Instructor: In this lesson, 2 2
we're going to talk about Metasploit 3 3
which is a multi-purpose computer security 4 4
and penetration testing framework. 5 5
It contains a lot of great things inside of Metasploit. 6 6
Now it comes installed by default 7 7
inside of Cali and Parrot Linux 8 8
and most other penetration testing distributions 9 9
because it is probably the number one tool 10 10
that most penetration testers are going to use, to launch it, 11 11
simply type in MSF console 12 12
for Metasploit framework console and hit enter. 13 13
When you do that, 14 14
the Metasploit framework is going to load up. 15 15
Now it takes a couple of seconds for it to load 16 16
and every time you load it, 17 17
you're going to get a different splash screen. 18 18
In this case, we have this big C looking thing 19 19
with a lot of words in it. 20 20
Every time you launch it, you're going to get a different one 21 21
and usually there's some kind 22 22
of a joke or pun inside of those. 23 23
More importantly though, you can see down at the bottom 24 24
that I have Metasploit framework version 6.1.27 25 25
and it tells me how many exploits, auxiliaries, posts, 26 26
payload, encoders, NOPs, and evasions there are. 27 27
Now, what are all of those things? 28 28
Well, let's talk about them. 29 29
First, we have exploits. 30 30
You can see here, there are almost 2200 different exploits. 31 31
An exploit is simply some piece of code or software 32 32
that can deliver a payload and do some sort of an attack 33 33
on a given target. 34 34
All these different exploits go after different 35 35
vulnerabilities on different windows, Linux, mobile 36 36
and other systems that you may encounter in the field. 37 37
The second category we have there is known as auxiliary, 38 38
now auxiliary, there is over 1100 39 39
of these inside the Metasploit framework. 40 40
This includes scanners, sniffers, fuzzer, spoofers 41 41
and other non exploit features of this tool set. 42 42
For example, instead of using Nmap to do your port scanning, 43 43
you can actually use auxiliaries that are set up inside 44 44
of the Metasploit framework to do that same type of work. 45 45
The next one we have is what's known as post 46 46
and you can see there are 400 as of this version. 47 47
Now, a post is basically any additional task 48 48
that you may need to perform on a compromised host 49 49
And post stands for post exploitation, which means 50 50
once you've broke into the box, what are those things 51 51
you need to do to maintain persistence, cover your tracks 52 52
and other things like that. 53 53
Next you'll see we have payloads and we have almost 54 54
600 payloads in this version. 55 55
Essentially, payloads are what exploits are going to deliver 56 56
and then run. 57 57
When you run those payloads, it gives you control 58 58
over machine or it gives you elevated permissions 59 59
or something like that. 60 60
Next we have encoders and there's 45 encoders 61 61
in this version. 62 62
Now, encoders are used to ensure the payloads make it 63 63
to their destination in one piece and undetected, 64 64
you may encode things or encrypt things 65 65
to bypass different intrusion detection systems, firewalls, 66 66
router ACLs and things like that, we also have NOPs. 67 67
There are 10 different NOPS here. 68 68
Now, a NOP is a non-op operation. 69 69
NOPs are used to keep the payload sizes consistent 70 70
across all the different exploit attempts 71 71
that you're going to going to do. 72 72
This is also useful as part of your evasion. 73 73
And finally, we have evasion. 74 74
This is a category that has nine different types 75 75
of evasion techniques that again, you can use as ways to 76 76
try to get by or get through some sort of defenses 77 77
that somebody has set up against you. 78 78
Now you'll notice once you go into the Metasploit framework, 79 79
you come up to the Metasploit prompt and here you can see it 80 80
as MSF6 telling me I am in version six 81 81
of the Metasploit framework. 82 82
Now, when you go and use the Metasploit framework, 83 83
you need to tell it what tools you want to use. 84 84
So everything is built up in a specific pattern. 85 85
They list it out by the module type saying 86 86
if it's an exploit, auxiliary, post, payloads, encoders, 87 87
NOPs or evasion, then the platform that you're targeting, 88 88
Windows, Linux, Apple, et cetera, then the target service 89 89
SMB, FTP, whatever that happens to be, and then 90 90
the module name. 91 91
So to use one of these things, 92 92
you simply have to list out its name. 93 93
Now, that's easier said than done because there are so many 94 94
of these, right? 95 95
But I have one memorized that I use all the time 96 96
and so I would just type in use 97 97
exploit/windows/SMB/MS17_010_psexec. 98 98
Now what does this say? 99 99
This says, I want to use this exploit that targets 100 100
Window systems over SMB using the vulnerability associated 101 101
with Microsoft patch 010 in the year 2017. 102 102
And if you're not familiar with this, this was known 103 103
as Eternal blue, which was a large vulnerability back 104 104
in 2017 and made up the core of the ransom order known 105 105
as WannaCry, when you hit enter, it's going to then load 106 106
that module for you to use, notice my prompt has changed. 107 107
It now says MSF6 exploit and then 108 108
in parenthesis what exploit I'm going to be using. 109 109
Now from here we would have to look 110 110
at the different options that are available 111 111
for this particular exploit, to do that, 112 112
simply type in options. 113 113
When you type in options, you'll see all the things 114 114
in this table that you have to have a setting 115 115
for in order to use this attack. 116 116
For instance, do you want to have the setting true 117 117
or false for debug trace? 118 118
And this shows extra debug information. 119 119
You'll notice this is a required field. 120 120
As you go through 121 121
there's going to be different things you're going to use 122 122
based on this particular exploit 123 123
and every exploit and every auxiliary in post 124 124
and NOP is going to be set up differently. 125 125
But by using options, 126 126
you could always see what options need to be made. 127 127
In this case, 128 128
one of the things that's required that has not 129 129
been set yet is the R host 130 130
which is the target host you want to go after. 131 131
-: For example, if during my information gathering 132 132
and vulnerability scanning, 133 133
I identify that there is a workstation 134 134
with a certain IP address that might be vulnerable 135 135
to this attack because it was missing this patch, 136 136
I could then use that as my Rhost. 137 137
And to do that, I'll just type in set, 138 138
the option I want to, set in this case Rhost 139 139
and then the IP address of that machine. 140 140
Let's say it was 192.168.1.2 and hit enter. 141 141
Now you'll see that it is set 142 142
to that Rhost, to that IP address 143 143
and if I type in my options again, you will see now 144 144
that everything that is required has been filled in. 145 145
And this is the way you use these different tools 146 146
inside the Metasploit framework. 147 147
When you see things like Rhost, that is the remote host 148 148
or the IP you want to target, Rport, the remote port 149 149
you want to target, things like Lhosts 150 150
and Lport are the local host 151 151
and local port notice you'll see the payload options down 152 152
at the bottom. 153 153
The payload options here is what are we going to do 154 154
once we run that exploit? 155 155
Just exploiting something doesn't do you any good, 156 156
you have to run some kind of code afterwards. 157 157
And in this case, we are setting up a reverse TCP shell 158 158
using the interpreter shell inside of Metasploit. 159 159
This will allow us to have a connection to that machine 160 160
and then do things on that machine that we want to do 161 161
as part of our post exploitation 162 162
like doing more information gathering, collecting files 163 163
and doing data exfiltration, changing settings, 164 164
pivoting to other machines and all of those type of things. 165 165
Now there is a lot to Metasploit 166 166
and we're not going to cover all of it 167 167
in this video because that can be an entire course 168 168
of 20 to 40 hours on its own. 169 169
But what you need to understand is 170 170
that Metasploit is a very powerful framework 171 171
and you should be able to understand the very basics 172 172
of setting up things 173 173
like options and then running those exploits. 174 174
If this option was already set up perfectly 175 175
and I'm ready to run the exploit, to do that, 176 176
I would simply type in the command run and hit enter. 177 177
Now, in this particular case, 178 178
I'm not on a network where there is a vulnerable host 179 179
at 192.168.1.2, so if I try to run it, 180 180
it's going to end up failing 181 181
because it's not going to be able to talk 182 182
to that particular device 183 183
because it was unreachable as you saw here. 184 184
Now let me go ahead 185 185
and show you how we use this in the real world. 186 186
To do this, I've gone ahead and set up a vulnerable machine 187 187
called Metasploitable two 188 188
and you can download this from Rapid seven who created this. 189 189
This is a Linux distribution. 190 190
It is intentionally vulnerable and has lots 191 191
and lots of different problems with it 192 192
and that is good for us to be able to practice on. 193 193
So what I want to do is I want to get 194 194
out of this particular exploit. 195 195
So I'm going to type in exit and you'll see 196 196
that that took me out of the entire Metasploit framework. 197 197
So now that I have a nice clear screen, 198 198
what we're going to do is we are going to search 199 199
on this network using Nmap to try to identify 200 200
what is that particular vulnerable machine's IP address. 201 201
And I know this, it's on the same local area network 202 202
as I'm in, so I'm just going to type in IF config 203 203
to find out my IP address, 204 204
which is 172.16.218.128. 205 205
And so I'm going to use Nmap 206 206
and I'm going to scan172.16.218.1/24. 207 207
because I'm not sure what the IP address is 208 208
of that vulnerable machine. 209 209
When I do this, Nmap is going to go 210 210
out and scan the entire network 211 211
of up to 254 hosts on this subnet. 212 212
Now as it comes back, 213 213
you'll see that we found a couple of things. 214 214
Let me scroll up a little bit so we can see what we have. 215 215
And you'll see that Nmap went and found two 216 216
different hosts that were reporting back ports. 217 217
The first one was located at 172.16.218.1 218 218
and that is my router or gateway. 219 219
And you'll see that there is an Apple file server 220 220
and there is UPNP that is open on those particular ports. 221 221
Now the more important one is the one that we see here 222 222
at the bottom, 172.16.218.130, 223 223
this is my vulnerable machine. 224 224
And you'll notice, there are a lot 225 225
of different things on this machine. 226 226
Notice that there are 23 open ports 227 227
and these are things like FTP, SSH, Telenet, 228 228
SMTP, domain, HTTP, RCP bind and many others. 229 229
Now, if we wanted to find out more information 230 230
about these particular ports, 231 231
we can do that by fingerprinting those ports or using Nmap 232 232
with a service scan to figure out what they're running. 233 233
And that's exactly what I'm going to do. 234 234
So I'm going to use Nmap, 235 235
I'm going to target just the IP that I want to go after 236 236
which is 172.16.218.130. 237 237
and I want to do that with a service scan of dash SV. 238 238
If I go ahead and hit enter, 239 239
it's going to go run off and do that scan for me. 240 240
All right, now that the results are back, 241 241
we can look at those particular services 242 242
and see if there's anything that's vulnerable. 243 243
Now this is where you'd normally do your information 244 244
gathering and vulnerability assessment part 245 245
of your engagement. 246 246
Now, I've already done this, 247 247
and I know that port 6667, that is open for IRC, 248 248
using the Unreal IRC damon is a vulnerable version. 249 249
And so that's what I'm going to target 250 250
and show you how to use Metasploit to go after 251 251
and exploit the vulnerability in that unreal IRC damon. 252 252
To do this, we again need to go back 253 253
into the Metasploit console. 254 254
So we're going to go MSF console. 255 255
And when we get up into that screen again, 256 256
we are going to use the vulnerability 257 257
for the Unreal IRC damon. 258 258
Now the first thing I want to do is search 259 259
for that vulnerability to see 260 260
if there is any exploits associated with it. 261 261
So if I type in search IRC, I can hit enter 262 262
and all of the things that have IRC in it 263 263
are going to show up. 264 264
If you look down at line 18, there is one 265 265
for exploit/unix/IRC/unrealIRCD3281backdoor. 266 266
Now what this means is 267 267
that this is an exploit that targets Unix systems 268 268
which is what Metasploitable is. 269 269
It targets the IRC port, which is what was open at 6667 270 270
and it targets the Unreal IRC damon, version 3281 271 271
and there's a backdoor in that particular version. 272 272
And so that's what we want to use. 273 273
Now to use it, I can type out the entire thing 274 274
of use exploit/unix/IRC/unrealIRCD3281backdoor, 275 275
or I can use it based on its number, and in this case, 276 276
it's number 18, so I'll go ahead and hit 18 277 277
and you'll notice it is now the one listed as my exploit. 278 278
So we're going to go ahead and look at our options. 279 279
And for our options, we only need to set two things 280 280
the Rhosts and the Rport. 281 281
Now we already know what the Rhost is. 282 282
In this case we're going to set our Rhost 283 283
to 172.16.218.130 and hit enter. 284 284
Now the port is port 6667 285 285
which is the port that was running on our server. 286 286
If it was running on a different port, we would just type 287 287
in set port and the port we want to set it to. 288 288
Now I'm going to go ahead 289 289
add options again to make sure it took and yes it did. 290 290
I can see my Rhost is now there. 291 291
Now that we have our Rhost and our port set up, 292 292
we are ready to run this exploit. 293 293
But if we do that now, nothing's really going to happen 294 294
because we've set an exploit but we haven't set a payload. 295 295
And a payload is necessary to say 296 296
what do you want to do once you exploit this server? 297 297
So I'm going to show you what that looks 298 298
like just so you can see the error. 299 299
And if you hit run, it's going to go off 300 300
it's going to try the exploit, but it fails. 301 301
Why did it fail? 302 302
Because a payload was not selected. 303 303
So as you can see, there was no payload. 304 304
So we have to be able to set a payload, to do this, 305 305
we're going to type in show payloads and hit enter 306 306
and this will show us all the compatible payloads 307 307
that are known to work with this particular exploit. 308 308
And here you can see there are 11 different payloads. 309 309
To keep things simple, I'm going to use the first one 310 310
which is payload/command/unix/bindpearl, 311 311
which is going to set up a bind shell 312 312
on that remote server so that I can connect 313 313
into it at any time I want and take over the system. 314 314
To do this, we're going to use set payload and then the name 315 315
which is command/unix/bind pearl. 316 316
Notice this is a little bit different 317 317
than when you're using an exploit. 318 318
When you use an exploit, you're going to say use space 319 319
and then everything after that is all one big word 320 320
with the slashes between it 321 321
but with payloads it's set payload, and then the command, 322 322
the system and the payload you want to use. 323 323
Go ahead and hit enter there and then hit show options. 324 324
When you do this, 325 325
you're going to be able to see the configuration 326 326
for both the exploit and the payload, for the exploit, 327 327
we're going to go and connect to that IRC server 328 328
at 172.16.218.130 over port 6667. 329 329
We're going to then send a payload 330 330
that is a bind shell that's going to bind on that IRC server 331 331
and open up a connection port at 4444. 332 332
This will allow me to connect 333 333
to that remote host anytime I want over port 4444 334 334
and be able to access this vine shell using pearl. 335 335
Now to run this, I'm simply going to type in run and hit enter. 336 336
You can now see that we are connecting 337 337
from our Colli machine to that server over port 6667. 338 338
We set the back door command 339 339
and we were able to start that buying TCP handler 340 340
on that remote server of 172.16.218.130 over port 4444. 341 341
And now I have a valid connection that is 342 342
called command shell session one that is open 343 343
between my Colli machine 172.16.218.128 344 344
from port 46773 over to the remote shell that I created 345 345
with that bind shell on port 4444 of that IRC server. 346 346
Now you'll see that nothing really happened. 347 347
We're just sitting there 348 348
and we are at basically a blank screen. 349 349
Why is that? 350 350
Well, because we're actually at a command prompt 351 351
you just don't know it. 352 352
And so if you want to see where you are, 353 353
you can use your Linux commands like PWD 354 354
to figure out what is the working directory you're in 355 355
and I am right now in the slash etc unreal directory. 356 356
If I wanted to see the files in there, I can type in LS 357 357
and I get back the answers of donation, license, aliases 358 358
and all the other things that are in that directory. 359 359
If I want to figure out what type of permissions I have, 360 360
I can do, who am I? 361 361
And when I do, who am I? I am root. 362 362
I was able to get into this box using brute access 363 363
by running this particular exploit. 364 364
And that's the way these things work 365 365
at a very basic level to set up an exploit, 366 366
set up a payload, and then run an attack. 367 367
Now, the last thing I want to show you is this concept 368 368
of sessions, 369 369
notice here it said the command shell session one 370 370
was opened, that means there might be other sessions too. 371 371
What this is is 372 372
that Metasploit allows you to run multiple sessions 373 373
so you can do multiple different attacks 374 374
or if you need to chain exploits across multiple systems 375 375
you can do that, now, right now I'm in session one 376 376
and I'm at the command prompt on this IRC server. 377 377
If I want to get out of that, 378 378
I can press Control Z and this will send that session 379 379
to the background when I hit yes, 380 380
that allows me now to get back 381 381
to my Metasploit framework prompt. 382 382
Now I can go and set up a new exploit 383 383
and a new payload and a new target and run that 384 384
and that will become session two. 385 385
If I want to see all the sessions that I have going on, 386 386
I can do that by simply typing 387 387
in sessions and then dash L to list them. 388 388
You'll notice right now I only have one session 389 389
because that's all I've done 390 390
but I could be working here all day 391 391
and have 5, 10, 15 sessions running at once. 392 392
Now, if I wanted to use a different session, 393 393
I would just type in sessions 394 394
and the number that I want to use, for instance, session two 395 395
or three or four, in my case, I only have one session 396 396
so I'm just going to select session one 397 397
and that brings me right back into session one. 398 398
And again, I'm right back on that terminal. 399 399
And if I do, who am I? I'm root. 400 400
If I do LS, I'm in that directory. 401 401
If I wanted to create a file or a directory 402 402
I can do make directory test. 403 403
And now if I do LS, you'll see there is this test directory 404 404
that was just added by me, 405 405
if I want to remove that directory, 406 406
I can do remove directory tests. 407 407
And now if I do LS, that test is no longer there. 408 408
These are all the different things you can do 409 409
just from a very high level when you start using 410 410
Metasploit, Metasploit is a truly powerful tool 411 411
and it's one that you really got to become comfortable with. 412 412
Now, for the exam, you just need to know the basics. 413 413
But for the real world, I definitely recommend 414 414
you take an in-depth course on Metasploit 415 415
or you spend some time with Metasploit, 416 416
it's documentation and some vulnerable machines 417 417
from VulnHub or Metasploitable 2 418 418
and be able to start using this to conduct your attacks 419 419
and practicing securing those vulnerable machines 420 420
to simulate an analyst job in the real world.