Metasploit Revealed: Secrets of the Expert Pentester

Book Image

Metasploit Revealed: Secrets of the Expert Pentester

By : Sagar Rahalkar, Nipun Jaswal

Book Image

Metasploit Revealed: Secrets of the Expert Pentester

By: Sagar Rahalkar, Nipun Jaswal

Overview of this book

Metasploit is a popular penetration testing framework that has one of the largest exploit databases around. This book will show you exactly how to prepare yourself against the attacks you will face every day by simulating real-world possibilities. This learning path will begin by introducing you to Metasploit and its functionalities. You will learn how to set up and configure Metasploit on various platforms to create a virtual test environment. You will also get your hands on various tools and components and get hands-on experience with carrying out client-side attacks. In the next part of this learning path, you’ll develop the ability to perform testing on various services such as SCADA, databases, IoT, mobile, tablets, and many more services. After this training, we jump into real-world sophisticated scenarios where performing penetration tests are a challenge. With real-life case studies, we take you on a journey through client-side attacks using Metasploit and various scripts built on the Metasploit framework. The final instalment of your learning journey will be covered through a bootcamp approach. You will be able to bring together the learning together and speed up and integrate Metasploit with leading industry tools for penetration testing. You’ll finish by working on challenges based on user’s preparation and work towards solving the challenge. The course provides you with highly practical content explaining Metasploit from the following Packt books: 1. Metasploit for Beginners 2. Mastering Metasploit, Second Edition 3. Metasploit Bootcamp

Title Page

Credits

Preface

Free Chapter

Module 1

Metasploit for Beginners

Introduction to Metasploit and Supporting Tools

Introduction to Metasploit and Supporting Tools

The importance of penetration testing

Vulnerability assessment versus penetration testing

The need for a penetration testing framework

Introduction to Metasploit

When to use Metasploit?

Making Metasploit effective and powerful using supplementary tools

Setting up Your Environment

Setting up Your Environment

Using the Kali Linux virtual machine - the easiest way

Installing Metasploit on Windows

Installing Metasploit on Linux

Setting up exploitable targets in a virtual environment

Metasploit Components and Environment Configuration

Metasploit Components and Environment Configuration

Anatomy and structure of Metasploit

Metasploit components

Playing around with msfconsole

Variables in Metasploit

Updating the Metasploit Framework

Information Gathering with Metasploit

Information Gathering with Metasploit

Information gathering and enumeration

Password sniffing

Advanced search with shodan

Vulnerability Hunting with Metasploit

Vulnerability Hunting with Metasploit

Managing the database

Vulnerability detection with Metasploit auxiliaries

Auto exploitation with db_autopwn

Post exploitation

Client-side Attacks with Metasploit

Client-side Attacks with Metasploit

Need of client-side attacks

The msfvenom utility

Social Engineering with Metasploit

Browser Autopwn

Web Application Scanning with Metasploit

Web Application Scanning with Metasploit

Setting up a vulnerable application

Web application scanning using WMAP

Metasploit Auxiliaries for Web Application enumeration and scanning

Antivirus Evasion and Anti-Forensics

Antivirus Evasion and Anti-Forensics

Using encoders to avoid AV detection

Cyber Attack Management with Armitage

Cyber Attack Management with Armitage

What is Armitage?

Starting the Armitage console

Scanning and enumeration

Find and launch attacks

Extending Metasploit and Exploit Development

Extending Metasploit and Exploit Development

Exploit development concepts

Exploit templates and mixins

Adding external exploits to Metasploit

Module 2

Mastering Metasploit

Approaching a Penetration Test Using Metasploit

Approaching a Penetration Test Using Metasploit

Organizing a penetration test

Preinteractions

Intelligence gathering/reconnaissance phase

Predicting the test grounds

Setting up Kali Linux in virtual environment

The fundamentals of Metasploit

Conducting a penetration test with Metasploit

Benefits of penetration testing using Metasploit

Penetration testing an unknown network

Using databases in Metasploit

Modeling threats

Vulnerability analysis of VSFTPD 2.3.4 backdoor

Vulnerability analysis of PHP-CGI query string parameter vulnerability

Vulnerability analysis of HFS 2.3

Maintaining access

Clearing tracks

Revising the approach

Reinventing Metasploit

Reinventing Metasploit

Ruby – the heart of Metasploit

Developing custom modules

Breakthrough meterpreter scripting

Working with RailGun

The Exploit Formulation Process

The Exploit Formulation Process

The absolute basics of exploitation

Exploiting stack-based buffer overflows with Metasploit

Exploiting SEH-based buffer overflows with Metasploit

Bypassing DEP in Metasploit modules

Other protection mechanisms

Porting Exploits

Porting Exploits

Importing a stack-based buffer overflow exploit

Importing web-based RCE into Metasploit

Importing TCP server/ browser-based exploits into Metasploit

Testing Services with Metasploit

Testing Services with Metasploit

The fundamentals of SCADA

Database exploitation

Testing VOIP services

Virtual Test Grounds and Staging

Virtual Test Grounds and Staging

Performing a penetration test with integrated Metasploit services

Client-side Exploitation

Client-side Exploitation

Exploiting browsers for fun and profit

Metasploit and Arduino - the deadly combination

File format-based exploitation

Compromising Linux clients with Metasploit

Attacking Android with Metasploit

Metasploit Extended

Metasploit Extended

The basics of post exploitation with Metasploit

Basic post exploitation commands

Additional post exploitation modules

Advanced extended features of Metasploit

Speeding up Penetration Testing

Speeding up Penetration Testing

The loadpath command

Pacing up development using reload, edit and reload_all commands

Automating Social-Engineering Toolkit

Visualizing with Armitage

Visualizing with Armitage

The fundamentals of Armitage

Scanning networks and host management

Exploitation with Armitage

Post-exploitation with Armitage

Attacking on the client side with Armitage

Scripting Armitage

Further reading

Module 3

Metasploit Bootcamp

Getting Started with Metasploit

Getting Started with Metasploit

The fundamentals of Metasploit

Benefits of using Metasploit

Penetration testing with Metasploit

Phase-I: footprinting and scanning

Phase-II: gaining access to the target

Phase-III: maintaining access / post-exploitation / covering tracks

Summary and exercises

Identifying and Scanning Targets

Identifying and Scanning Targets

Working with FTP servers using Metasploit

Scanning MSSQL servers with Metasploit

Scanning SNMP services with Metasploit

Scanning NetBIOS services with Metasploit

Scanning HTTP services with Metasploit

Scanning HTTPS/SSL with Metasploit

Summary and exercises

Exploitation and Gaining Access

Exploitation and Gaining Access

Setting up the practice environment

Exploiting applications with Metasploit

Converting exploits to Metasploit

Summary and exercises

Post-Exploitation with Metasploit

Post-Exploitation with Metasploit

Extended post-exploitation with Metasploit

Metasploit and privilege escalation

Gaining persistent access with Metasploit

Testing Services with Metasploit

Testing Services with Metasploit

Testing MySQL with Metasploit

Summary and exercises

Fast-Paced Exploitation with Metasploit

Fast-Paced Exploitation with Metasploit

Using pushm and popm commands

Making use of resource scripts

Using AutoRunScript in Metasploit

Global variables in Metasploit

Wrapping up and generating manual reports

Summary and preparation for real-world scenarios

Exploiting Real-World Challenges with Metasploit

Exploiting Real-World Challenges with Metasploit

Scenario 1: Mirror environment

Scenario 2: You can't see my meterpreter

Further roadmap and summary

Bibliography

Thanks page

About Packt Publishing

Writing for Packt

Customer Reviews

5 star

0

4 star

0

3 star

0

2 star

0

1 star

0

Exploiting SEH-based buffer overflows with Metasploit

Exception handlers are code modules that catch exceptions and errors generated during the execution of the program. This allows the program to continue execution instead of crashing. Windows operating systems have default exception handlers and we see them generally when an application crashes and throws a pop up that says "XYZ program has encountered an error and needs to close". When the program generates an exception, the equivalent address of the catch code is loaded and called from the stack. However, if we somehow manage to overwrite the address in the stack for the catch code of the handler, we will be able to control the application. Let's see how things are arranged in a stack when an application is implemented with exception handlers:

In the preceding diagram, we can see that we have the address of the catch block in the stack. We can also see, on the right side, that when we feed enough input to the program, it overwrites the...