METASPLOIT Framework Introduction

Metasploit Framework (MSF) is a Ruby-based, modular penetration testing platform that enables you to write, test, and execute exploit code. The Metasploit Framework contains a suite of tools that you can use to test security vulnerabilities, enumerate networks, execute attacks, and evade detection. At its core, the Metasploit Framework is a collection of commonly used tools that provide a complete environment for penetration testing and exploit development.

VMware player / Virtualbox (free)Kali Linux

Kali Linux is an advanced Penetration Testing and Security Auditing Linux distribution that will be used throughout this course. Kali Linux comes with Metasploit pre-installed along with numerous other security tools that you can try out against your victim machine.

3. Metasploitable 2

Metasploitable is an intentionally vulnerable Linux virtual machine that can be used to conduct security training, test security tools, and practice common penetration testing techniques.

Note: Never expose Metasploitable to an untrusted network, use NAT or Host-only mode!

Once you have downloaded the Metasploitable VM, extract the zip file, open up the .vmx file using your VMware product of choice, and power it on. After a brief time, the system will be booted and ready for action. The default login and password is msfadmin : msfadmin.

4.Windows

Microsoft has made a number of virtual machines available that can be downloaded to test Microsoft Edge and different versions of Internet Explorer. We will be able to use these VMs when working with some of the exploits and tools available in Metasploit.

The MSF filesystem is laid out in an intuitive manner and is organized by directory. In Kali Linux, Metasploit is provided in the Metasploit-framework package and is installed in the /usr/share/metasploit-framework directory, the top-level of which is shown below.

Some of the more important directories are briefly outlined below.

DATA

The data directory contains editable files used by Metasploit to store binaries required for certain exploits, wordlists, images, and more.

root@kali:~# ls /usr/share/metasploit-framework/data/
cpuinfo ipwn meterpreter snmp webcam
eicar.com isight.bundle mime.yml sounds wmap
eicar.txt john.conf msfcrawler SqlClrPayload wordlists
emailer_config.yaml lab passivex templates
exploits logos php vncdll.x64.dll
flash_detector markdown_doc post vncdll.x86.dll

DOCUMENTATION

As its name suggests, the documentation directory contains the available documentation for the framework.

root@kali:~# ls /usr/share/metasploit-framework/documentation/
changelog.Debian.gz CONTRIBUTING.md.gz developers_guide.pdf.gz README.md
CODE_OF_CONDUCT.md copyright modules

LIB

The lib directory contains the ‘meat’ of the framework codebase.

root@kali:~# ls /usr/share/metasploit-framework/lib/
anemone msfenv.rb rbmysql.rb sqlmap
anemone.rb net rex tasks
enumerable.rb postgres rex.rb telephony
metasm postgres_msf.rb robots.rb telephony.rb
metasploit rabal snmp windows_console_color_support.rb
msf rbmysql snmp.rb

MODULES

The modules directory is where you will find the actual MSF modules for exploits, auxiliary and post modules, payloads, encoders, and nop generators.

root@kali:~# ls /usr/share/metasploit-framework/modules/
auxiliary encoders exploits nops payloads post

PLUGINS

As you will see later in this course, Metasploit includes many plugins, which you will find in this directory.

root@kali:~# ls /usr/share/metasploit-framework/plugins/
aggregator.rb ips_filter.rb openvas.rb sounds.rb
alias.rb komand.rb pcap_log.rb sqlmap.rb
auto_add_route.rb lab.rb request.rb thread.rb
beholder.rb libnotify.rb rssfeed.rb token_adduser.rb
db_credcollect.rb msfd.rb sample.rb token_hunter.rb
db_tracker.rb msgrpc.rb session_notifier.rb wiki.rb
event_tester.rb nessus.rb session_tagger.rb wmap.rb
ffautoregen.rb nexpose.rb socket_logger.rb

SCRIPTS

The scripts directory contains Meterpreter and other scripts.

root@kali:~# ls /usr/share/metasploit-framework/scripts/
meterpreter ps resource shell

TOOLS

The tools directory has various useful command-line utilities.

root@kali:~# ls /usr/share/metasploit-framework/tools/
context dev exploit hardware memdump modules password recon

There are a number of MSF libraries that allow us to run our exploits without having to write additional code for rudimentary tasks, such as HTTP requests or encoding of payloads. Some of the most important libraries are outlined below.

REX

The basic library for most tasksHandles sockets, protocols, text transformations, and othersSSL, SMB, HTTP, XOR, Base64, Unicode

MSF::CORE

Provides the ‘basic’ APIDefines the Metasploit Framework

MSF::BASE

Provides the ‘friendly’ APIProvides simplified APIs for use in the Framework

The first is the primary module store under /usr/share/metasploit-framework/modules/ and the second, which is where you will store custom modules, is under your home directory at ~/.msf4/modules/.

root@kali:~# ls /usr/share/metasploit-framework/modules/
auxiliary encoders exploits nops payloads post

All Metasploit modules are organized into separate directories, according to their purpose.

overview of the various types of Metasploit modules is shown below.

In the Metasploit Framework, exploit modules are defined as modules that use payloads.

root@kali:~# ls /usr/share/metasploit-framework/modules/exploits/
aix bsdi firefox irix multi solaris
android dialup freebsd linux netware unix
apple_ios example.rb hpux mainframe osx windows

Auxiliary modules include port scanners, fuzzers, sniffers, and more.

root@kali:~# ls /usr/share/metasploit-framework/modules/auxiliary/
admin client dos gather scanner spoof vsploit
analyze crawler example.rb parser server sqli
bnat docx fuzzers pdf sniffer voip

Payloads consist of code that runs remotely, while encoders ensure that payloads make it to their destination intact. Nops keep the payload sizes consistent across exploit attempts.

root@kali:~# ls /usr/share/metasploit-framework/modules/payloads/
singles stagers stages
root@kali:~# ls /usr/share/metasploit-framework/modules/encoders/
cmd generic mipsbe mipsle php ppc ruby sparc x64 x86
root@kali:~# ls /usr/share/metasploit-framework/modules/nops/
aarch64 armle mipsbe php ppc sparc tty x64 x86

Metasploit gives you the option to load modules either at runtime or after msfconsole has already been started. Pass the -m option when running msfconsole to load additional modules at runtime:

root@kali:~# msfconsole -m ~/secret-modules/

If you need to load additional modules from with msfconsole, use the loadpath command:

msf > loadpath
Usage: loadpath </path/to/modules>Loads modules from the given directory which should contain subdirectories for
module types, e.g. /path/to/modules/exploitsmsf > loadpath /usr/share/metasploit-framework/modules/
Loaded 399 modules:
399 payloads