Metasploit Framework

0:00[MUSIC PLAYING]

0:06We've touched on and worked a little with Metasploit,

0:09but let's look under the hood a little bit.

0:12See in the previous course of enterprise security essentials,

0:15we, kind of, hit on Metasploit, but like a beginner level.

0:18So in this course, in this skill,

0:19we're going to take a look at Metasploit

0:21at that intermediate level.

0:23And as we continue, we'll start diving deeper and deeper

0:26to what Metasploit can actually do for us.

0:28Now first and foremost, what is Metasploit?

0:30Well, it's a package of tools that

0:32are installed in Kali Linux by default.

0:34But Metasploit does stand on its own

0:36and can be installed on different operating systems.

0:39And we'll touch on that throughout this skill.

0:41But together, with all the tools that were put together

0:44in the package of Metasploit, we can

0:46do a lot of security analysis, pen testing, and even

0:49a little bit of hacking as we've seen throughout the preview

0:52skills.

0:53Now, before we start getting into it,

0:55we have to make sure that we now have

0:56this is applied in the different arenas

0:58that we cover throughout our courses and skills together.

1:01So Metasploit, as a package--

1:03and we've seen different tools and utilities that we can use.

1:07As a pen tester, we can definitely

1:09use it to attack different systems

1:11and make sure that they're not vulnerable.

1:15And as a cyber security defense manager or that CIO or CISO,

1:20we can use Metasploit to allow us

1:22to test the actual defenses on that system

1:25before we call in the pen testers.

1:27Because even though we're putting out policy and making

1:30sure that all of that is implemented with the system

1:33and network administrators, the use

1:35of Metasploit and the professionals that use it,

1:38along with Kali Linux or whatever else that they're

1:41using for scanning and intrusion,

1:44can go in and test to make sure that those settings were

1:47put in correctly.

1:49And it allows us to play in the Sandbox

1:53like we're doing in this skill.

1:54Now, before we get too far ahead,

1:56I do want to point out that VM Tools is suggested

1:59to be installed on our VM for Kali Linux moving forward

2:03into the future.

2:04Now, I point this out because every time

2:06that we do an apt update or upgrade,

2:10it messes with a plug-in on Kali called fuse.

2:13And more recently, it turned into fuse 3.

2:16Now, I'm pointing this out because it's required

2:18for VM Tools to be installed.

2:20And the benefit of VM Tools is to allow

2:22us to be able to bring from--

2:24I don't know if you can see it over here-- this workstation

2:27over here into our VM that's hosting Kali Linux,

2:31that you see on the screen right now.

2:33In the previous skills and Kali, when

2:36we were using stuff like John the Ripper or whatnot,

2:39we took files like the password the password list,

2:41and the scan and stuff like that and dragged into the VM.

2:44Now, as you see in this command-- our terminal window,

2:48I have right here--

2:49I have already ran the command.

2:50And I'm going to put it right here.

2:52And I'm going to highlight it here as well too.

2:55This is the command that we use to re-install VM Tools when

2:59our Kali box or really any other Ubuntu or POSIX

3:04based system does an apt upgrade or apt update

3:08and installs different background programs

3:12that VM Tools is used to running off of.

3:15Now, originally, this program--

3:17VM Tools-- if you'll notice, I have

3:19the flag of reinstall on there.

3:21Because at the end, it says fuse3 now.

3:24And we're using our fuse before.

3:28Fuse 3 is the current one that the POSIX based

3:30systems are running all their programs through and on

3:34and stuff like that.

3:35And you'll see right here that whenever we do a reinstall,

3:38all these programs right here are packages

3:41that are required to run VM Tools

3:43or whatever it is that we're installing.

3:45You'll get this list right here too.

3:47And if there's anything that it needs to upgrade,

3:49it will ask us.

3:50Now, all the way down at the bottom,

3:53you can see that it's going through and doing its installs

3:55and its checks and everything.

3:57And right here, down at the bottom--

4:01what did I do?

4:02Ah, I went ahead and hit up and accidentally hit it.

4:05So I hit no on that.

4:07Because I don't want it to go through the process again.

4:10But right here, we can see this is what

4:12we're looking for right here.

4:14The VM Tools is installed.

4:16And it's running, specifically, as the service of vmtoolsd.

4:20And you can see right here on the top right of the screen

4:23that I have to do a restart.

4:25Now, I know that this is not directly related to Kali,

4:27but I did want to point this out because it makes working

4:30with Kali a lot easier at home.

4:32That way we can drag in and out of our VM system.

4:35Let's say we want to take an extract of some passwords

4:39that John the Ripper did and we say, to the desktop.

4:41Instead of having to open up an SMB channel or any other file

4:45transfer, we can just select the file

4:47and drag it over to our host desktop

4:50and it won't be a problem.

4:52Now, also that's not specific to the VM workstation environment

4:55that we're running.

4:56I just happen to be running 16.

4:58If those at home are playing on VM workstation 14 or 15

5:03or any other edition, this is specific to the operating

5:06system of Kali Linux or POSIX based systems inside of that VM

5:11environment.

5:12It's not necessarily something we

5:14have to do on the station itself.

5:16So that's, kind of, the overview of what

5:19Kali is, and some stuff that we need

5:21to do to make sure that throughout this skill

5:23and future skills, that we're prepped and ready to go.

5:27So let's go ahead and do it to it.

0:00[AUDIO LOGO]

0:05Let's review Metasploit on Kali since we've

0:07seen it in use already.

0:09And to do that, we're going to hit on some of the things

0:11that we've already seen in previous skills and courses.

0:14But let's go ahead and take a detailed look

0:17at what actually happens when we start up Metasploit

0:19and look at some of the tools.

0:20OK, we're in our VM Kali box, and we've

0:22seen this many times before.

0:24Now, there are different ways to start up Metasploit.

0:27But we're going to take the easiest route

0:28and hit Start on the top left and make sure we type

0:32in Metasploit and you'll see it come up

0:34as the Metasploit framework.

0:36Now, when this initially starts up and opens up,

0:39it's going to ask us for our sudo password

0:41because this needs to be ran as admin as it's accessing

0:45a lot of the internal operating system and some

0:48of the other applications in that elevated permissions

0:51level.

0:51Because you can't exactly do scans

0:53and use the operating system like this as a regular user.

0:56So we go ahead and type in our password and start up.

0:59And you'll notice that it's starting up a database.

1:01Because there's a lot of stuff that's

1:03installed in the background, which we'll

1:04go through in a little bit.

1:06And as this is starting up, one of the best things

1:08that I like to see on this is it starts up

1:10with some weird ASCII art when it cranks up initially.

1:15When you see that ASCII art, you know

1:17that Metasploit has been fully started up and is ready to go.

1:21So let's scroll up a little bit and see what

1:23they gave us the Oregon Trail.

1:25And [LAUGH] we died of dysentery.

1:29Now, one of the first things that we

1:30need to do when we have Metasploit open

1:32is we need to assume that we've already

1:34done a lot of reconnaissance work using tools like Nmap,

1:37Zenmap, Wireshark, Nessus, and we'll

1:39touch on this a little bit later in the skill, too.

1:42And as you can see here, I typed in the use command

1:45down here at the bottom.

1:46Let me highlight that for you real quick

1:48and because there are different modules that we can actually

1:52use within Metasploit.

1:53Now, there's a lot of them.

1:55So it's not a problem if we go and look for help

2:00or if we have a list at home of what

2:03modules that we commonly go to use

2:05for different sorts of things.

2:06And for that, I want to point us to an actual website that

2:10is written by Metasploit and Rapid7,

2:12the folks that developed the Metasploit is kind of a how

2:15to guide to get started with some of the module searching

2:18and whatnot.

2:18Now here, I have on the screen the actual Rapid7 startup guide

2:23and other guides for Metasploit.

2:25And I would highly encourage to go through this

2:27and look up some of the different instances

2:30that we can run inside of Metasploit

2:32and more detailed documentation on what it's actually

2:35doing behind the scenes.

2:36And as we can see here that they have a basic demonstration

2:42of different phases of the investigation process

2:45that Metasploit can actually be used on.

2:47What we're taking a look at specifically are the modules.

2:50Now, this is further down, and I'm

2:52going to put the website below as well,

2:55too make sure that everybody at home that's playing along

2:58can actually go through and see what's actually in here.

3:01Now, because there are different modules

3:06that we can use inside of Metasploit,

3:08we can actually use the search command as well, too.

3:11And we're going to take a peek at one of these

3:14and see what they present for us as we do a search.

3:18So right here, we see that they're

3:20in msf-pro, which is a sub running system of Metasploit.

3:26And we're going to search for the exploits.

3:28Now to do that inside of our Kali Linux Metasploit,

3:32we're just going to stay in the regular MSF 6

3:34command prompt or terminal prompt and type

3:37in show exploits down here at the bottom.

3:39And we're going to hit Enter, and we

3:40can see that it comes up with a lot of different exploits.

3:43Now, the reason that these exploits come up

3:46and why we would use them is to align it

3:48with whatever vulnerabilities we find on a specific system.

3:51Now for instance, let's say that we scan

3:55a system later in this skill.

3:58And we see that we have the 2229 exploit/windows/smb/psexec.

4:05And this is the year and date that that vulnerability

4:10came out, Microsoft Windows Authenticated User Code

4:13Execution.

4:14And we would see that pop up in one of our vulnerability

4:16scanners and use that specific exploit

4:19to be able to create a reverse shell,

4:21go inside SMB for enumeration.

4:24So that's where Metasploit ties into all of our investigation

4:28and reconnaissance phases for the different incident handling

4:32process.

4:33Now, there are so many of these that we can't always

4:37keep a track of.

4:38See, there's many, many, many, many, many of them.

4:43And that's why it's always good to have

4:44a Notepad or a cheat sheet at home for different ones

4:48that we use.

4:49Don't be afraid to Google search or Metasploit

4:51search on the Rapid7 site for anything that we need.

4:54Now, the nuts and bolts of Metasploit

4:57there's msfvenom, which we've used a couple of times

5:00previously.

5:00But now, we're going to take a deeper look at how

5:02to get it ready and configure.

5:04Because msfvenom, in them allows us to be

5:06able to do a couple of things.

5:07But one in particular is create a Trojan Horse

5:10for a targeted system, whether it be maliciously or pen

5:14testing wise.

5:15But we're doing it pen testing because we're legal.

5:17And here on our desktop, I have a demonstration

5:19of how we are using msfvenom, to create the actual package

5:24that we'll go over to a targeted system.

5:26So I'm going to walk through this.

5:27I'm going to have it on the bottom of the screen as well.

5:30So we're using msfvenom-p.

5:32And this identifies which exploit or package or module

5:36that we're actually using inside of Venom to be

5:39able to create this package.

5:41And for this one, we're using Windows,

5:43which is under the main Windows group for 64-bit systems.

5:47And we're going to use the shell reverse TCP.

5:51And what this does is it creates a backdoor channel.

5:54Now, I've actually made a mistake in here.

5:55Let me fix this real quick.

5:57This is targeting that IP address right there

6:00for local host.

6:01It's supposed to be this system because it's reaching back

6:04to here.

6:05Now, the next port--

6:06the next one is port.

6:08And port we're going to do this communication on,

6:10and we're always going to default

6:12to 4444 because it's a default that's

6:16used in all documentation.

6:18And the -f indicates that we're going to create

6:21this as an executable.

6:23And it's Pacmanned out to a directory

6:26so that we know where the file is actually going.

6:29So we don't have to do a lot of hunting for it.

6:31Now I'm putting this on the desktop.

6:32Give me just a second to fix the actual IP address,

6:35and we'll create it.

6:36OK, so our IP address is fixed.

6:37We're going to hit Enter.

6:38And we can see that it's already starting

6:40to create an actual package.

6:42Now when this gets created, we can see that

6:45on the bottom of the desktop, not this one.

6:48There it is right there.

6:50I'm moving it right here.

6:51This is the shell x64 executable and if we right click on it

6:55and go to Properties, we can see that this is a DOS Windows

7:01executable file.

7:02And this is something that we would be able to execute here.

7:06And we can check this out by opening a terminal here

7:10on the desktop and doing an ls-la.

7:13And let's look around for it right here

7:16and see that is not listed as executable like the others

7:20because again, this is for a Windows system.

7:22Now we could make in here for POSIX based system.

7:28But once this file is opened up, we

7:31can actually create a listener on Metasploit

7:35and open up a backdoor channel through the reverse shell

7:39portion of this actual package.

7:41Now using VM tools, I was taking this file

7:44and moving it to my desktop to move it over

7:46to the actual server 22 VM host, and this popped up.

7:50And that's because this is noted as the package

7:53itself is made in Metasploit.

7:55So it's a known problem inside of third party applications

7:59such as Symantec.

8:01Now, this one in particular, we're

8:03just going to undo action taken and start our undo,

8:06and it's back in our folder so we can move it over.

8:08But I just wanted to point this out

8:10that when we do stuff like this, keep in mind

8:12that some of the packages that we build

8:14will be picked up by third party antivirus

8:16or antimalware applications.

8:19OK, so I've dragged that package over to the server 22,

8:22which we have open here on screen now.

8:24And you may notice that my folder is empty.

8:26Well, if I go into the command prompt and see what's actually

8:29in there, I can go into stuff and type in a dir

8:33and I can see that nothing is in there either.

8:35And that's because when the packages are made,

8:37they're usually made as default hidden.

8:39So we're going to go into View and view our hidden files

8:41and see boom, chakalaka, there it is.

8:45So what can we actually do with this?

8:47Well, do keep in mind that this may pop even the Windows

8:51basic security settings, and you may

8:53have to allow it for a demonstration purposes only.

8:56And simply, we just run it.

8:58We're going to run this as admin just for a minute,

9:00and we can see that there's our threat.

9:03We're going to go in and allow this on here.

9:05And we can see that it's, I don't

9:07know if you saw it right there, but it was a Trojan Horse.

9:11And I'm going to make sure that this actually

9:13runs in the background to fix this real quick.

9:17Yep, here we go.

9:18Allow on this device, and see if we can run it again.

9:22Now, if we open up our Task Manager,

9:24Control Shift Escape and go into Details, scroll down to the S,

9:29and see if we can see this actually running.

9:34Let me move this over just a little bit

9:36and run this again to see if we can get it to pop up.

9:39There it is right there, process ID 4680,

9:43and it closed real quick.

9:44And the reason that it closed is because we don't

9:46have our listener open on the actual Kali box so let's

9:49fix that.

9:49We have set up our Netcat listener on port

9:524444, which was how we built the msfvenom package,

9:56put the command below is usual.

9:58And as you can see, we already have it starting its listening

10:01process.

10:02So we're going to jump back over to the server 22 box

10:05and execute our executable that Venom made.

10:08OK, so we're here.

10:09We're going to right click Run as administrator

10:11just to kind of circumvent a bunch of stuff.

10:13And it's running in the background.

10:15Let's pop over to our Kali box real quick.

10:18And we do have a connection from that server.

10:20Now, in previous skills, we've already

10:23gone over how to exploit Netcat and get it

10:25to run from behind the scenes.

10:27So we're just doing a demonstration

10:29of how to get that msfvenom within a package over to a box

10:32easily and what it does behind the scenes.

10:35Now obviously, there's a lot more

10:36that goes into this as far as making that Trojan Horse

10:39and having them select it.

10:40And we've covered this already by how

10:42to use social engineering if you will,

10:46to go in and do some of this behind the scenes.

10:48So we've got to make it to where it's

10:50enticing on that particular box to go in and click on

10:54and to run behind the scenes but also to get it

10:56to where it avoids stuff like third party

10:59and even the Windows antivirus and anti-malware detection.

11:03There's all sorts of stuff that goes into this as far

11:05as staging an attack on a system,

11:08whether it be for malicious or pen testing purposes.

11:11Now, this can be done with many other packages

11:13and many other modules inside msfvenom.

11:16I just wanted to point out here that Venom

11:18is used to build those packages inside of Metasploit.

11:22So in the next few Nuggets, we're

11:23going to be covering other possibilities inside

11:26of Metasploit aside from just making that Venom package.

11:30I hope this has been informative for you,

11:32and I'd like to Thank you for viewing.

0:00[AUDIO LOGO]

0:05Throughout our skills together, we've seen Metasploit on Kali

0:08and used it a good bit.

0:09But what if we didn't want to use Kali only

0:12for our pen testing?

0:13And that's where we can put Metasploit on those

0:15Windows-based systems, or wherever else we want--

0:18let's say, like just in a basic Ubuntu box.

0:21Now, why would we do this?

0:22Well, as a pen tester, it comes down to comfort--

0:25comfortability-- comfort.

0:27It comes down to comfort because we are better with tools

0:31that we're more familiar with.

0:32Now, yes, we do need to learn other tools and other traits

0:35and trades, and stuff like that.

0:37But if we know we have something that works,

0:40why go away from it?

0:41And there are plenty of pen testers out there in the field

0:44right now that are using Metasploit and many other tools

0:47on Windows-based systems.

0:48There's a couple of behind-the-scenes technical

0:51reasons as well too, because as in previous skills,

0:54we've seen where we have to allow certain connections

0:57and protocols between Windows and POSIX-based systems,

1:02whereas if you know you're going into a Windows-heavy

1:04environment and they run Active Directory

1:07and they have all these file share servers that we've

1:09demonstrated before, that Windows box that's

1:12running stuff like Metasploit and other tools

1:14like Netcat, which we've done in the past,

1:17is a whole lot better in that environment

1:19because that's stuff that we don't have to reconfigure

1:22or work around on that network infrastructure overall.

1:26And so in this Nugget, we're going

1:27to be taking a look at how to put Metasploit

1:29on an actual Windows-based system

1:32and take a look at some of the commands needed to put it

1:34on an Ubuntu box as well too.

1:37And kind of get a familiar feeling

1:39on how to do all this behind the scenes

1:43so that way if we're out in the field,

1:45we can have a copy of it.

1:46Or if we're staging new boxes, we

1:49can prep some for the field use as well.

1:51Back to picking on our Windows Server

1:5322 VM since we've already messed it up beyond recognition.

1:56So we go to the metasploit.com/download page.

2:00And I'm going to link it right below here.

2:01And if we click on Download, it'll take us to a page

2:05where all the wikis are and documentation

2:07that we've seen before too.

2:09And we can go to the-- it sends us to a document link.

2:12Now, scroll down just a little bit,

2:13and you'll see right here, Installing Metasploit

2:17on Windows.

2:17And that is the direct link to download the executable

2:20and package.

2:21I believe it's MSI here for Metasploit.

2:24And we can see that it's downloading.

2:26It's roughly 267 megs.

2:29And we're going to open it in folder.

2:31Now, at the snap of the fingers, this download

2:33is going to be done, and we're going to start installing.

2:36Wouldn't you know it, just like that, it finished.

2:38So let's go ahead and right-click.

2:40Go Install.

2:41Now, this may ask for admin rights on your specific system.

2:45That depends on how it's set up.

2:46But here I have that turned off under the User Access Control.

2:51We're going to hit Next.

2:52And we accept the terms.

2:56We're going to install it in a specific folder.

2:59We're going to call it metasploit,

3:02if I could spell it correctly, because by default, it

3:04wants to go to C drive.

3:05And we don't want to install the whole package there.

3:08It becomes a mess, and it also accesses some other problems

3:11too.

3:14And other than that, we just hit Install.

3:16And by the time this is finished,

3:17we'll take a look at what's actually

3:19going on inside of that folder and behind the scenes.

3:22And it's finished.

3:23So let's go ahead and close that.

3:24And then go to our C drive install folder of Metasploit.

3:29And make sure that we have everything there.

3:31And we do.

3:32Now, this is going to be a little bit

3:34weird because in Kali and POSIX-based systems,

3:37we can just go to our terminal and just say, sudo metasploit,

3:41or hit it in the Start menu.

3:43But we could see here that we have

3:45many different things that we run inside of this folder.

3:49So let's go ahead and open up our Command Prompt.

3:51Now, it would appear that I totally forgot that Ruby is

3:53required to run in the background whenever we have

3:56Kali-- or excuse me, Metasploit on a Windows-based system,

3:59because as you can see here, there's a lot of .RB files that

4:03Metasploit's running, or is required to run.

4:06And Ruby is the actual background

4:08databasing and coding program that this was built off of.

4:13So we went over to our Downloads page,

4:16and we installed Ruby in the background.

4:18And we're going to restart Metasploit.

4:20Now, I'm going to put this link right here that we have

4:22on the screen below as well.

4:24So that way, not only can you find Metasploit package

4:28for Windows, but you can also find the Ruby installer

4:30for Windows-based systems as well too.

4:32And they do make it for 64- and 86-type processors.

4:37Now, we've cleared off our Command Prompt.

4:39So that way, we don't have all that mess back on there.

4:41And we're going to restart our msfconsole.bat

4:45in the console itself, after we've installed Ruby.

4:49Now, Metasploit has started because this time

4:51we have a cow.

4:51But as you saw in the bottom right-hand corner,

4:53Windows popped up with a security error.

4:56Now, we're going to see if we could take a look at that

4:58because, natively, Metasploit does trigger some

5:02of the stuff that's on Windows and other third-party

5:04applications, like Symantec, which we've seen before.

5:07Why does it do that?

5:09Well, because we use tools like MSFvenom

5:11to build those packages.

5:12And the core programming of those packages

5:15is built inside of Metasploit, along with a bunch

5:17of other tools.

5:18So it will pop on the security systems

5:20and other third-party apps as well too.

5:24That's why whenever we go out and do some of our pen testing,

5:27we have to do it on a system that is either

5:29configured to allow these programs to run or do it

5:33on a system that doesn't have any kind

5:35of third-party or native antivirus

5:38or antimalware software on there at all.

5:41And just like that, we have our MSF 6 console for Metasploit,

5:46just like we do in our Kali system.

5:48And it pretty much ran the same as it is from here, because we

5:52can go in and type use.

5:55I think it's question mark?

5:56Yes.

5:57So instead of the --help or tabbing over and getting

6:00all the other possibilities on there, inside of Windows,

6:04you could use a question mark.

6:06And it gives us all the different uses

6:08that we can have.

6:09We see exploits.

6:10We see post.

6:11It's 99% the same as what we have inside of the Kali

6:16version of Metasploit.

6:17Natively, inside of our Ubuntu box,

6:20we don't really have anything to get Metasploit

6:24except by the way we did on Windows.

6:26Now, we could easily open up our browser

6:29and go to the Download Metasploit page.

6:32Go into the documents, and go straight

6:35to the Linux manual installation,

6:37which is right above the Windows portion.

6:40And it takes us to a directory tree, where

6:42all the individual files are.

6:44And we could do a manual install.

6:46But we can actually cheat just a little bit.

6:48And to do so, we have our terminal opened up here.

6:51And we're going to be taking a look

6:53at our /etc/apt/sources.list.

6:55And I'm going to put that right below here.

6:58The reason we're going to go in in gedit

6:59it and take a look at it is because this

7:02is where we point the POSIX-based systems

7:05to an update repository.

7:07Now, there's a lot of commented-out sections,

7:09like with the pound signs here.

7:12But we can see, like on line 26 of this one

7:15that I have highlighted, this is not commented out.

7:18And this tells Ubuntu to use the us.archive.ubuntu.com/ubuntu

7:25for local multiverse, blah, blah, blah-- basically,

7:28where to get its update from.

7:30So when we do an apt-get or apt install, apt upgrade,

7:33apt update, and et cetera, et cetera,

7:35this is where it's pointing to, to do that.

7:38Now, at the bottom here, I've added this line.

7:41And this is the line that we have inside of our Kali

7:45versions that we have out now.

7:47This is one of the repositories that we

7:49have to point to be able to apt whatever

7:53we want that's inside of Kali.

7:55Now, I'm putting this here.

7:57So that way, when we do an apt upgrade, apt update, and all

8:00that other great stuff, we could use

8:02it to get Metasploit inside of our terminal window

8:04without having to install all those ridiculous files.

8:07So very easily, we're going to type in sudo apt install--

8:12if I could spell correctly today--

8:14metasploit-framework.

8:17And again, this will be on the bottom of the screen.

8:19And it's going to go through reading its packages from all

8:21the lists that are in there.

8:23And I might actually have to restart.

8:25My mistake was that I just forgot to do an apt-get update.

8:27So we're going to run that real quick.

8:29Let's go in here and work it.

8:31Now, if you get this error, this is a certificate error coming

8:34from Kali to an Ubuntu box.

8:36We're simply going to bypass that here,

8:38instead of going through and getting the keys and all

8:41that great stuff, because we can remove the apt-get site out

8:44of our gedit later.

8:47We're just going to allow insecure repositories

8:50on the apt-get update.

8:51And I'll put this command below as well too.

8:53We type that in.

8:54And we can see that Kali is starting

8:56to roll the updates for this particular system as well.

8:59Now, once this completes and we get the apt-get update,

9:03the repository is built on the local system.

9:06So we can add in sudo apt-- or install Metasploit framework,

9:10which we'll do here shortly.

9:12And after the repository has been built from the Kali site,

9:14we're just going to type in sudo apt install

9:17metasploit-framework with a dash in there.

9:20And we can see that it comes up with all the requirements

9:22that it needs, because there's a lot of stuff that

9:24runs in the background for Metasploit overall.

9:27Now, we're going to do the default yes on this

9:29because this will install all the background requirements

9:32along with Metasploit itself.

9:34So let's go ahead and hit Enter.

9:37And install these packages without verification?

9:39And for the purpose of this one, yes, because this only

9:42pops up if we're allowing an insecure repository

9:45like we are here.

9:46See, remember, we bypassed the actual key retrieval

9:49when we added this inside of our sources.list.

9:52So we're going to hit yes here.

9:54And it's going to go through and start

9:55doing a lot of downloading.

9:57And again, at the snap of the fingers,

9:59we'll be at the end of this.

10:001, 2, 3.

10:03Once it's all done, we'll get the obligatory-- or mandatory

10:07restart on the system.

10:08And yes, we're going to restart all the services

10:11and everything.

10:12And display manager must be restarted manually.

10:16So again, this is just requiring a bunch of restarts.

10:20Good practice is that once we have all this installed

10:23on the actual system--

10:24and this has actually just started the installing.

10:27It was doing the downloading first.

10:30But we restart after all this is done.

10:32And that's what we will do.

10:34It'll just be done off screen.

10:36So when all this is done, we'll have come back from a restart.

10:38And we're rebooting our Ubuntu box

10:40that we set up with the Kali stuff,

10:42mostly for the Metasploit.

10:44And if we notice that Ubuntu has turned basically

10:48into Kali at this point.

10:49And we could say here by the Kali GNU/Linux Rolling

10:53ubuntu logon prompt.

10:55It still says ubuntu login, but it is a Kali box.

10:58At the end of the day, installing Metasploit

11:00on any operating system is possible.

11:04You've got to work around some plugs here and there

11:07and make sure some add-ins and plug-ins are

11:09installed, and stuff like that.

11:10But we can install Metasploit and use it on just

11:13about any operating system.

11:15Now, in the next Nugget, we're going

11:16to go over and review how to prep a target for Metasploit

11:19to attack.

11:20I hope this has been informative for you,

11:22and I'd like to thank you for viewing.

0:00[AUDIO LOGO]

0:06We're ready to use Metasploit on a system,

0:08and we've seen there are many options to use.

0:10But how do we know which ones are the best?

0:12Well, we have a couple of options

0:13that we can do here because we have other tools and resources

0:16that we're capable of using to identify a target,

0:20figure out what vulnerability there is,

0:22and select the actual course of attack

0:25that we want to proceed with.

0:27Now, scanning comes first.

0:29And we can do scanning inside of Metasploit.

0:31And we can use other programs out there

0:33that are third party, like Nessus, to figure out

0:35if there are vulnerabilities on a specific system

0:38that we can leverage against that fall

0:40within that exploit category of Metasploit.

0:43And within our Metasploit inside the Kali box,

0:46we have our Server 22 virtual machine running also

0:50on the side.

0:51We'll come back to that in a second.

0:52But we're going to be using Metasploit

0:54to do a port scan on that particular system, which

0:57is something that we normally do inside of in Nmap and Zenmap.

1:00We'll come back to that in a second.

1:02Now, there may be a couple of bad cuts

1:04here because I can't really tab while I'm inside

1:07of VM and Metasploit.

1:08So I am going to put the commands

1:10on the bottom of the screen.

1:11And right now, we're going to use

1:12auxiliary/scanner/portscan/tcp.

1:16And this is a built-in scanner inside of Metasploit

1:19that we can use to gather just a little bit of information.

1:22So as with most uses and exploits and auxiliaries

1:28that we have inside of Metasploit,

1:29we have to set the host and the ports.

1:32And in this case, it's going to be remote host.

1:34So we're going to set RHOSTS to--

1:41capital S. Ah, terrible at typing today.

1:44192.168.247.130.

1:47And then we're going to set our PORTS to whatever ports

1:52that we want to scan to see if they're

1:53open on that particular system.

1:55Now, we can scan multiple systems using this.

1:58But we're only selecting one system right now.

2:01It makes it a bit easier on us when we're looking

2:03at the results for a second.

2:04Now, we're going to scan 80 and 443, just out of curiosity,

2:09because we also know from doing previous skills together

2:12that Server 22 box on the VM is also an IIS

2:17and does some other stuff as well too.

2:20It does everything at this point.

2:21But we're going to run, and we're going to type -vv so we

2:25get verbose--

2:26verberose-- get more information when we do the run command.

2:30And when we do that, we can see that 443 didn't come back.

2:34But on this line right here, 80 is open.

2:38Now, if we wanted to get more information other than this,

2:41we would definitely do a Nmap or Zenmap.

2:44And we're going to check that in just a second

2:46to see if it correlates with what we have here.

2:49But we can also do a set ports to, let's say, 1 to 1000.

2:57My bad.

2:58And then, run -vv.

3:01And it will scan all the ports going from 1 to 1000

3:04to see what's actually open and put it in an output for us

3:08right here.

3:09Now, right off the bat, it says 80 is open.

3:11And it's going to go through the other ones

3:13until it reaches 1000.

3:14Now, while this is ongoing, let's go ahead and open up

3:18our Zenmap.

3:19And we can see here that 135, 139.

3:22Now, those are good to know if we're

3:24knowledgeable on our standardized ports and even

3:26some of our nonstandards, because we

3:28know that that's the tip-off for a Windows system.

3:31But we can use Zenmap to correlate information

3:34from Metasploit to make sure that not only are they open,

3:37but we're actually getting the system that we want.

3:41247.130.

3:43And we're just going to do a quick scan on this system

3:46because we're making this demonstration pretty quick.

3:51And we can see here that port 80 is open on that target,

3:55as it is in the Metasploit scan.

3:57But in Zenmap--

3:59Nmap-- it tells us that it's HTTP.

4:02So we know that it's actually being used

4:04for what it's standardized for.

4:07If we're doing a sandbox or a honeypot,

4:10if we're trying to elude somebody, if you will,

4:13then that may or may not be what it's for.

4:16We could set port 80 for FTP.

4:19But this is what we have here.

4:21We have that one quick scan done.

4:24And those should be the only four ports open.

4:27And when it reaches 1000 on the Metasploit side,

4:29it'll come back and say, that's it.

4:31And just like that, at the bottom,

4:33we have "Scanned 1 of 1 hosts complete."

4:35And the four ports that popped up inside of Metasploit, as far

4:39as what's open, were the same ones that popped up inside

4:42of Nmap/Zenmap.

4:44So we know that Metasploit, if that's all that we have,

4:46can be used as a port scanner along with a vulnerability

4:50exploiter.

4:51And there are many other uses.

4:53We're just tapping on some of the ones that

4:54need to be addressed.

4:55Now, we also know that we can use programs like Nessus, which

4:58we've done in previous skills.

5:00And I would encourage to go back and watch those

5:02because I don't want to rehash something

5:04that we went way in-depth on.

5:06Nessus basically told us, on a particular system or systems,

5:10what the vulnerabilities were, based on the definitions

5:13that we had loaded up.

5:14So if we worked inside of DoD, we

5:16could use certain predefined definitions coming from DISA.

5:19Or if we worked on the outside, we

5:21can use definitions that came from OVA?

5:26SCAPs, that's what I meant to say.

5:27I totally was spelling it out S-C-A-P and totally didn't goof

5:32up there, because SCAPs is built off of stuff like IAVA reports

5:36that are predefined definitions that know what to go

5:39in and scan against on that particular system.

5:43Now, when those reports come back,

5:44that's where we start using Metasploit,

5:46like we have in previous skills and Nuggets,

5:48to go through and use that proper exploitation that aligns

5:52with that vulnerability to do stuff like reverse TCP shells,

5:56or DetCat, or however we want to do it.

6:00Now, we could do it through reverse shells,

6:02or we can do it through Trojan horses,

6:04like hiding the exploit inside of a file

6:08and letting them open up on a system.

6:09Or we can do what we did a couple of skills ago

6:12and start hiding it in some macros

6:13to where they download it, and they never know it.

6:15Now, in the next Nugget, we're actually

6:16going to get into some of the other tools

6:18that Metasploit has.

6:19We've touched on them in the past.

6:20But we want to make sure that we have a good understanding

6:23that they do come with Metasploit,

6:24because as we upgraded our Ubuntu system

6:27and accidentally morphed it into a Kali box,

6:29these are the tools that we're going to have on there that

6:32allow us to be able to go through and do some

6:34of the exploits that we're asking about.

6:36I hope this has been informative for you,

6:38and I'd like to thank you for viewing.

0:00[MUSIC PLAYING]

0:06We understand the basics of Metasploit,

0:08but let's compare the whole package to a base install.

0:12I want to sit here and crack a password inside of our server

0:1522.

0:16And I know that we have Metasploit

0:18installed on the actual system.

0:20Now, we have to open this through--

0:22its inside of our bin folder that we installed this on.

0:26So let's go inside of our command

0:27prompt and make our way over there.

0:30And see if we can do so.

0:31So CD, desktop--

0:35CD, Metasploit-- oh, wait.

0:38My bad.

0:39CD, C drive, Metasploit slash bin.

0:46And we're going to open up the MSF console--

0:49dot bat.

0:52Now, while this loads up, we can already see in here

0:54that these are the different programs that

0:56come with Metasploit when it's installed

0:57on a non native system like Kali.

1:00Now, I say, non native.

1:02Metasploit is its own program, but it's integrated into Kali

1:05with all the bells and whistles that come with it as well too.

1:08So inside of here, just looking at the directory,

1:11we can see that there's already a bunch of stuff that

1:13we're missing, because we can go back over--

1:15while this is loading on here--

1:19and already know that our port scan is one of the tools

1:23that we can use inside of Metasploit.

1:25Well, we have a PE scan, but that's for processes.

1:31And RPC, RPCD-- but there's not a lot of stuff in here.

1:36Metasploit, on its own, is a standalone,

1:38does not include stuff like John the Ripper, Hashcat, Netcat.

1:45The scanning utility that we had on here.

1:49And that's because it's only been used as an exploit tool

1:52right out the gate.

1:53That's all there is.

1:54So it's assumed that if you're installing Metasploit

1:57on a particular system, let's say like Windows that we did,

2:00then for sure that you're going to be using it only

2:03for that attack method.

2:04And you've already done all your reconnaissance work

2:07to make sure that everything's vulnerable like we did here

2:10in the previous Nugget.

2:11Now, we have started up our Metasploit console

2:14inside of Windows.

2:15It opened up fully and already ran commands

2:16because, like a goof, I would just talk to a camera

2:19and didn't have it recording for a little bit.

2:21Ha-ha.

2:22So we're going to do a platform search, which I already did.

2:26And we use search platform colon windows.

2:29And we hit Enter.

2:30And we have 2,257 different things

2:34that we can do to a Windows platform.

2:37Now, not all of these are exploits.

2:39Some of these are payloads.

2:40Some of these are shell codes.

2:42Some of these are different ways to actually go in

2:46and mess with the Windows box because we

2:48can use this in conjunction with reverse TCP, bind TCP, blah,

2:53blah, blah, blah.

2:53Now, even though there's a lot of them in here,

2:56the difference between this and what

2:57we have on an actual Kali box can be significantly different.

3:02As we go down here, we have 260--

3:052260, which is there's a few more on our Kali box.

3:11And that's because we have tools that are natively

3:14installed inside of Kellie that come with Metasploit

3:17in that natural environment.

3:19Remember, when we're installing Metasploit

3:21on a non native system like Windows,

3:23we only get the core infrastructure.

3:25And we're assuming that all of the reconnaissance and detailed

3:29work that went into finding the vulnerabilities

3:32has already been done.

3:33Now, when it comes to actually cracking

3:35passwords inside of our Windows environment

3:38here, using Metasploit, that's not really possible.

3:40And we have other programs like [INAUDIBLE]

3:42John the Ripper for Windows, et cetera, et cetera.

3:45And we go back into Kali.

3:47And we can see that not only when Metasploit is installed,

3:49we also have tools like John installed.

3:52John the Ripper.

3:53These all come in the background of Metasploit

3:56for that Kali Linux environment because it

3:58was packaged as such.

4:00And I do want to point this site back out again.

4:02It's the docs.rapid7.com site where

4:06we have all the documentation for Metasploit.

4:08And again, highly encouraged that we

4:10go review it at some point.

4:12But this is just the big idea of basic commands and et cetera,

4:16et cetera.

4:17Because you could do here like show exploits.

4:19And there are other tools and tricks

4:21that we could use inside of Metasploit

4:23for Kali that don't necessarily pop up inside of Windows.

4:28And for instance, there's a lot of reporting that can

4:31be done inside of Metasploit.

4:33This is the GUI format for Windows

4:36that you have to install on top of what

4:38we have inside of Windows.

4:39So let's go back and take a look at our Windows VM for a second.

4:44The only thing that we got inside

4:46of our Metasploit for Windows--

4:48when we downloaded it-- were all these command line

4:50features that we go in and basically run it

4:53like we're in a Linux box or Kali box.

4:56There are other things that we can install on top of this.

4:59Specifically, inside of Windows like that GUI.

5:02But these are different downloads

5:03that we constantly have to keep obtaining for this one system

5:08in order for it to make sense and work together.

5:11Now, that's why using Kali in its native environment

5:15or Metasploit in its native environment for Kali,

5:18there may not be a GUI, but everything's already

5:21installed in itself.

5:22And it's prebuilt to support all the tools

5:24that Kali has to offer.

5:25Now, in the next Nugget, we're going

5:27to take a look at some of the other options

5:29out there outside of that regular Kali framework that has

5:33Metasploit integrated into it.

5:35So that way, if we run across a situation or a system

5:39to where we don't have everything

5:41right there in front of us, we, kind of,

5:43know how to work around it.

5:44I hope this has been informative for you.

5:46And I'd like to thank you for viewing.

0:00[AUDIO LOGO]

0:06Metasploit has a lot of bells and whistles,

0:08but are there other options out there for us?

0:12And the answer to that would be yes,

0:14because we've seen in previous skills and Nuggets

0:17that there are many tools that we can put together

0:19to make up for the lack of Metasploit

0:22on a particular system.

0:23Now, why wouldn't we be able to use Metasploit?

0:26There could be a couple of reasons.

0:27Let's say that our pen testing group inside

0:30of our organization, the CIO, the CISO, or whoever

0:34the actual network owner is, has said, don't use Metasploit,

0:37for whatever reason.

0:38It's not for us to argue.

0:40It's just for us to nod our heads up and down and smile.

0:43But that also means that we have to find

0:45other ways to work around the fact

0:46that we can't use Metasploit.

0:48And if you think I'm stretching the truth there a little bit,

0:52inside the DoD, Metasploit is very frowned upon.

0:55And we do have to use other stuff besides that.

0:58And that's where stuff like John the Ripper comes in.

1:01But if we're on a Windows box and can't actually

1:04employ John the Ripper inside of Metasploit,

1:06we use programs like Hash Suite, which I'm pulling up

1:09here on the screen now.

1:10And we've seen this--

1:12sorry, let me get my double vision, inception out of there.

1:15And we've seen this many times and used it before.

1:19And this is also a kind of a Hashcat or a hash identifier

1:23method as well too, because we can

1:26start using this to identify where the hashes come from

1:30is whether they're NTLM or LM hash, et cetera, et cetera.

1:34Now, there are other tools also.

1:35We're back at our Windows Server 22 VM.

1:38And we have enum, which we've used before to tell us what

1:42other systems out there that we can enumerate

1:44from inside of that workgroup or Active Directory environment.

1:48We can enumerate the users.

1:49We can enumerate the groups.

1:51We can enumerate a lot of information about that domain

1:54and tell-- or even a workstation--

1:56and tell us what it is that we're

1:58looking for that we need to start exploiting, because let's

2:02say that we do have Metasploit installed on a Windows box

2:05and we are allowed to use it.

2:07We can correlate some of the information

2:09that we gain inside of the Hash Suite or inside the enum tools,

2:15and go in and start looking at what's allowed

2:18in here as far as our exploits.

2:21We can do a search and see if there's anything that lines up.

2:24Now, there's also some other stuff too,

2:26as we've seen in here, that we can do--

2:29or in the Kali side-- that we can actually

2:31do a minimized port scan to see what's going on.

2:35And of course, you can come down and open up our Zenmap.

2:39I don't know why it opened up back there.

2:41Let me grab that real quick.

2:43I'm going to grab that and bring it over here.

2:45Come on.

2:46And we can see that this is our native Nmap for here locally.

2:52It's the same information that we get inside of Nmap.

2:54But Nmap does come in the background

2:56of Kali and Metasploit in that native environment.

3:00Now, on the Windows systems, do we have it?

3:01No.

3:02And we can probably find a way to have Metasploit do

3:06that wonky little scan for us.

3:08But in here, we've seen many times--

3:11and I'm not going to stick around for the results

3:13of this--

3:14that we can go through here and get all the detailed stuff,

3:17even OS fingerprinting to give us

3:18more information, which again, aligns

3:21with what we can do inside of Metasploit,

3:23when it concerns picking the vulnerability or exploit.

3:27Now, lastly, we're going to be touching on the last one

3:31that we used.

3:31And I think it's inside of tools.

3:34I sent it to the recycling bin because we were done with it.

3:37And I already deleted it.

3:38But Netcat.

3:39We've used Netcat a few times.

3:40And in the Metasploit world, this

3:43is usually referred to as reverse shell or reverse TCP,

3:46where we can send the command prompt

3:48through the reverse shell to the actual Metasploit

3:52machine that's handling it.

3:53And we can go from Metasploit to a box like this

3:56and actually pull up commands, which we've done,

3:59inside of the Command Prompt with root access.

4:02And this is something that we could

4:04use to circumvent Metasploit if we're not

4:07allowed to use it on a system.

4:08We just have to find a way for them

4:10to be able to put Netcat on their system.

4:12Now, we've gone over those nefarious ways to do it.

4:15But for those of us old enough to remember stuff

4:18like Dameware, it's not that hard,

4:20because you just tell the person that it helps them

4:23in their computing world.

4:24And magically, they do it and get infected.

4:26The point of the story is that there's more than one

4:29way to skin this cat.

4:30And Metasploit is not the only way to do it.

4:33Metasploit just happens to be a commonly used tool inside

4:36of the pen testing world.

4:37And the reason that we cover it so much

4:39and different aspects of it-- like, in this skill,

4:41we're really getting under the hood in how to use it

4:44and what we could use if we don't have it.

4:46And in the previous course, we just got into--

4:48this is it.

4:49This is Metasploit installed on Kali.

4:52And we're doing all that because if there were a certification

4:55exam covering this skill or course,

4:58it may ask a few Metasploit questions that I am 100% sure

5:03we covered all of that content up until now

5:06and in the upcoming skills.

5:08But it's always good to know that Metasploit is there

5:11for a pen tester and the baddies,

5:14if they want to use it.

5:15But we know how they work it.

5:17So we can block against it.

5:19That wraps up this skill for Metasploit.

5:21I hope this has been informative for you,

5:23and I'd like to thank you for viewing.