Metasploit Unleashed: Build defense against complex attacks

Scanning is one of the core steps to information gathering. Metasploit has a built-in scanner for gathering and harvesting information about target systems.

   •  The first steps are discovering what scanning ability Metasploit has built-in

   •  The second step is leveraging the appropriate scan for what you wish to accomplish

   •  Although not required the third step would be storing the scan information in a database for retrieval

The Nmap scanning framework can be used to enhance the Metasploit.

   •  Accessing the Nmap engine either directly or through Metasploit console

   •  Importing the data for Metasploit to leverage

Metasploit scanning is very limited in comparison to a vulnerability scanner. Using Nessus can greatly enhance the use of Metasploit.

   •  Initiating scans in Nessus and then importing that information in to Metasploit

Using Metasploit to issue and conduct Nessus scans for use in Metasploit.

   •  Making a connection to Nessus scan engine and initiating a scan

Metasploit scanning is very limited in comparison to a vulnerability scanner such as Nexpose. Using Nexpose can greatly enhance the use of Metasploit.

   •  Accessing the Nexpose console. Initiating and executing scans

   •  Generate a report for the information Metasploit needs

   •  Exporting that information in a format Metasploit can import

Provides a description of the Meterpreter, how it works, and what it is used for.

   •  The first step would be finding an exploit Metasploit can use

   •  Set payload to be a Meterpreter session

Once you have a Meterpreter sessions, there are predefined commands that can get run to get information and further exploit the system.

   •  After establishing a Meterpreter session issue command such as getuid or sysinfo

Once you have a Meterpreter sessions, there are predefined scripts that can get run to get information and further exploit the system.

   •  After establishing a Meterpreter session call on scripts such as enum_logged_on_users to get a list of uers

Sometimes it is helpful to call upon the windows API to perform operations.

   •  Once a Meterpreter session is established call IRB

   •  Access windows API and other Metaspoloit scripts

Putting together API commands and functions can make pentests run smoother and more efficiently.

   •  After establishing the IRB call your script to do the work for you

Here the problem of client machines and number of applications and behaviors exposed gives way to being vulnerable.

   •  Review scan and information gathered about application and look for exploits

Browsers represent one client application that can be abused either directly through a vulnerability or a third-party add in.

   •  Stage exploit in a web environment and get the target(s) to access it

Another pentest method is to craft application files containing exploits to take advantage of an application vulnerability.

   •  Get the compromised file to the target and get them to execute

When you do not want to depend on vulnerabilities use a stand-alone application containing the exploit.

   •  Once the stand-alone file is created deliver it to the target and get them to execute

Because these types of exploits rely on delivery, we discuss delivery mechanisms.

   •  Besides email and staging we show a post exploit method of delivering other exploits

Some services are not immediately known. Using basic information such as port we can determine the service and use Metasploit to exploit it.

   •  Find an open port through scans. Attempt to connect and find more information

   •  Research the port numbers commonly associated services

   •  Check Metasploit for a matching module. If so, load it and exploit the system

Webservers vulnerabilities can take many shapes. Here we will look at implementation vulnerability in authentication.

   •  Determine the webserver type and find the administrative URL

   •  Load authentication scanner and launch against the server attempting to brute force login

Databases can be the subject of brute force attacks with through authentication routines as part of a program or authentication to the database administration. Here we look at the database administration vulnerability.

   •  Determine the type of database. Find the URL or authentication routine for the service

   •  Launch Metasploit brute force scanner against the service. When successful login is found, login

VOIP represents another service or device on the network. Here we will look at exploiting the VOIP server through a known vulnerability.

   •  Find a VOIP system and attempt to determine general information including version

   •  Search for exploits related to that service and version

   •  Load the exploit(s) and launch

SCADA devices are found in a smaller set of companies. Mostly manufacturing, however as more and more internet ready devices come online this area will expand.

   •  Find uncommon devices or ports associated with hardware devices

   •  Determine what device and/or protocol it is running

   •  Search/Load modules related to the service or protocol

The aim of this video is to look at Privilege Escalation to grant access.

   •  Understand why we need privilege escalations

   •  Understand the 3 ways to privilege escalate

The aim of this video is to Gather Passwords with MimiKatz and Kiwi.

   •  Understand the stages of Pentesting

   •  Understand what MimiKatz and Kiwi are

   •  Learn how to interact with them

The aim of this video is to understand what happens after you exploited the system.

   •  Perform a demo to see what happens after exploitation of the system

The aim of this video is to understand what happens post exploitation of the system and maintain a foothold on the system.

   •  Understand Persistence and Persistence with Script

   •  Perform a demo to see what persistence on a script looks like on a system

The aim of this video is to understand what and how you are going to cover up for the things we did while exploiting the system.

   •  Perform a demo on how it needs to be done

The aim of this video is to look at Social Engineering Toolkit.

   •  Define the Social Engineering Toolkit

   •  Run the SET

The aim of this video is show how to use Armitage to share access.

   •  Define Armitage

   •  Run Armitage

The aim of this video is to understand how to turn on RDP.

   •  See how they work in a Meterpreter session

The aim of this video is to understand Screen capture, Keylogging and Web Cam.

   •  Get an insight on each: Screen capture, keylogging and web cam

The aim of this video is to understand how to manipulate the Registry.

   •  Access a Meterpreter session

   •  Follow a step by step approach as per the demo

The aim of this video is to look at Evasion with MSFvenom.

   •  Define MSFvenom

   •  Look at how evasion with MSFvenom works

The aim of this video is to look at Evasion with Veil.

   •  Define Veil

   •  Look at how evasion with Veil works

The aim of this video is to look at Evasion with Trojanizer.

   •  Define Trojanizer

   •  Look at how Evasion with Trojanizer works

The aim of this video is to look at Evasion with Metasploit.

   •  Understand what evasion with Metasploit means

   •  Look at how Evasion with Metasploit works

The aim of this video is to understand how to create custom modules.

   •  Understand the need to create custom modules

   •  Know of the templates that are used

   •  Learn how to create custom modules

The aim of this video is to Implement Custom Modules.

   •  Understand the steps involved in implementing custom modules

   •  Look at how to implement it