface

Free Chapter

Approaching a Penetration Test Using Metasploit

Approaching a Penetration Test Using Metasploit

Setting up the environment

Mounting the environment

Conducting a penetration test with Metasploit

The dominance of Metasploit

Summary

Reinventing Metasploit

Reinventing Metasploit

Ruby – the heart of Metasploit

Developing custom modules

Breakthrough meterpreter scripting

Working with RailGun

Summary

The Exploit Formulation Process

The Exploit Formulation Process

The elemental assembly primer

The joy of fuzzing

Building up the exploit base

Finalizing the exploit

The fundamentals of a structured exception handler

Summary

Porting Exploits

Porting Exploits

Porting a Perl-based exploit

Porting a Python-based exploit

Porting a web-based exploit

Summary

Offstage Access to Testing Services

Offstage Access to Testing Services

The fundamentals of SCADA

SCADA torn apart

Securing SCADA

Database exploitation

VOIP exploitation

Post-exploitation on Apple iDevices

Summary

Virtual Test Grounds and Staging

Virtual Test Grounds and Staging

Performing a white box penetration test

Generating manual reports

Performing a black box penetration test

Summary

Sophisticated Client-side Attacks

Sophisticated Client-side Attacks

Exploiting browsers

File format-based exploitation

Compromising XAMPP servers

Compromising the clients of a website

Bypassing AV detections

Conjunction with DNS spoofing

Attacking Linux with malicious packages

Summary

The Social Engineering Toolkit

The Social Engineering Toolkit

Explaining the fundamentals of the social engineering toolkit

Attacking with SET

Providing additional features and further readings

Summary

Speeding Up Penetration Testing

Speeding Up Penetration Testing

Introducing automated tools

Fast Track MS SQL attack vectors

Automated exploitation in Metasploit

Fake updates with the DNS-spoofing attack

Summary

Visualizing with Armitage

Visualizing with Armitage

The fundamentals of Armitage

Scanning networks and host management

Exploitation with Armitage

Post-exploitation with Armitage

Attacking on the client side with Armitage

Scripting Armitage

Summary

Further reading

Index

Index

Porting a Python-based exploit

We just saw that we can import a Perl-based exploit into the Metasploit framework. Let's now get our hands onto a Python-based exploit.

Dismantling the existing exploit

We are going to port an exploit for Xitami Web Server 2.5b4 in this section. A publically available Python-driven exploit for this application is available at http://www.exploit-db.com. This exploit is authored by Glafkos Charalambous. We can download the exploit and its corresponding vulnerable application from http://www.exploit-db.com/exploits/17361/. Now, when we run this exploit, it gives us back the successful completion of it and asks us to establish a connection to port 1337 to gain a command prompt at the target. Let's see the process:

Now, let's make a telnet connection to port 1337 and check if we are able to gain the command prompt at the target:

As we can see in the following screenshot, after sending the telnet command to the victim, we can easily gain the command prompt at the target...

CONTINUE READING

83

Tech Concepts

36

Programming languages

73

Tech Tools

Unlimited access to the largest independent learning library in tech of over 8,000 expert-authored tech books and videos.

Innovative learning tools, including AI book assistants, code context explainers, and text-to-speech.

50+ new titles added per month and exclusive early access to books as they are being written.

Mastering Metasploit

Search

Your notes and bookmarks