Instructor: Welcome back.
Let us talk about Metasploit Framework.
We already mentioned that we will use this tool a lot to
exploit different targets and their vulnerabilities,
but there are a few things we need to learn first about it
before we get to use it.
Remember when I told you
that Metasploit Framework offers us thousands of exploits
that we can use for Windows, MacOS or Linux?
While that is true,
Metasploit offers us a whole lot more things
that we can use besides the exploits.
Matter of fact, exploits are just one of seven modules
that we can get with Metasploit.
Besides them, we also get payloads, auxiliary modules,
encoders, evasion modules, nops,
and post exploitation modules.
If you're new to all of this,
you probably have no idea what each of them are.
Don't worry. We will explain it right now.
First, to navigate to the Metasploit Framework directory,
we can type cd/usr/share
and then metasploit-framework.
You can just type meta and then tab it out to complete it.
If I press here enter, and if I type ls right here
in the Metasploit Framework directory,
we are going to see quite a few things.
One of the most important things right here
is this msfconsole, and this is an executable file.
This is our program.
If we wanted to run Metasploit,
we will just type msfconsole in the terminal,
and it will open the Metasploit Framework.
The msfvenom is also very important.
This is a tool that we will use to generate a payload
or a shell that we use to control the target machine with.
But for this video,
what we want to explain is this modules directory.
If we change to that directory so cd modules,
and I type ls here,
we will see those seven modules that I mentioned.
Let's talk about each one of them a little bit.
We're already familiar with exploits, right?
Let's go to that directory first.
So cd exploits, and just to remind ourselves
that an exploit module or program executes a sequence
of commands to target a specific vulnerability
in a system or application.
It takes advantage of that vulnerability
in order to provide us an access to that machine.
There are few different types of exploits such as,
for example, buffer overflow, code injection,
web application exploits,
but what is also important to mention right here
regarding Metasploit is that once we type ls inside
of this exploits directory,
you will see these exploits are split into different groups.
We've got Windows exploits,
OSX exploits,
Linux exploits, Firefox exploits, and many others as well.
And if we go to any of them, for example,
let's go to Windows exploits,
and I type ls right here,
we will get even more division of exploits.
All of the Windows exploits that we have are divided
into bunch of other submodules such as FTP, firewall,
SMTP, SMB, and others.
And all of them contain exploits for those specific things.
If we navigate to, for example,
HTTP Windows exploits, so let's go there.
And I clear the screen, type ls right here.
We will see there is a lot of them for the HTTP,
and this dot rb that all of these files have
is just an extension for Ruby language.
All of the exploits in Metasploit Framework
are coded inside of a Ruby language.
And each one of these programs right here
exploits a different vulnerability.
If you were, for example,
interested in how some of these work,
you could open the code of an exploit using nano editor.
Let's see, for example, this one.
If I nano it,
it will open the code of this exploit.
And if you know Ruby language,
you could figure out how this exploit works, right?
It also gives us a description right here.
So this exploits a stack buffer overflow
in the Webster HTTP server.
The server and source code was released within an article
from the Microsoft System Journal in February 1996,
titled, "Write a Simple HTTP."
So this is an old, old exploit,
but you can do this for any file that you want.
You can just open it and see the code
of that specific exploit,
and that's how they're stored in cal Linux.
Let's also mention other modules that exist besides these.
So if I go back to the modules directory,
And type ls, let's next talk about the auxiliary modules.
So if we change directory to auxiliary,
and I type ls right here,
then we will see that auxiliary modules are also split
into different categories as we can see right here.
And an auxiliary module does not execute a payload
like an exploit module does.
It is used to perform different actions,
such as scanning, fuzzing, or denial of service attacks.
These modules can sometimes be used in first two stages
of penetration test, as there is a lot of them
that perform fingerprinting and vulnerability scanning.
If we go to one of these submodules, for example,
let's go to sniffer submodule.
If I type cd sniffer,
type ls,
well it seems that there is only one sniffer
in Metasploit, and we can see again, it is also coded
in Ruby language because of the dot rb extension.
If we go to a different auxiliary submodule, for example,
let's go to this one, which is spoofing.
So let's go to these spoofers.
Clear the screen. Type ls.
We can see they're also divided into even more submodules
based on what it is spoofing.
So it can spoof ARP requests, it can spoof DNS,
it can spoof mDNS, and others as well.
And all of these spoofers we can use
for our attacks if we need to.
Good. Those are the auxiliary modules.
Now you can always explore others as well if you want
to check out what different files this module has,
but we are going to continue, and we are going
to cover the next module from the Metasploit framework
which is the post exploitation module.
And if we change directory to the post exploitation module,
clear the screen, and type ls.
This module is used as its name says,
after exploiting the target. Usually they're used to gather
or steal information from target's device.
That information could be files, saved passwords,
dumping hashes, and numerating other services
and applications on the target,
and many other things we can do
with post exploitation modules.
After you type ls, you will see that they're mostly
displayed the same as the exploits.
If we go to Windows post exploitation modules,
and type ls right here,
we will see different post exploitation submodules
that have different purposes, such as gathering information,
such as escalating privileges.
And this escalating privileges simply means
if we exploit target as a regular user on that machine,
we would always want to try to escalate our privilege
to become an administrator or a root account.
We can also see WLAN post exploitation modules,
and I believe this would be used
to steal saved wireless passwords to the access points
that the target was connected to.
Okay. You can explore the others as well if you want to,
and let's talk about the others as well.
So we can go through all of them real fast,
so you can get a pretty good understanding
of what all of these modules do.
And the next one that we will talk about
is also really important, and that is payloads.
If I change directory to payloads,
clear the screen, and type ls.
And hopefully you remember
that payload is something we deliver to the target
with an exploit in order to control that machine.
And in this payloads directory,
we can see it is split in three different subdirectories,
singles, stagers, and stages.
What does this even mean?
Well, singles are payloads that are completely standalone.
A single payload can be something as simple as adding a user
to the target system or running some other application.
Stagers set up a network connection between the attacker
and victim, and are designed to be small and reliable.
And lastly, stages are payload components
that are downloaded by stagers modules.
These payload stages can provide us with advanced features
with no size limits, such as, for example,
different command shells or meterpreter shells.
And meterpreter is something that we mentioned
for the first time.
Meterpreter shell is also something that we will use a lot.
It is similar to the command shell
but with bunch of other options as well.
Besides executing commands, we can download files,
upload files, record microphone conversation, run webcams
on target machine, take screenshots of their desktop,
and many other things we can do with the meterpreter.
So once we are exploiting a target,
meterpreter is usually what we want to run
on the target after an exploit.
If I go to stagers directory right here
so cd stagers,
clear the screen, type ls,
and if I for example, go to Window stagers, type ls.
Here we can see different ways of establishing connection.
Remember when we talked about two different types
of shells in the last video?
Well, here they are.
Here we can establish a connection
either by binding to a port or by listening
and creating a reverse shell connection.
They are further divided into, for example,
reverse HTTP,
reverse UDP,
and reverse TCP.
And out all of these that we have right here,
we will almost always use reverse TCP.
So for now, we know that two main things we will combine
in a payload is reverse TCP connection
and a meterpreter shell,
because that two combined give us much more options
to do with the target.
Okay, great.
Now, if you don't understand some of this, don't worry.
Once again, this is something that you will fully understand
once we get into the practical examples.
For now, we are left to explain three more modules,
and we are going to go quickly through them
since they're less important than the ones
that we already covered.
And those are the evasion modules, encoders, and nops.
Now, let's go with encoders first.
Encoders are something that helps us
to evade antivirus detection.
How exactly?
Well, even though we call our payload the shell
or meterpreter, what it is to antiviruses and other people,
it is just a simple malware or Trojan or a virus.
That's why with the help of encoders,
we can encode our payload and make it less detectable
by some antivirus vendors.
These are not that useful anymore
since they are known to almost all antiviruses.
They can, however, help us bypass some of them.
And evasion modules do pretty much the same thing.
And if I change directory to them, so cd evasion,
you will see that they're evasion modules only
for Windows, and they're used to bypass Windows Defender.
If I change my directory right here, type ls,
we will see different Windows Defender files that we use
in order to bypass the Windows Defender.
However, since Windows Defender recently got an update,
I believe many of these don't work anymore.
But don't worry, we will see later in the course
different techniques that we can use
to bypass antiviruses and execute our payload.
And the last thing that we got are nops.
Nops can be a little bit hard to understand.
What a nop is is an instruction for the processor
to do nothing.
Once a processor reads a nop instruction,
it does absolutely nothing, and I know what you're thinking.
What is the purpose of this for us?
Well, these nops are useful
in buffer overflows to allocate a lot
of space in memory before the payload executes.
By the way, nop stands for no operations,
and if you have programmed in Assembly before,
you will be familiar with this.
But don't worry for now, nops are not that important for us.
Okay. That was a lot to take for one single video,
but all of this will be more clear
once we start exploiting our target,
and trust me, we are really close to that.
We just need to explain the usage of Metasploit
in the next video real quick.
And after it, we will perform our first exploits.
So get ready, and I'll see you in the next video.