Welcome to part one of this module.
In this section we're going to be studying the a split framework which comes pre installed in Cali Linux
as well as Armitage which is a graphical front end for metal split because of the complexity of these
applications.
This module will focus exclusively on them and will be divided up into several different videos starting
with a basic introduction and explanation of what Metis split actually is.
Will I normally try to keep each individual application confined to a standalone video that really isn't
possible in the case of met a split.
So it is recommended that you follow the videos presented in this module in order and if you have been
following all of these videos in order one after another you may have just arrived from the section
covering Wi-Fi hacking and radio based attacks.
If so I'll mention that it is perfectly okay to use a virtual box installation of Kali for this module.
In fact most if not all of the demonstrations will be done in virtual box.
However please keep in mind that virtual box is significantly slower than a fully installed version
of Kali or just running it off a USP with persistence.
There are a few things we can do to make met a split run a little faster but if you choose to use virtual
box please keep in mind the need for patience.
I also need to open by saying that once again we will be using the metal split able to virtual system
as the target for all of our attacks using Metis Floyd for more detailed instructions on how to set
up such a virtual system.
Please refer back to the first module which covers setting up the lab and because I'm required to say
this I must once again remind you to never use this or any other tool seen in any of these demonstrations
in any sort of unlawful manner.
Never use them against a system that you do not personally own or have written permission from the owner
to penetration test.
All right so what is met a split met a split is the leading exploitation framework.
It is used by nearly every Penetration Tester an ethical hacker out there.
It was developed by a group called rapid 7 a company that owns a lot of different vulnerability scanners
and it is well worth looking them up when you have a little free time Metis Floyd is basically the premier
tool kit that hackers use to hack systems and no lawful penetration tester can afford not to study it
in a moment we're going to look over the metal split interfaces.
You may recognize some that we have seen already over the course of this class albeit in other forms.
We will be starting out with the MSF console which is the command line interface for Metis Boyd and
then we will work our way up to Armitage which is a graphical user interface or G UI framework that
allows you to use metal exploited more conveniently.
The first thing to understand is that Mitt exploited needs to be setup correctly or else it is going
to be needlessly slow.
Now we could just launch it directly by going to applications
exploitation tools and clicking on metal split or from the Kelly Linux sidebar.
But let's do this right.
So we're gonna begin by opening up a terminal window
and we're going to start the post grass Eskew well data service.
What this will do is allow Metis ploy to run faster searches as well as allow Metis ploy to store the
information while you are performing scanning and exploitation.
It is not as I said an absolute requirement but it is a good practice for efficiency.
So let's do that now.
Service post Gris.
Q Well start.
Keep in mind this will take a moment and if you are in a virtual box it may take several moments for
the service to start.
Now with that done we could just load directly into met a split but I'm going to suggest running one
more command.
The very first time that you run Metis Floyd it is going to need to build a database and it is going
to take quite a long time.
This won't be required every time that you run Metis Floyd sometimes the database cachet does not get
built correctly and this can result in slow searches.
If this is your first time running Meadows Floyd I suggest that you run the following command.
M S F D.B. I n i t.
In my case the database is already started and configured.
And if you get that message great move on and don't worry about it.
Otherwise this will begin building the database which may take quite some time but it is a good investment
of time to get this done now rather than having to perpetually deal with slow searches within the framework
once that's done.
We're going to type M S F console to begin loading met spoiled if you chose to start the posts the post
Press Service.
This will load faster but it always takes some time for this to come up particularly in virtual box.
And again please bear in mind that the first time that you're running met a split the load time is going
to be very slow as it's going to be building these databases.
Once the console does finally finish loading you'll be treated to one of a dozen or so random banners
possibly containing some ASCII art.
These banners are quite amusing but some of them confuse new users because they make it appear that
met a spoilt failed to load correctly they can take the form of a joke error message that are actually
references to old movies and video games about hacking.
But if you don't know the reference you might be thinking that the framework crashed since the banner
is random and different versions have different banners.
I don't really know for sure what you'll be presented with when you first load up Metis Floyd but as
long as you see this bit here at the bottom you can be confident that Metis Floyd is working correctly
also notice that the prompt is changed to MSF.
I want to point out that if you watch the video on recon energy a lot of things about this framework
are going to look very familiar to you.
This is no accident as recon energy was designed to be very similar to metal split all right.
Once again I'm going to suggest an optional command if this is your first time using metal spoiled your
database cachet may not have been built properly.
We have the MSF prompt which means we are in the MSF console so I suggest running the following command
D.B. underscore rebuild underscore cachet.
This gives us a message about purging and rebuilding the module cachet in the background while we work.
As I said this is not absolutely necessary but using this command is how we fix any problems with the
cachet that can result in slow searches and it should only be necessary to do this.
The very first time that you load met a split not every time you load met Boyd.
But if you run into any problems by all means run the command again.
In any case now that we're up and running we'll begin by looking at the Met a split keywords menace
Floyd has six type of modules although we will mostly be using just four of them.
Briefly put it has exploits auxiliary post payloads encoders and knobs and exploit is a module that
will take advantage of a system vulnerability.
This is why reconnaissance of our targets is so important.
Just because we know an exploit exists for a particular operating system application it won't do us
any good.
If that vulnerability has already been patched we've seen how to find these vulnerabilities in prior
modules.
And this is the class of tools that allow you to attack them.
Usually these exploits seek to install a payload on the target system.
These payloads typically take the form of a reverse shell or a mature splitter giving you direct access
to that computer.
In other contexts payloads are often referred to as root kits or somewhat more broadly as remote access
tools auxiliary modules are sort of a catchall class for things like port scanners phasers sniffers
and the like encoders ensure that payloads make it to their destination intact.
This is a little hard to explain in a coherent way at this stage.
The tutorial because it can seem overly technical and overwhelming but this should become more clear
as we go along and not just keep payload sizes consistent across exploit attempts.
This should also become more clear as we go along so the very best command to remember in metal spoiled
is unsurprisingly the help command
if we open this up we can see a long list of examples and commands that can seem quite overwhelming.
But don't try to figure it all out right now.
Just remember that this exists as a reference for you to go back to at any point.
As we go along if you get confused if you find yourself getting lost or trying to do something outside
of the bounds and scope of this tutorial and the help file itself is not enough to answer your question.
Use it as a starting point for your web searches and there is a good chance you'll find what you're
looking for.
All right.
So now let's look at the use.
Command again.
If you watched the recon energy video this is going to seem very familiar to you.
If not briefly what use does is it allows you to load up a particular module within the framework for
this example let's say that we have a target system and we have detected that it is vulnerable to an
old adult Adobe Flash plugin exploit.
So we're going to use the use command then from here.
The path follows a certain logic we specify that we want to use an exploit forward slash.
Then we add in Windows because it is a Windows exploit.
Then we add in forward slash browser and another forward slash and include the name for the browser
exploit.
So in this case it's going to be a dobie underscore flash underscore AVM too.
It's all going to look like this.
Use exploits.
Sorry.
Exploit forward slash windows forward slash
browser forward slash Adobe underscore flash underscore AVM to hit enter and right away we notice that
the prompt is changed.
This tells us that the exploit we want to work with is now loaded up in any commands we run from here
will apply to the exploit itself.
The module name being displayed in red means that it is ready for use.
The first thing we want to do is type the show command and this will give us information about the module
itself since we didn't provide any sort of argument to this command.
It is going to show us everything there is to see and this will seem very overwhelming.
But don't worry about it and do please be patient as this will be somewhat slow to pop up for larger
exploits like this.
We need to know about the show command for circumstances where we need to check something specific about
the module itself but for the most part we don't really need to know all of this.
Needless to say that was a lot to take in a better and more digestible thing to do is to use the show
options command.
This will give us options for the module that we're working with that we can customize depending on
the method of exploitation.
In this case we have server host the server port the SSL certificate etc. Every exploit will have certain
options that you can change.
This will become more clear later.
Next we'll have a look at these show payloads command and this will probably take a few seconds particularly
in virtual box.
These are all the payloads that we can load.
Each one gives us a different way of approaching an attack.
This will show you all the payloads that are compatible with this particular exploit.
Another one is the show Target's command.
In this case none are set with different exploits.
You can have multiple targets and it's important to get this right.
This will be elaborated on a bit later and next we look at the show info command and this gives us general
information about what the module itself is supposed to do.
So in this case if we read what is written here this module exploits of vulnerability found the active
x component of Adobe Flash Player before a certain version no by supplying a specifically crafted s
w f file it is possible to trigger an integer under flow in several AVM to instructions which can be
turned into remote code execution under the context of the user.
So on and so on.
In other words if your target is running a version of Adobe Flash Player older than version twelve point
zero point zero point four three This module will attempt to exploit this integer under flow bug to
run a payload on the target system in the background and make it appear that this to the system that
the user of the system is the one running it.
In other words it can install for example a remote access package and make it seem to the system as
if the user was the one who did it thus bypassing many or all security defensive measures.
Of course this is a very old exploit and will not work on flash player versions past twelve point zero
point zero point for three.
But this is just an example chosen to give you an idea of how this process works.
You detect what your target is vulnerable against during a reconnaissance phase and then you find the
appropriate exploit within the Met a spoilt framework to go after it.
And this leads us nicely to the MSF search command because once you found something on a target machine
that you want to exploit you need to find the appropriate exploit for it within met a spoiled men exploit
has a lot of modules.
So finding the right one can be quite time consuming.
The syntax is going to contain keywords such as we have already seen the first will be platform then
the type of module such as for example an exploit or a payload and then finally the specific name that
we're looking for.
First we're going to exit out of the current module and return to the MSF console for this.
We'll use the back command
notice that unloaded the module and our prompt just says MSF again.
Now from here what this is going to look like is search type colon exploit.
We'll give it a space platform colon windows and another space flash.
This will eventually give us a list of all exploits that will fit the bill.
Incidentally if you received any sort of a warning about searches being slow due to the database cachet.
This is why it is important to run that D.B. underscore rebuild underscore cachet command the very first
time we load up Metis Floyd.
That should fix any sort of problem with slow searches that you might get.
So now if we scroll up we can see that the exploit we just used is listed near the top notice that they
are sorted by name with the date of disclosure.
The rank and general description so we'll just copy the one we want which in this example is the one
we were just using.
And from here we'll use the use command.
We'll go ahead and paste that in and we'll do show options
and now we want to set some of these options that is very easy.
We will just use the set command to do it.
For example if you wanted to set the server port it would be set aside of the port.
Forgive my typing set SRB port 80
Another example might be that we want to set the server host so we'll use set S R v host 10 dot 0 1
0 dot eleven which in this case is the local IP address of my met a splitter ball to machine on my network
now to launch the exploit we simply type exploit and I've gone ahead and used control seed interrupt
this because I'm getting into using these exploits for another video and I don't think I properly configured
the port but the point is this is how you would do it you simply set the options you give it the target
and then you type the exploit command.
OK so once again we use the back command to get the MSF console and last but not least the exit command
to shut down met a split and get back to the regular command prompt.
All right.
That'll about do it for this introductory video.
I hope this wasn't too overwhelming or confusing.
This is a very complex subject but hopefully as we go along and there are more practical examples of
using some of these exploits and other tools the concepts and commands will begin to make a little bit
more sense.
We have to learn to walk before we can run.
Thank you for your patience and your attention.