Welcome to Part Eight of this module.
So before we move on and start taking a look at ARMITAGE We need to quickly go over how to update our
met a split installation with the latest and greatest modules and exploits.
The process is actually fairly simple as we'll see all versions of Cally dating back to around 2017
or so have a built in exploit database complete with a search function.
The idea is that you update this database all at once grabbing a large number of new exploits that haven't
yet been plugged into met a split yet.
Then you can add them on an as needed basis without even needing a web browser or an internet connection.
Of course in practice you're probably going to search the internet for a particular exploit that matches
a vulnerability that you have identified in a target system.
Then you'd search the exploit D.B. and upon discovering that you already have the one you saw mentioned
online.
Plug it into Metis Floyd and start using it.
You could just take the entire exploit DP and dump it right into Metis Floyd.
But I really don't recommend doing this.
I am of the opinion that it is best to wait until an exploit has been officially added to the framework
unless it is an exploit that you personally researched and decided you wish to add.
Just plugging them all in is an invitation to disaster since some of them might not be particularly
well made.
It's up to you and we'll cover both approaches but I strongly recommend doing them wondered.
One at a time as needed.
So if you're following along we're actually going to need three terminal windows open here.
As you can see Metis Floyd is already up and running in our first terminal.
If you've been following along this should look very familiar but in case you need a quick refresher
we just you service post rescue l start and then MSF console and that'll bring up your meds split.
So from within minutes Beloit.
Notice the current number of exploits that we have plugged in.
In my case it's one thousand seven hundred sixty nine.
And yours will vary.
This number should be going up by 1 by the end of this video.
So we're gonna go ahead and we're going to open up a second terminal window to maximize it.
All it's going to take to get us going initially here is a single command and we just need a regular
terminal for this.
We don't want to do it in the Mets Floyd console itself and we're gonna type search split tack H for
help.
Now search spoiled is a powerful tool that allows us to query the exploit database of all the current
exploits currently published and available out there.
As I said it takes a while for these exploits to actually get made into Ruby files and officially plugged
into the Mets plate framework itself.
But many of them are ready to be we're going to go ahead and we're just going to grab them all.
So you will need an internet connection for this.
Now you already have exploit D.B. in your Cally installation assuming that your calling installation
is current and you're not using some very old version of backtrack or something.
However there's no reason not to go ahead and act and update it.
So we're gonna do search split tack you for the update.
And it will begin downloading all of the packages with the latest exploits in them.
Be aware that if this is the first time you've ever run this command it's going to take a very long
time to finish and say yes when prompted say yes again one prompted the process that this is going to
go through is it's going to create a folder called exploit database papers and building the structure
is brutally slow.
1 It is sort of creating it for the first time from scratch.
Now obviously I'll be making an edit to this video to make this process seem much faster than it actually
is because we really don't want to sit here throughout the whole thing.
However it is worth pointing out that after you've done this for the first time subsequent updates will
not take this long.
Also keep in where the amount of time that you spend doing this will vary greatly depending on the strength
of your machine.
If you're doing this in virtual box as I am for the purpose of recording this video this process will
probably be pretty slow if you're doing it on the machine with considerable resources.
You could probably get through this within about an AI at estimate about 5 to 10 minutes.
Actually while this is updating let's go ahead and open that third terminal window and we'll just go
ahead and we'll put these terminals side by side.
All right.
There we go.
As you know everything in Cali is sorted into a directory structure and the modules for met a split
are really no different.
Let's go ahead and list out everything in our root directory now and we want to see the hidden files
because the file that we're going to be looking for is normally hidden.
So we're gonna do l s TAC a R L hidden files are the ones listed with dots in the front of them.
The one that we're looking for is going to be dot M S F 4 which is where our met a split console is
sorted.
What we want to do is see into it.
Seedy MSF for and we'll do.
ELLIS We can see a folder inside called modules.
Let's go ahead and see right into it.
List files as we can see there's nothing in this folder as of yet.
We don't want to start dumping things into the framework without any organization because in the long
run that is a recipe for unpleasantness.
Instead let's go ahead and make a directory.
And since this isn't very pretty to look at I think I'm just going to minimize this or maximize the
screen.
And we're gonna go ahead and we're going to make directory exploits
you really want to do yourself a favor and be as organized as you can when adding modules to MSF console.
You don't want exploits and other things like encoders and auxiliaries living together in a big tangled
Mess with other files in the long run it is going to be a huge headache it's coming back over here for
just a second.
We can see that this is about 83 percent done.
So for the next step we're going to need this process to be completely resolved so I'm going to make
a brief pause to the recording here.
Keep in mind this is the part that's going to take you the most time as it will have to build the paper's
database just be patient it will finish.
OK so once that's done we're gonna go ahead and we're gonna come over to our met a split window and
you'll notice that the number of exploits has not actually gone up and this is not a mistake and it
won't help to reload MSF console.
What we've done is we've updated the database but we haven't actually plugged any of these in yet.
So let's go ahead and do that now do that over here.
So now we're going to use the search split command to search the database and let's say that we found
a popular one online.
I'm going to use M.S. 15 dash 100 because it's a common one and as soon as we press enter it will recall
the information that we need onto the screen.
Let's look at over real quick.
There are two ways that this particular exploit comes packaged as a Python script and is a ruby file.
Generally speaking you shouldn't have any problem plugging in Ruby files.
You'll notice that next to the name of the exploit.
And the short name for the exploit which in this case is M.S. 15 dash one hundred.
It has parentheses Metis Floyd meaning that this ruby file is made to be compatible and plugged right
into better split but you may run into problems trying to plug in python scripts.
Remember these are published exploits that haven't been officially added to the Mets plate framework
yet.
So bugs and errors are a distinct possibility.
Either way we're going to add the ruby file which is the DOT RB B file.
So let's move back over to our directory window and our exploits folder is empty.
Let's go ahead and do make directory windows and we'll see into it.
And now we're going to make yet another directory within this newly created Windows directory called
remote.
Now the reason that we're doing this is that we're following the naming convention shown here which
in this case is exploits windows remote and then the file name.
Now obviously there are a couple of ways we can copy the silver but let's do it via the terminal.
So we're going to do C.P. for copy forward slash user that's USSR forward slash share for forward slash
exploit D.B. forward slash exploits forward slash windows forward slash remote forward slash and then
the exploit Ruby file which is 3 8 1 9 5 dot RB we'll give it another space.
And now we're going to tell it to copy into our forward slash route forward slash dot MSF 4 forward
slash modules forward slash exploits forward slash windows forward slash remote.
Great.
Now if we see into remote and Ellison side remote we can see the newly copied exploit displayed in green.
Now this is the same Ruby file that we downloaded into the database.
However we aren't done yet even though we've placed the exploit in the correct spot.
You won't find it in the MSF console because there is one more step that we need to take in a regular
terminal window not the MSF console.
We have to type update D.B. which is short for update database.
This is going to update the file location database throughout Cali itself.
Now after that will exit MSF console and reloaded and the newly imported exploit should be available
and there we go.
Our total number of exploits has increased by 1.
So this tells us that the exploit has been plugged in successfully so let's go ahead and search for
it with the search command search M.S. 15 dash one hundred we can see that it comes up and is located
in the directory that we created for it.
Oh neat and tidy to summarize Carly has an exploit database already on it full of unpublished files
or rather published files that haven't yet been added to the Metis flight framework yet we updated it
which downloaded even more files and then we selected one of those files and manually added it to the
Metis flight framework itself.
Since the framework is all modular you can do this with pretty much anything although I don't promise
that you won't run into bugs and errors with various pieces of code.
One thing to remember too is that this method pulls down files from a trusted source.
You might be able to find them individually on the web but who knows if they've been fiddled around
with.
The nice thing about the exploit database on Cowley is that when you hear about an exploit and find
you don't have it already you probably do in fact have it.
So let's come back over to r prompt window and we're just going to clear out of this and just to show
you.
You can look at the entire database by typing C.D. forward slash user forward slash share forward slash
exploit D.B. Ellis and we can see how it's divided we'll do seedy exploits
unless the very they're of course divided by the various types of exploits.
So we'll go into seedy windows and then from here further subdivided we'll do seedy remote because that's
where we pulled the one we're working on we'll do less
as you can see it's a very big list.
Now this isn't the only way to move these around you don't have to do it through the terminal window.
The way I just showed you and you might not even prefer to do it that way we can always go into the
file manager provided that we have enabled the show hidden files.
Option and I'll back out of this a bit and we'll just go into user share
and scroll down a bit until we find exploit.
D.B.
exploits.
Here we have the same subdivisions go into Windows remote.
And there we go.
And I really want to stress that trying to plug all of these in at once or even just grabbing a lot
of them that sound really nice is a supremely bad idea.
It's better to have a few tools that work well than an overflowing tool box that is too unwieldy to
carry now in principle and downloading an exploit off the Internet instead of adding it from the exploit
database works the same.
Take the file.
Plug it into the relevant folder and run the update DB command.
In theory you should then be good to go.
The wonderful thing about the modular nature of metal spoiled is that you can add things to it very
easily.
So as long as you keep things well organized and sorted the framework will continue to be a worthwhile
tool for you long into the future.
Remember also that new exploits are constantly being discovered.
So if you use metal exploit often it is very worth your time to do a little research and see if you
can find something wonderful that hasn't yet made it into the official release yet.
Newer payloads that have seen less use are also at least in theory anyway less likely to be detected.
And remember that you'll need to reload MSF console any time you add anything new to the framework.
All right.
That should about cover it.
Hopefully this has been clear.
If there is any special module you want to add met a split.
Let's say from GitHub there are usually instructions included with these files and they tend to follow
the same general schema.
Thank you.