Welcome to part two of this module.
We are going to continue with our introduction to a split and for those of you just joining us I will
quickly reiterate that for this particular module it is very important to watch each video in the order
in which they are presented.
While they do try to keep each video a single standalone presentation it isn't always possible or desirable
for more complex applications and met a split is a subject that warrants an entire module dedicated
to it.
We are going to be picking up where we left off in the last module because it is so critically important
to understand before we proceed.
I'm going to be speaking a bit more about the nature of modules and showing you where they live on your
Kelly installation.
This is vital for many reasons.
So please be patient even if this does seem slightly redundant with what you've already learned.
We touched upon what modules are very briefly in the last video but the purpose of that presentation
was to take you through the basic interface of metal spoiled and get you comfortable with the simplest
examples of the command structure.
Now it is time to understand the components and how they all work together.
I recommend following along on your own system since it is often easier to learn and retain information
by doing rather than just watching and I have to admit this won't be an overly exciting video in terms
of examples.
As I sent said at the end of Part One we have to learn to walk before we can run.
So let's get started.
We'll begin by loading up MSF console although we won't really be spending much time in it until the
next video.
While this loads I'll explain a few things that I only glossed over before when met a split opens.
It shows us the type of modules the exploits the payloads the auxiliaries the encoders the knobs and
the post.
We did touch on these briefly in the last video.
In total we have six categories of modules within the Met a split architecture.
The basic structure is that the six modules are categorized which is then superseded by the MSF console
or met a spoilt framework itself which is then superseded by the core.
And finally by the libraries.
This means that we have our command line interface which we can access for many prompt and often is
accessed by other applications that utilize it.
We have the MSF console which we are now in.
And finally we have the graphical user interface or Armitage which we'll be looking at a little further
down the line.
Alright now it is critically important to understand where these modules are stored not only to grasp
the architecture but also because we may want to update them or edit them in the future.
So we'll just go ahead and open up a second terminal window to serve for this demonstration so CDE user
share met a split dash framework
so if you look at the list the files here we can see that there is a sub directory called modules.
Our next step is going to be to see into this folder and see what we have installed
if we list the files in here.
We can see that it is further divided into six categories that have been mentioned earlier.
Auxiliary encoders exploits knobs payloads and post.
The main point here is to understand the file directory structure and how it is all sorted.
If we drill down further into a particular module let's start with exploits exploits are really our
bread and butter.
These are bits of code that take advantage of a weakness on a target system.
So if we open the directory and list out the files we can see subcategories for all the types of exploits
that we currently have sorted in terms of operating system that contains the particular vulnerability.
For example we have Android for Android operating systems Linux Unix Solaris Apple OS Windows et cetera
et cetera.
We also have exploits for things like Firefox listed here as well because Firefox is a cross platform
browser used on many of these systems.
Pretty much any set of exploits that would be used for an application that has cross platform would
be located here alongside the operating systems.
Let's say that we're trying to target windows.
We can do city windows as we can see we have a lot of further sub directories sorted into the forms
of vulnerabilities.
For example my sequel FCP post grass SS H FCP you get the idea it is worth pointing out that the syntax
for the search command always follows this structure.
So as we saw in the first video if we were to look for a Windows Adobe exploit we would freeze it as
follows within the MSF console search type colon exploit platform colon.
Windows flash and that tells Metis ploy to look in the exploit folder the windows sub folder and search
out and list everything flash related so this has been one type of module.
It's back out of here and see what else we have.
The next type of module that we will have is payloads.
These are files that are left on the exploited system.
Simply speaking they give the attacker access or control over the system.
They are sometimes universally called root kits although this isn't strictly speaking always accurate.
Many payloads do indeed allow an attacker remote access but not all of them work like that payloads
allow the attacker to own the system they are left in will S.D. into payloads to drill down a little
deeper and see what we have payloads is further divided into three directories singles stages and stages
singles are like small bits of code that are usually designed to take one single action on the target
system stages on the other hand are used to create a line of communication between the attacker and
the target which is often used to deliver other payloads.
Stages are very large payloads that can give the attacker the aforementioned control over the target
for instance through Metro printer sessions VANOC reverse shells and so forth singles are very small
things like key log key loggers for example stages create communication between the attacker and the
target and stages are what give the attacker control over the target so hopefully that makes sense.
One last thing I want to add is that as I said not all stages are remote access the most dangerous from
a security point of view are those that sit on a system long term like a sleeper agent never setting
off any alarms and keeping a system compromised in very subtle ways while your average hacker might
go for direct control over a system that sort of thing often gets detected sooner or later higher level
groups like intelligence agencies prefer to create a point of compromise that allow them to maintain
a very subtle presence on a network over a long period of time.
This can obviously get really really complicated and it is quite a deep subject but for now it is enough
to understand basically what these are.
So we'll go back once again and take a look at the other types of modules
so change directory and auxiliary and listed out right away.
We can see that it is further sorted into some very interesting things.
Scanners spoof furs crawlers parsers sniffers buzzers and DOS stuff et cetera.
The primary use of the auxiliary is to scan the target and detect vulnerabilities which you can then
leverage using exploits to drop a stager to allow you to then drop a larger payload.
Another way of describing this category might be to call it miscellaneous so now we'll head back again.
Next up we have the encoders and these are more or less what you think they are.
The encoders are used to re encode packages and exploits.
They're used to get past security systems such as anti viruses.
Another term for encoder is often crypto her although they aren't completely the same thing.
The encoders job is to take a payload that an antivirus would detect as hostile.
Let's say a rootkit for example and make it look innocent so that it slips past detection
so this shouldn't look too confusing at this point.
Here we have the same subcategories and as we dig a little further let's do X 60 for
we can see the code files for the specific modules themselves within this category and they all have
the DOT RB on the end.
Now if you have the expertise you can't edit many of these files.
I don't really recommend it unless you are very confident that you know what you're doing but it is
also important to remember that if you acquire a new module you can just drag it into the proper directory.
For example let's say that you download some promising new exploits from a trustworthy source.
You just stick them into the appropriate sub directories of the exploits folder and then they should
come up and be accessible when you look for them in the MSF console.
Of course do your due diligence and make sure you only download new modules from trustworthy sources.
There are many groups online that produce unofficial modules for met a split as new exploits are being
discovered almost daily.
And of course you can always get more when you update which you should be doing fairly regularly.
The key thing to take away here is that you have many options for encoders and you want to use an encoder
that is appropriate to the target system.
X 86 for example would be for 32 bit operating systems X 64 for 64 bit and so on modules will sometimes
tell you which encoders are recommended but there may be times when the encoder or the encoders that
met a split recommends are not really the correct choice.
In these instances you'll have to find the ones you want to use yourself and they all pretty much live
here.
This really all does get quite a lot easier once you understand how all of this is divided and structured.
Next up Noffs
knobs are a little hard to explain.
A NOP is more commonly known as a no operation.
Essentially what they are.
For those of you who have done a lot of programming on machine language is an instruction to the system
microprocessor or CPE you causing it to do nothing for an entire clock cycle.
What is the point of that.
I hear you ask how and how will this help us.
Will knobs are very good for getting a system to perform in a certain way or execute certain files at
certain times after you have already exploited a buffer overflow.
They have other potential uses as well.
You really don't have to worry about them at this stage of the game because we may be coming back to
them later.
A lot of people who use met exploited don't tend to take not seriously because for many exploits they
simply aren't necessary.
However true masters of menace ploy may get a lot of mileage out of them.
It really all depends on what you're doing.
Again we can browse into Noffs And it's the same type of deal here subdivided and sorted into multiple
architectures.
Right now all you need to know is that knobs are mainly for exploiting the buffer overflow that come
in handy for more complex operations.
When going against very tightly defended systems but you really don't need to stress about understanding
them right now
so we've looked at all these module categories and they all provided us with many different ways of
getting into a system.
Last but not least we have posts or post exploitation.
These are going to be used after a system has been exploited.
They allow you to perform extra pieces of functionality once you've gained access in penetration testing
terms that they allow you to carry out further attacks on a system.
After that system has been owned these can be things like key loggers spying on the web cam hacking
a microphone opening the seedy drawer or anything else you can really think of.
Again everything here is subdivided into the operating system of choice.
So if we do see windows just for example again we have our different categories capture escalate which
is privilege escalation gather which has your key loggers manage recon w land let's open up gather
as you can see there is a lot of stuffing here and that is of course because Windows is the most vulnerable
operating system ever created by human beings.
With the possible exception of men exploited while each one of these does something interesting for
example this one allows you to enumerate the Windows product key and deactivate the windows authentication
protocol on the computer after deleting the key which is a really mean way to force your windows using
friends to make the move over to Linux and Oh oh what's this.
This is a new one I'll have to make a note of that one but I'm sure none of my students would be even
the slightest bit interested in a module like that.
So moving right along.
OK so looking back to summarize we have our auxiliary encoders exploit knobs payloads and post.
I hope you now understand more clearly what these are and have at least a general idea of how they are
all structured.
This may have been a boring video but if you can understand this stuff than using met a split really
will be a breeze.
We are still learning to walk but we're moving our way up to a run and I want to thank you for your
patience.