© 2010 – MAD Security, LLC All rights reserved ArmitageArmitage A Power User’s Interface for Metasploit

Overview What is Armitage? User Interface Reconnaissance and Host Management Attack Post-Exploitation Maneuver Reporting

What is Armitage? User interface for Metasploit –Red Team collaboration –Advanced Post-exploitation –Time Saving Automation Fast moving: 30+ Updates in 2011 Distributed with Metasploit –BackTrack Linux Recommended

User Interface Visualize targets Find the right module Work on multiple things

User Interface

Reconnaissance Launch NMap –db_nmap –Hosts -> NMap Scans Not pivot friendly!

Reconnaissance MSF Scans –Launches 20+ Metasploit Auxiliary Modules –Works through a pivot

Import Hosts –Acunetix –Amap –Appscan –Burp Session –Foundstone –IP360 –Microsoft Baseline Security Analyzer –Nessus –NetSparker –NeXpose –Nmap –OpenVA –Qualys –Retina Reconnaissance

Host Management Table View –Displays hundreds of hosts –Same information as graph view

Host Management For large networks, use dynamic workspaces Group hosts by: –Network –Open services –Operating system –Session status Use Workspaces menu to switch

Attack: Remote Exploits Search for exploits –Use module browser Exploit recommendations –Attacks -> Find Attacks “Hail Mary” –Smarter db_autopwn

Attack: Remote Exploits

Attack: Client-side Search for module Optional: configure payload Launch module

Attack: Client-side Search for module Optional: configure payload Launch module

Attack: Client-side Search for module Optional: configure payload Launch module

Attack: Client-side Search for module Optional: configure payload Launch module

Post Exploitation Spy on the user –Screenshots, webcam, key logging Access the file system –Upload, download, TIMESTOMP Escalate your privileges –Token stealing, local exploits

Post Exploitation

Maneuver Host Discovery: ARP Scan Pivoting Setup Metasploit Scans

Maneuver Host Discovery: ARP Scan Pivoting Setup Metasploit Scans

Maneuver Host Discovery: ARP Scan Pivoting Setup Metasploit Scans

Maneuver: Pass the Hash Use password hashes to authenticate as a user Requires an Active Directory domain

Maneuver: Pass the Hash Use password hashes to authenticate as a user Requires an Active Directory domain

Reporting Activity Logs –All console tabs logged –Organized by host/date Export Data –TSV and XML output of most data Quick Screenshot –Grab a screenshot of any tab

Summary What is Armitage? User Interface Reconnaissance and Host Management Attack Post-Exploitation Maneuver Reporting

Where to next? Armitage Homepage – Twitter