Skip navigation
All Places > Metasploit > Blog > Authors erayymz

Metasploit

7 Posts authored by: erayymz Employee

In August, we were getting a lot of questions about Kali 2. I have answered some questions in Metasploit on Kali Linux 2.0 blog post in the past. Today, I am pleased to announce that we extend our official platform support to three new operating systems which are now listed in Metasploit System Requirements page:

  • Kali Linux 2.0
  • Red Hat Enterprise Server 7.1 or later
  • Microsoft Windows Server 2012 R2

 

Since we have added Kali 2 as a supported operating system, we no longer support Kali 1.x. Please note that these changes are applicable to our closed source products which are Metasploit Community, Express, Pro. Since Metasploit Framework is an open source and free tool, we do not provide support for it.

 

Let me now try to cover some frequently asked questions:

 

What is the difference between Rapid7 officially supported and not supported platforms?

For every platform we list in our Metasploit System Requirements page, we perform automated testing before every release. Additionally, we perform full regression tests if we introduce a new feature. This ensures that we minimize the chance of introducing a defect. Beside from testing, we have a lab environment that includes each of the supported platforms so that when our customers report any issues, we can quickly reproduce those issues and address as soon as possible. Given these reasons, we highly recommend that you use a supported platform.

 

Kali 2 already comes with Metasploit Framework, how does this change affect me?

This announcement is only applicable to our closed source products which are Metasploit Community, Express, and Pro. Since Framework is an open source tool, we do not provide support for Metasploit Framework however you may still receive community support via IRC channel, and Rapid7 Community Discussions.

 

Additionally, we have recently released Metasploit Framework Open Source Installers. If you wish to always stay on updated version of Metasploit Framework, feel free to use the open source installers.

 

Kali 2 already comes with Metasploit Framework, can I still install Community, Express or Pro editions?

Yes, Kali 2 comes with a Metasploit Framework version, however you can still install any of our closed source edition of Metasploit without any issues. As I mentioned above, Express and Pro editions are now fully supported on Kali 2. Once you install Community, Express, or Pro editions, you will realize that the packages will install into a complete different path, thus it will not overwrite Kali provided Framework edition. However, you will be able to use the command line provided with Pro edition without issues.

 

Can I continue to use Kali 1.1?

If you wish to continue using Kali 1.1, you certainly can. Please keep in mind that it is no longer supported and we do not perform tests on this platform anymore. Thus it is highly possible that some things may not work as expected.

 

I have further questions, what do I do?

Feel free to provide comment to this thread, or send us a tweet.

 

Eray Yilmaz - @erayymz

Sr. Product Manager

Metasploit on Kali Linux 2.0

Posted by erayymz Employee Aug 12, 2015

As you are aware, Kali 2.0 has been released this week and getting quite a bit of attention, as it should. Folks behind Kali have worked really hard to bring you the new version of Kali Linux that everyone is excited about. If you have already started to play with the new version, you probably have realized that something is different, that is; Metasploit Community / Pro is no longer installed by default.

 

Where is Metasploit Community / Pro in Kali 2.0?

Currently Kali 2.0 does not include commercial editions of Metasploit that are Community, Express and Pro versions. Kali 2.0 includes, by default, a version of Metasploit Framework.

 

Why doesn’t Kali 2.0 include Metasploit Community / Pro?

Kali 2.0 is not yet officially supported by Rapid7 for our commercial versions of Metasploit. There were a lot of changes occurred in Kali 2.0, thus we need to make sure our commercial editions work as expected in the new Kali platform. We are working towards adding Kali 2.0 support soon.

 

How can I install Metasploit Community / Pro on Kali 2.0?

If you like to install latest version of Metasploit Community, Express, or Pro edition, you can absolutely do that by downloading the latest installer from Github: Metasploit Installers. Once you download the installer, please follow normal install procedure. We have verified that the latest installer will install and Metasploit will run without issues, however I must remind you that Kali 2.0 is not yet officially supported by Rapid7.

 

Do I need to uninstall pre-installed Metasploit Framework?

Due to the way we package commercial versions, installing Metasploit Community, Express, or Pro will not overwrite any Metasploit Framework packages provided by base install of Kali 2.0. Thus, it is not required to uninstall Kali provided Metasploit Framework packages.


What if I upgrade from Kali 1.1 to 2.0?

At this point, if you are planning on using any commercial edition of Metasploit on Kali 2.0, we strongly recommend a fresh install of Kali.

 

I have further questions, what do I do?

Feel free to provide comment to this thread, or send us a tweet.

 

One last thing: It is because we have no call home functions in any Metasploit versions, it is really hard for us to know which version of Metasploit is being used on Kali. Thus, please take this one question survey to let us know which version of Metasploit you use on Kali. We really appreciate your response.


Eray Yilmaz - @erayymz

Sr. Product Manager

It is always a running battle to keep an application's backend up to date with various technologies. Today, we are excited to announce that Metasploit Framework now ships with Rails 4.0. Upgrades like this are sometimes hard to get excited about because if everything goes well, users should see no difference. There are many reasons to upgrade to Rails 4, though.


Why Upgrade

Here are the important reasons to upgrade from our perspective:

o Security is a big part of why we have to keep our code up to date. We want to make sure that any third party technology we use is up to date in order to receive security updates and patches. This is especially important for us, given what our product does.

o Rails 4 comes with many new features that make our lives easier from a development perspective. We want to make sure that we can utilize the latest and greatest things in order to become more efficient in our everyday programming efforts.

o We want to make sure we can provide the best integration experience possible. Staying with industry standards helps us provide the best experience possible to our community and our customers.


What Should I Expect

Your everyday experience with Metasploit Framework will be no different. This upgrade does not introduce any changes to the way Metasploit Framework works. Thus, you should not see any usability changes. Additionally, we are always committed to delivering high quality code all the time. We have performed extensive testing to make sure we are not introducing any issues to Metasploit Framework. At this point we are very confident that our users' experience will not degrade at all.

However, as any developer knows, when you are dealing with a complex application such as Metasploit Framework, there is a likelihood of things slipping through the cracks. Thus, we kindly ask our users that if you see unusual behaviour as you continue to use Metasploit Framework, especially shortly after Rails 4.0 rollout, please keep in mind that the behaviour might be surfacing due to Rails 4 upgrade and please approach troubleshooting the issue with that in mind. Additionally, we kindly ask you to open an issue on Metasploit Framework Project - Github to let us know about your experience and steps you have taken to verify the issue.

I want to thank you for the folks here in Austin, TX for their hard work that they did past couple of months in order to make this upgrade possible.


As always, I want to thank our community for supporting us to improve Metasploit Framework years to come.

*** Rails 4 is only included in Metasploit Framework Master Branch on Github. If you are using Metasploit Community edition you will receive Metasploit Framework Rails 4 upgrade within two weeks. We will call the changes out in our release notes.

 

Eray Yilmaz - @erayymz

Sr. Product Manager, Metasploit

Last week, we had a live webcast to talk about how Metasploit Pro helps pentesters be more efficient and save time. There were so many attendees, which made it possible to have great conversation. First of all, I want to thank you folks who have taken the time from their busy schedules to watch us live. There were many questions our viewers asked us, and we were not able to answer all of them due to time limitations. In this post, you will find the answers for those questions.

 

First things first. If you would like to read a recap of the webcast, go here: Top 3 Takeaways from the "Escalate your Efficiency: How to Save Time on Penetration Testing" Webcast, and if you would like to watch the webcast go here: .On Demand Webinar: Escalate Your Efficiency: How to Save Time on Penetration Testing.


Questions and Answers

In order to protect identities of our attendees, we taken out any identifiable information from the questions. Thus, some questions may have been reworded.


Is there a tutorial available for some of the finer points of using Metasploit Pro?

There are quite a bit of content available. We will continue to generate new content as we add new features in the future. Feel free to start here: Metasploit Online Help.


Is Metasploit Pro licensed specifically for a named user or can it be licensed to support a moderate scale remotely located pen test group arrangement?

As of right now, we only support licensing based on number of users. However we are investigating different licensing options, and we will take your suggestion into consideration.


Does Metasploit Pro license limit how many IP addresses that can be added to a project?

No, it does not. Our licensing model is based on number of users. There are no license limitations around number of IP addresses. Please keep in mind that if you plan to test a large network, we strongly suggest you run Metasploit Pro on a beefy machine to prevent any performance issues.


Is one of the UI improvements the ability to pause scanning to accommodate multiple small testing windows?

Yes. We have recently released the Pause & Resume feature to Metasploit Pro. Currently it is only available for the Credential Reuse task. However we are planning to extend the feature to other tasks in the future.


Our organization is just about to train our ISSO to conduct internal penetration testing in house utilizing Metasploit Pro. What features should we begin testing to introduce us "newbies" to the world of pentesting?

Metasploit Pro comes with an easy to use web interface to simplify pentesting as much as possible. Personally, I would start with a phishing/social engineering campaign to quickly assess your employees since this type of testing requires a lot less technical knowledge. Additionally, an easy win may be scanning your network for vulnerabilities with Nexpose and validating found vulnerabilities with Metasploit to determine which vulnerabilities you should focus on fixing first. Here is a good read to get started: Introduction to Penetration Testing.


Can I develop an exploit in Metasploit Pro?

You actually do not need Metasploit Pro to develop an exploit. Metasploit Pro is not a tool for reverse engineering an application to look for zero day vulnerabilities and write exploits. It is an application to consume available exploits in an efficient manner. If you would like to learn how to write exploits, feel free to start with following pages:

Contributing to Metasploit

Metasploit Resource Portal


What are the learning curves between the editions? I have used Metasploit Framework several years ago so I am not totally new to pentesting.

Metasploit Pro consumes same modules that Framework does, so as far as exploit content goes, there is not much difference. However, Metasploit Pro comes with some additional features, most of which we talked about during the webinar, that might require some reading and learning. We know that many of our users have used Framework in the past and they are used to command line, thus, we are going to bring some of those commands to Metasploit Pro web interface in 2015 to make it even easier to use. Overall, the learning curve is not that steep.


Can I use my own word list when I customize a bruteforce attempt?

Yes, you can. Even though bruteforce functionality does not take a wordlist as an input, a wordlist can be used to generate a list of credential pairs which then can be imported to be used for bruteforce.


Is there an option for passwords in different languages for bruteforce?

Currently there is not. You can however create your own custom list of credential pairs from any language wordlists, and then import it for bruteforce.


How can I customize the password mutation feature for a bruteforce attempt?

Password mutation feature comes with several mutation options. Currently we do not support adding customized mutation rules, however this is something we are looking to implement in the future.


What can I expect in a typical 100 PC network including servers and workstations to spend in hours when performing bruteforcing? Does speed changes between Metasploit Editions, say Community vs. Pro?

We would very much like to give you an answer for this; however, it really depends on many factors such as network speed, mutation rules, password combinations, number of services, etc. The best way to learn is to actually try this on your own network with your custom configuration. This way you can create your baseline and go from there. Running speed of any task does not differ between versions.


Do you have any suggestion for a good place to get a good username and password list to use?

Here is a collection of mirrors: https://wiki.skullsecurity.org/Passwords.

If you are interested in building personalized wordlists for specific situations, here is a good starting point: Errata Security: Extracting the SuperFish certificate.


We started using task chains extensively and at some point realized that they don't function as setup when we update the machines. Are task chains dependent on the projects created?

Yes, task chains are project dependent and cannot be replicated across projects.

 

How often are you utilizing embedded outdated, insecure components of applications and systems for exploitation (similar to GHOST)?

When there is a high impact vulnerability becomes available, the turnaround is usually pretty fast. When Shellshock came out, there was an exploit released within 24 hours. The turnaround time really depends on how difficult (or easy) the issue is to exploit. If there's a reasonable network vector (rather than a mere local-only vulnerability), and the likely impact of the vulnerability.


If the Metasploit framework is unable to break a hash, say an MD5 hash, what other resources would you use or how would you go about using Metasploit to figure out how to crack the hash?

We have recently added a tool to lookup MD5 hashes on publicly available databases: https://github.com/rapid7/metasploit-framework/pull/4601

Additionally, you can combine John the Ripper and Metasploit to attack MD5 hashes with this module: modules/auxiliary/analyze/jtr_linux.


Could you add a service to find default login credentials for Tomcat?

There is a Metasploit module already for Tomcat to perform login attempts. It is called "Tomcat Application Manager Login Utility" and its path is "auxiliary/scanner/http/tomcat_mgr_login". Additionally, here is our module database. Feel free to search for other modules.


With the release of msfvenom, is there going to be any compatibility with users who have developed payloads and tools in msfencode and msfpayload?

We don't anticipate any gaps in functionality -- msfvenom has been in "public beta" for years now, and there should already be a 1:1 feature parity. That said, if you notice something not working for your use case between msfpayload + msfencode and msfvenom, please open a GitHub issue here.


When will GPU password cracking be available?

Currently, we do not have any plans on adding GPU password cracking as a feature. However, John the Ripper has some excellent toolchains for this, and Metasploit can import the results pretty easily.

 

Metasploit is a great tool however it is only a tool. PCI V3 requires that the pentest is "based on industry-accepted penetration testing approaches (for example, NIST SP800-115)". What is the penetration testing methodology used by your pentesters with Metasploit?

We believe that there is no single methodology for PCI compliance. Generally, companies use a vulnerability management solution to try to fix as many vulnerabilities as they can. Some also performs initial penetration testing and this is where Metasploit Pro can help. Finally, consultants can come in to provide pentesting. We actually like this order because consultants should help you find the things you could not. I would not call this a methodology, however if you approach a PCI engagement in this order, then you can get the most out of your compliance engagement, not just PCI check in the box. Feel free to read more about this topic starting with this article: What You Should Take Away from the PCI DSS 3.0.


Is it simpler to run a WiFi penetration test using Pineapple with Metasploit Pro compared to Metasploit Framework? | Can you add WiFi pentest integration?

Once you have a connection to a WiFi network though Pineapple or any other tool, then you can use Metasploit Pro or Metasploit Framework as intended since the WiFi becomes just another network. In this case, all additional features of Pro will be available for you to use. However, as far as getting access to a WEP or WPA protected WiFi network, Metasploit Pro or Framework has no functionality to do this, and we are not planning on adding this functionality at this time.

 

So some of your experts are stating that you shouldn't focus all your work on automated tools such as your own Metasploit, that you should spend the time to learn the tools individually/manually, however other experts are touting Metasploit as the be all end all tool to use. What are your thoughts on this?

Metasploit Pro can replace many tools for various tasks thereby makes the user more efficient. Additionally, we can make the argument that if you know Metasploit very well, you may not have to spend time on learning bunch of other tools. The reality is, as long as pentesting stays as a broad and complicated subject, there will always be many tools out there for different purposes, and a good pentester should always be familiar with different options.

 

Is there a set of questions or a methodology that can be used to interview a good pentester?

There are many approaches to interviewing a pentester. Here are two examples:

  • Hands On, Practical Interview | Interviewee is given access to a lab network with various systems along with couple pentesting tools, and various objectives which interviewee is expected to complete. With this approach, interviewer can observe the interviewee while interviewee executes a small size pentesting while utilizing different tools and techniques.
  • Theriocal, Story Telling Interview | Interviewee is asked a list of questions to assess the overall knowledge (this step can be combined with practical interview). Interviewee is also expected to share several examples of past work and discuss various situations that the person had to overcome.

Interview questions will vary depending on the interviewee; however I find this article a good read.


This is it for this blog post. As always, feel free to reach out to us @metasploit if you have further questions. Thank you Metasploit Team for assisting me with these answers.


Eray Yilmaz - @erayymz

Sr. Product Manager, Metasploit

#1 Attack Vector: Credentials

According to the Verizon Data Breach Investigations Report, credentials are the number #1 attack vector used to compromise networks. This news comes with no surprises. Credentials have been and most likely will continue to be one of the top attack vectors for years to come.

 

With credentials-based attacks becoming exponentially more topical, it's become more critical than ever to focus on credentials management and reuse. Metasploit has always provided the ability to leverage credentials in attacks, but it was a cumbersome and inefficient process. There was not an easy way to manage and use credentials that were collected from compromised systems. So in 2014, we dedicated a great deal of time to developing new features that enabled our users to easily manage and reuse credentials easily and efficiently.

 

Managing Credentials Made Easy

In August of 2014, we have released a major feature, a one-stop shop, to handle all credentials, in a single view in Metasploit Pro. Since then, we have received tons of feedback from our customers in terms of how it has helped them streamline the process of managing and using credentials, especially with large projects. Additionally, we also introduced a new feature that simplifies using credentials on other targets. Reusing credentials is a very common practice, but it was a very manual process before. With this improvement, we expected to save our users a lot of time by enabling them to reuse credentials very quickly and efficiently.

 

cred_blog_1.jpg

cred_blog_2.jpg


These two features were only half of the story. Metasploit Pro had a bruteforce feature prior that was lacking certain features and was cumbersome to use. We also needed to provide more tools to our users to help them save even more time on their penetration testing engagements. Fast forward to December of 2014; we released a new MetaModule that simplified to reuse credentials, and we made significant improvements to bruteforce functionality.

 

Owning the Network with Credentials

The new bruteforce workflow not only looked significantly better, but it also included new functionality that enabled customers to test common factory defaults and previously collected credentials. Password mutations, which were removed in Metasploit 4.10.0, were re-added to the bruteforce workflow to enable users to append and prepend characters to passwords as well as perform leetspeak substitutions. The new "Time Between Attempts" configuration helps prevent account lockouts during bruteforce attempts. I was particularly excited about the Credentials Domino MetaModule. It completely automates the credentials reuse scenario thereby enabling our users to focus on other parts of testing process that may require more manual effort. It also comes with network visualization view that analyzes the results of the reuse attempts which makes it very easy to clearly identify weak hosts within a network.


 

cred_ss_3.jpgcred_ss_4.jpg

As we wrapped 2014, I felt really good about the improvements and new features we have added to Metasploit. I strongly believe 2015 will be a great year for us. We will continue to add new features, and improve usability along the way.

 

As always, your feedback is really important to us, feel free to reach out to us here on the Community, via Rapid7 Customer Portal, or tweet us @rapid7 and @metasploit any time.

 

Eray Yilmaz - @erayymz

Sr. Product Manager, Metasploit

 

 

Hello World

My name is Eray Yilmaz, and I am the new Product Manager of Metasploit. It has been three months since I have joined Rapid7, and I wanted to share my experiences with you so far. Before we get to that, here is tiny bit about myself:

 

I am a 28, married, and fairly new father. I went to UTSA where I majored in Information Assurance and Information Systems, and received my B.B.A. Like anyone else in our industry, I have done my fair share of IT work, from helpdesk to managing networks, operating systems, etc. Like many geeks out there, I used Metasploit in the past, and now I can proudly announce that I am one of the people responsible for its future.

 

If you want to learn more about what I have done in the past, feel free to check my Linkedin profile.

 

Hello Rapid7

When I learned about the position at Rapid7, the idea of being part of great group of people who get Metasploit to the next level really excited me. I knew about Rapid7's acquisition of Metasploit, and I was aware of their commercial products, Metasploit Express and Pro. However, I have never used the commercial versions myself in the past, mainly because I haven't done much pen testing in the past couple years. As I was considering the position and going through the interviews, there were two things really got my attention:

 

1. People's Republic of Metasploit (the folks in Austin, TX): During my interview, I was amazed with the dedication and care that Metasploit Team had for the product. To them, this was not simply a product but something that they truly enjoyed being part of. After the interviews, I really was drawn into the role even more, and felt that I needed to be part of this amazing team - yes, we really call ourselves People's Republic of Metasploit -.

2. Rapid7's Take on Metasploit Framework: It was super clear, from day one, that Rapid7 really respects Metasploit Community and understands its importance. Rapid7 truly believes that Metasploit Framework and Metasploit Community are as equally important as our commercial versions. I was really moved by this since it is really hard to find companies that support open source projects at this level.

 

At this point, things were looking great, and I went ahead made a decision to accept the position and move my family to Austin, TX.

 

Past Three Months

I am not going to lie; the first month was hard. One of the best things about Rapid7 is also one of the hardest things that you have to go through as a new employee. Despite the fact that Rapid7 is 15 year old company, it does not act like one. It is very much like a startup which I like a lot. This is why I was meeting with so many people to learn as much about the company as possible, which felt like drinking from a fire hose some time. I spent almost a month trying to understand everything about the company and trying to get to know Metasploit Team as much as I could.

 

One of the things I liked the most was how much our customers cared about the product as well. I had numerous customer calls to talk about the product and to listen their thoughts and feedback around how can we make the product even better. I truly believe that when you have customers invested in your product, not just financially, it makes the the team even more dedicated towards improving the product.

 

Metasploit Framework

Before I say anything else, I want to thank to our open source community for supporting Metasploit Framework, which would not be a great tool like it is today without your support.


Tod Beardsley and I are always brainstorming about how we can push the Metasploit Framework forward. One of the things on our radar is to make educational content available to our users and exploit committers. todb and tdoan are doing great work with the external resource portal to make it easier to locate external educational content. You can expect more initiatives like this to come up in the future.

 

Metasploit Community / Express / Pro
As I was coming up to speed, I was also learning a lot about the commercial products, specifically Metasploit Pro. It was clear to me that this version gives the user two distinct advantages:

 

1. Web Interface: We all know pen testing can get really complicated, especially if you are dealing with many targets at one time. One of the advantages of using a graphical interface is that it makes it easier to handle multiple work streams (multi-tasking) thereby improving efficiency and enabling the user to do more things in a short period of time. Metasploit's user interface tries to do just that, making it easier and more efficient for the user. While this is certainly true for users new to pen testing, veteran pen-testers maintain a preference for Framework. That’s ok by us. Framework is an awesome product and with your help it continues to get even better. We will keep investing in the UI version to make pen-testers as efficient as possible. Stay tuned for 2015 as you will see many UI improvements coming up in near future.

 

2. Pro Features: Metasploit Pro is powered with Metasploit Framework, along with some additional features, such as metamodules, reporting functions, social engineering features, vulnerability validation wizard, etc. Some of these are additional capabilities that are only available in Metasploit Pro, and some of them are designed to automate common tasks.

 

I want to finish this blog post saying that there are many challenges ahead of us, both on Framework and the commercial side, and we are happy to accept those challenges and convert them into opportunities to make Metasploit even better in the future. I am super happy to be part of People's Republic of Metasploit.

 

Eray Yilmaz - @erayymz

Sr. Product Manager, Metasploit

Overview

The Update (2014122301) which was released on December, 23th 2014, failed to include necessary files for the application to update to version 4.11.0 for the first time.

 

Issue

The application will not start, therefore browser will provide generic "The page can’t be displayed" message when trying to load the web UI.

Additionally, various log messages may appear in respective log files.

Windows: C:\metasploit\apps\pro\engine\prosvc.log

Linux: /opt/metasploit/apps/pro/engine/prosvc_stderr.log

/opt/metasploit/apps/pro/ui/lib/metasploit/pro/ui/common_configuration.rb:2:in `<top (required)>': uninitialized constant Metasploit::Pro::UI (NameError)

from /opt/metasploit/apps/pro/vendor/bundle/ruby/1.9.1/gems/polyglot-0.3.5/lib/polyg lot.rb:65:in `require'

from /opt/metasploit/apps/pro/vendor/bundle/ruby/1.9.1/gems/polyglot-0.3.5/lib/polyg lot.rb:65:in `require'

from /opt/metasploit/apps/pro/ui/lib/metasploit/pro/ui/engine.rb:1:in `<top (required)>'

from /opt/metasploit/apps/pro/vendor/bundle/ruby/1.9.1/gems/polyglot-0.3.5/lib/polyg lot.rb:65:in `require'

from /opt/metasploit/apps/pro/vendor/bundle/ruby/1.9.1/gems/polyglot-0.3.5/lib/polyg lot.rb:65:in `require'

from /opt/metasploit/apps/pro/engine/config/application.rb:22:in `<top (required)>'

from /opt/metasploit/apps/pro/engine/lib/metasploit/pro/engine/command/base.rb:44:in `require'

from /opt/metasploit/apps/pro/engine/lib/metasploit/pro/engine/command/base.rb:44:in `require_environment!'

from /opt/metasploit/apps/pro/engine/lib/metasploit/pro/engine/command/base.rb:65:in `start'

from prosvc.rb:17:in `<main>’

Windows: C:\metasploit\apps\pro\ui\thin.log

Linux: /opt/metasploit/apps/pro/ui/log/thin.log

/opt/metasploit/apps/pro/ui/lib/metasploit/pro/ui/common_configuration.rb:2:in `<top (required)>': uninitialized constant Metasploit::Pro::UI (NameError)

from /opt/metasploit/apps/pro/vendor/bundle/ruby/1.9.1/gems/polyglot-0.3.5/lib/polyg lot.rb:65:in `require'

from /opt/metasploit/apps/pro/vendor/bundle/ruby/1.9.1/gems/polyglot-0.3.5/lib/polyg lot.rb:65:in `require'

from /opt/metasploit/apps/pro/ui/config/application.rb:23:in `<top (required)>'

from /opt/metasploit/apps/pro/ui/config/environment.rb:2:in `require'

from /opt/metasploit/apps/pro/ui/config/environment.rb:2:in `<top (required)>'

from /opt/metasploit/apps/pro/ui/config.ru:3:in `require'

from /opt/metasploit/apps/pro/ui/config.ru:3:in `block in <main>'

from /opt/metasploit/apps/pro/vendor/bundle/ruby/1.9.1/gems/rack-1.4.5/lib/rack/buil der.rb:51:in `instance_eval'

from /opt/metasploit/apps/pro/vendor/bundle/ruby/1.9.1/gems/rack-1.4.5/lib/rack/buil der.rb:51:in `initialize'

from /opt/metasploit/apps/pro/ui/config.ru:1:in `new'

from /opt/metasploit/apps/pro/ui/config.ru:1:in `<main>'

from /opt/metasploit/apps/pro/vendor/bundle/ruby/1.9.1/gems/thin-1.5.1/lib/rack/adap ter/loader.rb:33:in `eval'

from /opt/metasploit/apps/pro/vendor/bundle/ruby/1.9.1/gems/thin-1.5.1/lib/rack/adap ter/loader.rb:33:in `load'

from /opt/metasploit/apps/pro/vendor/bundle/ruby/1.9.1/gems/thin-1.5.1/lib/rack/adap ter/loader.rb:42:in `for'

from /opt/metasploit/apps/pro/vendor/bundle/ruby/1.9.1/gems/thin-1.5.1/lib/thin/cont rollers/controller.rb:169:in `load_adapter'

from /opt/metasploit/apps/pro/vendor/bundle/ruby/1.9.1/gems/thin-1.5.1/lib/thin/cont rollers/controller.rb:73:in `start'

from /opt/metasploit/apps/pro/vendor/bundle/ruby/1.9.1/gems/thin-1.5.1/lib/thin/runn er.rb:187:in `run_command'

from /opt/metasploit/apps/pro/vendor/bundle/ruby/1.9.1/gems/thin-1.5.1/lib/thin/runn er.rb:152:in `run!'

from /opt/metasploit/apps/pro/vendor/bundle/ruby/1.9.1/gems/thin-1.5.1/bin/thin:6:in `<top (required)>'

from /opt/metasploit/apps/pro/ui/scripts/ctl.rb:33:in `load'

from /opt/metasploit/apps/pro/ui/scripts/ctl.rb:33:in `start_thin'

from /opt/metasploit/apps/pro/ui/scripts/ctl.rb:47:in `<main>'

Affected Editions

Metasploit Pro, Express and Community.

 

Scope

The issue is only applicable if the application updated to version 4.11.0 between December, 23rd 2014 and January, 7th 2015. If the application updated to version 4.11.0 before or after these dates, and is currently running 4.11.0, it should not be affected by this issue.

 

Solution

On Linux:

1. Launch a Linux terminal via SSH or console

2. Stop Metasploit:

   /etc/init.d/metasploit stop

3. Change to your Metasploit installation directory, e.g.:

   cd /opt/metasploit

4. Create a hotfix directory:

   mkdir -p apps/pro/install/hotfix

5. Change to the hotfix directory:

   cd apps/pro/install/hotfix

6. Download the hotfix from Rapid7:

   wget http://updates.metasploit.com/data/metasploit-4.10.2-hotfix.7z

7. Extract the hotfix (substitute your installation directory as necessary):

   /opt/metasploit/common/bin/7za x metasploit-4.10.2-hotfix.7z

8. Install the hotfix (substitute your installation directory as necessary):

   /opt/metasploit/ruby/bin/ruby install.rb

 

On Windows:

1. Stop Metasploit:

   Start Menu -> Metasploit -> Services -> Stop

2. Open a Windows command prompt/shell as an administrator:

   Start Menu -> type cmd.exe -> right click cmd.exe -> click Run as administrator

3. Change to your Metasploit installation directory, e.g.:

   cd C:\metasploit

4. Create a hotfix directory:

   mkdir apps\pro\install\hotfix

5. Change to the hotfix directory:

   cd apps\pro\install\hotfix

6. Download the hotfix via your web browser:

   http://updates.metasploit.com/data/metasploit-4.10.2-hotfix.7z

   Save or move the hotfix to C:\metasploit\apps\pro\install\hotfix (substitute your installation directory as necessary)

7. Extract the hotfix (substitute your installation directory as necessary):

   C:\metasploit\ruby\bin\7za.exe x metasploit-4.10.2-hotfix.7z

8. Install the hotfix (substitute your installation directory as necessary):

   C:\metasploit\ruby\bin\update-windows.bat

 

The hotfix will take a few minutes to run and provide no output.  You may see some warnings that you may safely ignore.

 

After it completes, Metasploit will be automatically started.  Please wait 5 minutes and then access Metasploit in your browser:

https://localhost:3790/

Once logged in, you will need to update Metasploit to the latest version as you normally would.

Filter Blog

By date: By tag: