Tag Archive for: Metasploit

You are here: / Metasploit

Posts

OpenVAS & Metasploit Integration – How to Use OpenVAS in Metasploit

Recently during an engagement, I was able to use OpenVAS in Metasploit to scan a host and conduct a test to see if the system was indeed exploitable.  Here is how it was done below:

  1. Issue command msfconsole to open Metasploit console.
    • msfconsole
  1. To use the OpenVAS integration you need to load the OpenVAS module within msfconsole. Do this by running the command
    • load openvas.
  1. Start by connecting to the server using the command openvas_connect.
    • openvas_connect username password 127.0.0.1 9390
  1. To create a target to scan use the command openvas_target_create. If you want spaces in the name or comment then make sure you place quotations around them.
    • openvas_target_create “Local Machine” 192.168.70.128 “My Local Machine” 
  1. Create a task by specifying a target and a configuration. Use the command openvas_config_list to get a list of configurations and the command openvas_target_list to get a list of targets.
    • openvas_config_list
    • openvas_task_create “Local Scan” “Scan My Local Machine” 0 1 
  1. Start the task with openvas_task_start and watch the progress using openvas_task_list.
    • openvas_task_start 0
    • openvas_task_list
    • openvas_task_list 
  1. Once the scan is finished, the progress is -1, list the available reports using openvas_report_list.
    • openvas_report_list

 

If this was helpful please let me know.

Using Metasploit to Conduct NMAP Scans

Using Metasploit and nmap together as been a useful technique for me during some of my engagements.  Below are the steps I take to implement that task.

  1. Start metasploit by issuing the following command:
    • msfconsole
  1. Verify the status of the database by issuing the following command:
    • db_status
  1. Run NMAP from inside msfconsole and save the output into the MetaSploit database.
    • db_nmap -v -sV host_or_network_to_scan
      • db_nmap -v -sV 192.168.1.1 (Single Host)
      • db_nmap -v -sV 192.168.1.0/24 (Network Range)
  1. To list all the remote hosts discovered during your nmap scan issue command:
    • Hosts
  1. To add the hosts to the list of remote targets issue command:
    • hosts –R
  1. To list all of the available targets issue command:
    • show targets
  1. You can search for exploits using the “search” keywords below:
    • search type:exploit
    • search CVE-XXXX-XXXX
    • search cve:2014
    • search name:wordpress

If you found this to be useful, please leave a comment.

Metaspolit – msfconsole help command output

msf > help

Core Commands

=============

Command Description

——- ———–

? Help menu

banner Display an awesome metasploit banner

cd Change the current working directory

color Toggle color

connect Communicate with a host

exit Exit the console

get Gets the value of a context-specific variable

getg Gets the value of a global variable

grep Grep the output of another command

help Help menu

history Show command history

irb Drop into irb scripting mode

load Load a framework plugin

quit Exit the console

route Route traffic through a session

save Saves the active datastores

sessions Dump session listings and display information about sessions

set Sets a context-specific variable to a value

setg Sets a global variable to a value

sleep Do nothing for the specified number of seconds

spool Write console output into a file as well the screen

threads View and manipulate background threads

unload Unload a framework plugin

unset Unsets one or more context-specific variables

unsetg Unsets one or more global variables

version Show the framework and console library version numbers

Module Commands

===============

Command Description

——- ———–

advanced Displays advanced options for one or more modules

back Move back from the current context

edit Edit the current module or a file with the preferred editor

info Displays information about one or more modules

loadpath Searches for and loads modules from a path

options Displays global options or for one or more modules

popm Pops the latest module off the stack and makes it active

previous Sets the previously loaded module as the current module

pushm Pushes the active or list of modules onto the module stack

reload_all Reloads all modules from all defined module paths

reload_lib Reload one or more library files from specified paths

search Searches module names and descriptions

show Displays modules of a given type, or all modules

use Selects a module by name

Job Commands

============

Command Description

——- ———–

handler Start a payload handler as job

jobs Displays and manages jobs

kill Kill a job

rename_job Rename a job

Resource Script Commands

========================

Command Description

——- ———–

makerc Save commands entered since start to a file

resource Run the commands stored in a file

Database Backend Commands

=========================

Command Description

——- ———–

db_connect Connect to an existing database

db_disconnect Disconnect from the current database instance

db_export Export a file containing the contents of the database

db_import Import a scan result file (filetype will be auto-detected)

db_nmap Executes nmap and records the output automatically

db_rebuild_cache Rebuilds the database-stored module cache

db_status Show the current database status

hosts List all hosts in the database

loot List all loot in the database

notes List all notes in the database

services List all services in the database

vulns List all vulnerabilities in the database

workspace Switch between database workspaces

Credentials Backend Commands

============================

Command Description

——- ———–

creds List all credentials in the database

msf > help | more

Credentials Backend Commands

============================

Command Description

——- ———–

creds List all credentials in the database

Database Backend Commands

=========================

Command Description

——- ———–

db_connect Connect to an existing database

db_disconnect Disconnect from the current database instance

db_export Export a file containing the contents of the database

db_import Import a scan result file (filetype will be auto-detected)

db_nmap Executes nmap and records the output automatically

db_rebuild_cache Rebuilds the database-stored module cache

db_status Show the current database status

hosts List all hosts in the database

loot List all loot in the database

notes List all notes in the database

services List all services in the database

vulns List all vulnerabilities in the database

workspace Switch between database workspaces

Resource Script Commands

========================

Command Description

——- ———–

makerc Save commands entered since start to a file

resource Run the commands stored in a file

Job Commands

============

Command Description

——- ———–

handler Start a payload handler as job

jobs Displays and manages jobs

kill Kill a job

rename_job Rename a job

Module Commands

===============

Command Description

——- ———–

advanced Displays advanced options for one or more modules

back Move back from the current context

edit Edit the current module or a file with the preferred editor

info Displays information about one or more modules

loadpath Searches for and loads modules from a path

options Displays global options or for one or more modules

popm Pops the latest module off the stack and makes it active

previous Sets the previously loaded module as the current module

pushm Pushes the active or list of modules onto the module stack

reload_all Reloads all modules from all defined module paths

reload_lib Reload one or more library files from specified paths

search Searches module names and descriptions

show Displays modules of a given type, or all modules

use Selects a module by name

Core Commands

=============

Command Description

——- ———–

? Help menu

banner Display an awesome metasploit banner

cd Change the current working directory

color Toggle color

connect Communicate with a host

exit Exit the console

get Gets the value of a context-specific variable

getg Gets the value of a global variable

grep Grep the output of another command

help Help menu

history Show command history

irb Drop into irb scripting mode

load Load a framework plugin

quit Exit the console

route Route traffic through a session

save Saves the active datastores

sessions Dump session listings and display information about sessions

set Sets a context-specific variable to a value

setg Sets a global variable to a value

sleep Do nothing for the specified number of seconds

spool Write console output into a file as well the screen

threads View and manipulate background threads

unload Unload a framework plugin

unset Unsets one or more context-specific variables

unsetg Unsets one or more global variables

version Show the framework and console library version numbers

msf >

DoD Cyber Crime Conference 2011

SANS is pleased to announce that we’ve partnered with DoD Cyber Crime Conference 2011 to offer SANS two-day Metasploit Kung Fu for Enterprise Pen Testing course as part of the pre-conference training January 21 – 24, 2011 in Atlanta, GA.

Register for pre-conference training and the DoD Cyber Crime Conference 2011 by December 31, 2010 for the deepest discounts available. Pre-conference training is January 21 – 24 and the Conference runs January 25 – 28.

The DoD Cyber Crime Conference focuses on all aspects of computer crime and incident response including intrusion investigations, cyber crime law, digital forensics, information assurance, as well as the research, development, testing, and evaluation of digital forensic tools.

The goal is to prepare attendees for the new crimes of today and the near future. Speakers will discuss new approaches and new perspectives with the current movers and shakers in cyber crime.

Metasploit Pro Webcast with HD Moore – Recording Now Available for On Demand Viewing

Recently, Metasploit founder and Rapid7 CSO, HD Moore, conducted a live walk through of Metasploit Pro, the new commercial penetration testing tool based on the open source Metasploit Framework.

Whether you attended that session and would like a repeat, or you weren’t able to attend and would love to catch a glimpse of what Metasploit Pro has to offer, a recording of that session is now available.



Metasploit Pro is designed for security professionals in enterprises, government agencies and consulting firms who need to make network security testing more efficient in order to reduce costs. Unlike alternative products, Metasploit Pro improves the efficiency of penetration testers by providing unrestricted remote network access, and by enabling teams to collaborate efficiently. Metasploit Pro exceeds the functionality of Metasploit Express™ with support for security testing of custom Web applications, managing client-side campaigns against end-users, and additional evasion features.

Metasploit Pro – Now Available – Free Trial & Webcast with HD Moore

From a Rapid 7 email.  I love the Metasploit and I like what these guys have done with it too…  Wow Metasploit Pro

Rapid7 is thrilled to announce the introduction of Metasploit Pro™, the new product for penetration testers who need an advanced tool to penetrate networks efficiently and from many angles.

Metasploit Pro is designed for security professionals in enterprises, government agencies and consulting firms who need to make network security testing more efficient in order to reduce costs. Unlike alternative products, Metasploit Pro improves the efficiency of penetration testers by providing unrestricted remote network access, and by enabling teams to collaborate efficiently. Metasploit Pro exceeds the functionality of Metasploit Express™ with support for security testing of custom Web applications, managing client-side campaigns against end-users, and additional evasion features. And, effective immediately, Metasploit Pro is available for trial and purchase.

Metasploit Pro has these additional features over Metasploit Express:

  • Web application scanning and exploitation
  • Social engineering campaigns
  • VPN Pivoting
  • Endpoint protection evasion
  • Team collaboration
  • Experts recommendations
  • Customizable reports

If you’d like to learn more, please join us for a Webcast on November 2nd when HD Moore will provide a live walk through of the product and answer questions from the audience, or visit our website for more details where you can also download a fully-featured trial version of Metasploit Pro.

Alternatively, we’d be happy to answer any questions you may have. Simply contact your Rapid7 Account Representative or call +1 (617) 247 1717.

You can download the Metasploit Framework for free here.