Book Image

Mastering Metasploit - Fourth Edition

By : Nipun Jaswal
Book Image

Mastering Metasploit - Fourth Edition

By: Nipun Jaswal

Overview of this book

Updated for the latest version of Metasploit, this book will prepare you to face everyday cyberattacks by simulating real-world scenarios. Complete with step-by-step explanations of essential concepts and practical examples, Mastering Metasploit will help you gain insights into programming Metasploit modules and carrying out exploitation, as well as building and porting various kinds of exploits in Metasploit. Giving you the ability to perform tests on different services, including databases, IoT, and mobile, this Metasploit book will help you get to grips with real-world, sophisticated scenarios where performing penetration tests is a challenge. You'll then learn a variety of methods and techniques to evade security controls deployed at a target's endpoint. As you advance, you’ll script automated attacks using CORTANA and Armitage to aid penetration testing by developing virtual bots and discover how you can add custom functionalities in Armitage. Following real-world case studies, this book will take you on a journey through client-side attacks using Metasploit and various scripts built on the Metasploit 5.0 framework. By the end of the book, you’ll have developed the skills you need to work confidently with efficient exploitation techniques
Table of Contents (17 chapters)
1
Section 1 – Preparation and Development
6
Section 2 – The Attack Phase
10
Section 3 – Post-Exploitation and Evasion

Technical requirements

In this chapter, we will make use of the following software and OSes:

  • For virtualization: VMware Workstation 12 Player for virtualization (any version can be used).
  • For penetration testing: The Ubuntu 18.03 LTS Desktop as a pentester's workstation VM, with the IP 192.168.232.145.

    You can download Ubuntu from https://ubuntu.com/download/desktop and Metasploit 5.0.43 from https://www.metasploit.com/download.

    You can install Ruby on Ubuntu by using the apt install ruby command.

  • Demonstration 1 (Shodan.io): A Shodan account and an API key.
  • Demonstration 2 (DATAC RealWin SCADA Server 2.0): Microsoft Windows XP SP2 (1 GB RAM) with the IP 192.168.232.149 and DATAC RealWin SCADA Server 2.0 from https://www.exploit-db.com/apps/e8b5dc518ae0db89e5ae280abcc7a9a3-DemoRW-1.06.exe. (The installation password is rfx.)
  • Demonstration 3 (Modbus manipulation): Microsoft Windows 7 Home Basic 32-bit (IP 192.168.248.138) with 2 GB RAM and ModbusPal (http...