Metasploit Year in Review

Size: px

Start display at page:

Download "Metasploit Year in Review"

Asher Rodger Hoover
5 years ago
Views:

1 Metasploit Year in Review James Lee Metasploit Developer and Community Manager Rapid

$ whoami James Lee @egyp7 Metasploit Developer Community

2 $ whoami James Metasploit Developer Community Manager NTX ISSA Cyber Security Conference October 2-3,

3 What is Metasploit Framework for building & using: Exploits Post-exploitation tasks Reconnaissance tools Scaffolding for solving networking problems Client for many protocols NTX ISSA Cyber Security Conference October 2-3,

4 A few numbers

5 Rapid7 has 71 Public Repositories 5

6 Repos You Probably Care About metasploit-framework metasploit-payloads metasploit-omnibus NTX ISSA Cyber Security Conference October 2-3,

7 Repos You Might Find Interesting github-connector ssh-badkeys NTX ISSA Cyber Security Conference October 2-3,

9 Over 1200 Pull Requests landed 9

10 Over 7500 commits git log --since ' ' --oneline wc -l 10

11 Almost 200 unique authors git log --since ' ' --format='%ae' sort -u 11

12 12

13 358 new modules 13

14 Modules

15 20 Local Priv Escalation 15

16 Local exploit suggester 16

17 exploit/unix/webapp/wp_admin_shell_upload 17

18 Anti-Virus Products

19 auxiliary/gather/mcafee_epo_xxe 19

20 exploit/linux/http/symantec_web_gateway_restore 20

21 exploit/windows/browser/malwarebytes_update_exec 21

22 js-beautifier exploit/multi/fileformat/js_unpacker_eval_injection 22

23 Browser Exploitation

24 21 browser exploits 24

25 25

26 26

27 27

28 28

29 SOHO Routers

30 30

31 Credentials

32 Old and Busted Cred Service Cred Cred 32

33 Private Password SSH Key SNMP Community NTLM Hash Non-replayable Hash Core Public Username Blank Username Realm SMB Domain Postgres DB 33

34 Login Service Login Core Login Service 34

35 Java Serialization

36 Java Serialization with RMI, JMX auxiliary/gather/java_rmi_registry exploits/multi/misc/java_jmx_server exploits/multi/misc/java_rmi_server NTX ISSA Cyber Security Conference October 2-3,

37 SMB

38 Kerberos Partial implementation Enough to exploit MS NTX ISSA Cyber Security Conference October 2-3,

39 SMB Server Partial implementation Serve a single file Enough to exploit most DLL hijacks NTX ISSA Cyber Security Conference October 2-3,

40 Payload Improvements

41 Powershell Session Type Interactive Powershell Can upgrade to meterpreter Mostly compatible with existing Post API NTX ISSA Cyber Security Conference October 2-3,

42 Unicode support Meterpreter handles unicode in filesystems Still have to have support in your terminal NTX ISSA Cyber Security Conference October 2-3,

43 UUID Tracking Embed Universally Unique ID in payloads Makes a payload identifiable Track which EXE got this session Generate unique machine ID for each session Makes a machine identifiable Track whether we ve popped this box before NTX ISSA Cyber Security Conference October 2-3,

44 Paranoid Mode Set a real TLS cert for payload handlers Verify it from Meterpreter side Bail if we re being MitM d Whitelist UUIDs in the handler Don t start sessions for things that aren t a payload NTX ISSA Cyber Security Conference October 2-3,

45 Meterpreter Transport Reliability NTX ISSA Cyber Security Conference October 2-3,

46 Runtime Transport Control reverse_tcp vs reverse_http vs reverse_https Bind tcp://:8000/ IPv6 tcp6://fe80::82e6:50ff:fe08:2e50:8000?en0 HTTP(S) URI> NTX ISSA Cyber Security Conference October 2-3,

47 Session Communication Retry total Retry wait Configurable timeouts NTX ISSA Cyber Security Conference October 2-3,

48 Stageless Meterpreter Skip staging and put everything in one payload NTX ISSA Cyber Security Conference October 2-3,

49 49

50 NTDS.dit Domain controllers store accounts Multi-GB file for large orgs Downloading giant files sucks NTX ISSA Cyber Security Conference October 2-3,

51 NTDS.dit Solution windows/gather/credentials/domain_hashdump Uses a C extension to parse on target Send back a few at a time NTX ISSA Cyber Security Conference October 2-3,

52 Infrastructure

53 Ruby

54 54

55 Omnibus logo 55

56 Random

57 Workspace in Your Prompt NTX ISSA Cyber Security Conference October 2-3,

58 Tab-completing LHOST NTX ISSA Cyber Security Conference October 2-3,

59 Questions?

60 North Texas ISSA (Information Systems Security Association) Thank you NTX ISSA Cyber Security Conference October 2-3,

Building Payloads Tutorial

Building Payloads Tutorial Last updated 06/23/2014-4.9 With Metasploit Pro, you can build payloads with the Payload Generator. The Payload Generator provides a guided interface that you can use to quickly