Welcome to part nine of this module.
It is now time to take a long and overdue look at Armitage originally developed by Rafael Mudge Armitage
is a Java based graphical user interface that acts as a front end for the Met a spoilt framework.
It is very much what zen map is to end map.
It gives you a visual representation of what is going on when you're using Metis Boyd the gooey comes
pre installed on all modern versions of Kali and is actually pinned to the taskbar right here by default.
When you initially installed the operating system it is represented by this icon of green haired woman
with what I take to be large paratrooper and ears.
Well I've never had this confirmed to be a fact.
I believe that the program name and icon design were inspired by an animated cyberpunk cartoon show
of the same name that was released sometime in the 1990s.
In any case it can also be found under applications
exploitation tools.
Armitage.
So let's go ahead and load up Armitage and take a look at the interface.
The first thing that will happen is that you'll be prompted with this little connection box.
We're going to go ahead and leave all of this just as it appears now.
So we'll just click connect.
This is going to form a connection to the local host.
We are then informed that a Metis Floyd our P.S. server is not running or not accepting connections
yet.
And we are asked if we wish to start one.
We'll go ahead and answer yes to this question.
Connecting will probably take you a few minutes.
If you've never run Metis ploy before at all.
This process is likely to take far longer the first time you do it.
Virtual Box users should be aware that Armitage tends to be moderately demanding in terms of system
resources it can run relatively smoothly even on a laptop with around 2 gigabytes of RAM.
But I really wouldn't recommend pushing it any lower than that.
Obviously it is possible to install Armitage and met a split on other distributions of Linux and for
various reasons you might wish to do this on a very low spec platform such as for example a raspberry
pi or a chip computer or possibly a very inexpensive virtual private server with very poor specs.
And that's fine.
You can do that but in such cases I would recommend the standard MSF console over the gooey now the
great thing about Armitage is that the exploitation process is essentially automated.
If the Mets point console seemed needlessly confusing or obtuse this graphical interface is meant to
be a kind of easy mode whereby you can accomplish with a few mouse clicks what would otherwise require
complex and somewhat arcane commands.
Perhaps you now ask asking yourself why the heck didn't we just start off with this instead of waiting.
Knee deep in the Met a spoiled and that is because having an understanding of what you're doing is important.
Even though Armitage can make things seem very easy you will run into occasional issues while using
it.
You may for example need to make changes to the options and settings on the fly and if you just rely
on a script to do everything for you then you'll never really progressing your skill beyond the limits
of that script.
OK so what is going on here.
First off we have three windows.
You'll notice that the MSF console is visible in the bottom window.
This is literally just MSF console.
If you type a command down here that would work normally in a normal MSF console that you open in a
terminal window.
It'll operate the same way you'll also see all the text based output down here in this window as well
such as for example the results of your scans the large empty window at the top is where the graphical
aspect of her graphical user interface comes into play as we'll see demonstrated in a moment.
Finally you have your categories here on the left auxiliaries exploits payloads and post.
Please note that you can resize these windows just by clicking and dragging them on the edge like so.
I generally tend to leave them the default size.
Also notice that much like Sparta the bottom console window is separated into discrete tabs in this
way it is much easier to manage multiple sessions or scans all at once.
Nothing about Armitage is different from anything you've learned so far.
Only the way in which information is presented and how you go about interacting with the system.
Now let's walk through this toolbar real quick under Armitage.
You can form a new connection.
Change your preferences set the target view set the exploit rank.
Use a SoCs proxy set the listeners so that you can connect to or wait for set the L host or another
listening host.
If for example you are running Cally on another computer and you want that computer to listen as well.
Finally you have your scripts and the option to close.
Armitage view is very straightforward.
That is just to essentially edit your view hosts is also what you would expect in a moment we're going
to add hosts to add in our midst Floyd able to virtual machine as a target for Armitage.
This is also where you would manually add in whatever targets you want to attack that don't automatically
pop up when you scan such as for example a remote target.
If you are attempting to use Armitage remotely please see the prior video on port forwarding and make
sure that you are configured properly for that.
We also have built in and map scans as is the case in standard MSF console.
If you watch the videos on any map these options should be familiar to you.
We won't be going into detail on what these mean here such as the differences between an intense scan
or a quick scan.
So please see that video if you have any questions about it.
MSF is our medicine Lloyd scans and there's DNS enumeration offered as well.
Finally you can clear your database which is essentially just removing any leftover scans or machines
that will show up in the graphical part of the window.
Again we'll see this in a moment.
Next up we have a tax which lets you find a tax on your targets or host.
Hail Mary is something that we'll look at later workspaces allows you to switch between all the workspaces
you currently have very useful and a large pen test where there are multiple systems at play and finally
help which is hopefully self-explanatory.
Now another thing to mention about the interface that a lot of people tend to miss is this little search
bar under the folders display.
It allows you to search the framework for particular exploits and what have you exactly like the search
command in the normal MSF console or module section is exactly the same as MSF console.
If we go through them real quick you can see the directory structure follows the basic structure that
we've seen displayed so far.
You have your auxiliaries your scanners your father's sniffers spoof furs et cetera et cetera.
Here we have our exploits sorted as always by the operating system exploits pertaining specifically
to windows would be stored in the windows folder.
Linux in the Linux folder Firefox Android and so on and so forth.
And here we have our payloads payloads are of course sorted by platform and operating system.
And of course last but not least we have our post right.
Hopefully this all seems very familiar and you are impatient to get started so let's get started as
I said our target for this demonstration is going to be our trusty met a split able to virtual machine.
If you're following along please load that up and use the I f config command within met a split to grab
its network address like so.
So here we can see in my case the network address is 10 0 0 0 dot 15 and yours will very likely be different.
Also keep in mind that a split able to is just for testing purposes and because it's an easy target
you can do this against a Windows box or whatever else you like.
You just won't find quite as many vulnerabilities and you might not find any if the system is well maintained
and fully up to date.
In any case we can go up to the hosts and click Add hosts then put in our a split able to virtual machines
IP but instead lets performing and map scan and see if it comes up by itself.
So we're going to hosts and map and we'll select a quick scan with operating system detection.
Now we're being prompted to enter a single IP address or a range of IP is if we wish to scan our entire
network.
We are on the network already so we know our own networks IP.
In this case it's going to be 10 dot 0 0 dot 15.
Yours will vary yours maybe something like 1 92 dot 168 dot one dot something.
In either case to scan a range we type 10 dot 0 0 0 1 slash 24 but we don't need to scan the whole network
right now so we'll just field our target address since we already know it.
When you're ready click OK.
Once we can enter the end map scan will begin.
This is exactly the same type of scan you've seen done elsewhere.
It is just taking place within Armitage.
The output is going to appear in the bottom window under its own specific tab and in a moment you should
see a computer image pop up in the top window with a small penguin on the screen.
Once the scan is done you'll be prompted telling you that the scan is complete and reminding you that
you can use the attacks tab find attacks to suggest applicable exploits for your target click OK.
So if we hover our mouse over the penguin we can see that the target is running Linux.
Two point six and the kernel is not specified.
The Penguin is a kind of shorthand that shows you it is a Linux machine you are dealing with.
If it was a Windows computer you'd see a Windows icon represented.
If we scroll up to evaluate our end map results in one of the previous videos we exploited the V as
f TPD backdoor to gain access.
How did we do that.
Well we knew that it exists as an exploit.
So let's go to our exploits folder and see if we can find it.
So we'll just click on exploits and we'll recall that it was a Unix exploit FTB.
And here we go from here we just double click.
Now it's going to present us with a window that lets us set the options for the exploit.
Exactly as you did in previously with the MSF console options like setting the R host an R port by default
the L host is the listening host and is your computer's network IP address the El port is the listening
port and this is an important number to remember if you're using port forwarding in this case we don't
need to worry about changing anything but you may need to set the R host it might not be done automatically
if that is the case.
Just double click set it to whatever you want in my case it's already set and press enter.
Now that we're ready we'll just click the launch button.
This will take a few seconds.
Armitage is now going to launch the exploit and a new dedicated tab will be opened pertaining specifically
to the exploit.
Here on our lower console window
and there we go.
We have backdoor access.
Easy is that.
Notice that the icon of the Linux computer is now surrounded by lightning bolts and has turned red.
This means that we have successfully exploited the system in some way.
Okay great.
We have access but so what.
Nothing about this really seems that different from MSF console.
What can we really do here.
Well the big advantage here is the automation of attacks and this is both Armitage's greatest strength
and greatest weakness.
It is a great strength because with just a few mouse clicks you can find all of the chinks in our target's
armor and exploit them and a weakness because if you rely solely on automation as ESP as has been said
your skills do not improve and you can't handle any hiccups that might happen so if we right click on
our target we can see that it gives us options to log in to the default network services.
If the cracking process is possible you can then log into things like the FCP protocol HDP my sequel
et cetera et cetera.
Now the shell that we have created which is the exploit that we just used allows us to interact with
the computer we can upload files past the session post modules or disconnect.
Let's go ahead and interact with it.
Now the shell that we have created which is the exploit that we used allows us to interact directly
with the computer as though we were sitting in front of it.
That is to say our target we can upload files we can delete files we can do whatever we want.
For example will print the working directory which is route we can list the files in the root directory
we can change to the home directory
we can switch into MSF ad men Saeedi vulnerable unless for list files and we can see the web services
that are currently running.
OK I'm going to close the shell because hopefully this is clear and maybe it's a little repetitive
upon disconnection.
The lightning bolts around the computer icon will be removed.
This denotes the fact that it is no longer being exploited.
Now if we go up to attacks and click find attacks it is literally going to do all the work for us at
completion.
It will tell us the attack analysis is complete and we'll see new options in the attack menu attached
to each host and the target window.
We just have to give it a second to complete we can see that the attack analysis is complete so we'll
click OK.
If we right click now we can pull up the newly added attack tab which shows us all the compatible exploits
that Armitage is found for us that should work against our target.
Now please notice that this is not a complete list in fact it doesn't even show us the exploit that
we literally just used.
We can go down to more and sometimes we can find it.
However it's not listed so we're going to go ahead and click check exploits
and as we can see in the lower window it is now checking against a wide range of possible exploits one
at a time switching between them and automatically setting our options.
This may of course take some time and it's not necessary to sit here and watch the process however has
more possibilities are found.
These should appear in your attack menu.
The point that I wish to drive home here is that while the find attacks option is very handy and can
save you a lot of time it's usually not 100 percent effective at finding all possible attack vectors.
You'll probably come up with something good and that may serve your immediate purpose but it's not a
replacement for a full blown reconnaissance scan such as such as we did with any map in the information
gathering phase.
And keep in mind that we can also scan an individual target by right clicking and clicking scan.
This will open up a dedicated tab and this is going to run through a large number of scanners as well.
One after another back to back in an automated information gathering process it will take some time
to finish and the information will be displayed on the bottom of the screen.
In this tab as we can see there are nine scans to go.
So while this is working we'll go up to hosts and we're going to perform an end map scan once again
same as before.
Quick scan with operating system detection.
And this time we're going to select a range of IP addresses so in my case it's 10 not 0 0 dot 1.
If your network address were something like one ninety two dot 168 dot 1 dot 0 you'd probably enter
one ninety two dot 168.
Dot one dot one.
In either case we then do slash 24 to show that we're scanning for up to 24 other connected machines
and we will click OK and this will begin the end map scan and with luck it will further populate our
target window.
We should see more machines pop up in a moment.
Some will be unclear as to what operating system they're using and others should denote the operating
system with an icon either Linux Windows Mac OS et cetera.
And this will further populate our target window so we'll click OK.
And now we can see that several war machines have popped up.
We have our Linux machine two different windows machines and a number of unidentified machines on the
network.
So as you can see this is a very useful tool particularly when you're auditing a very large network
with a lot of different computer systems and you want to pin test a lot of them.
You can scan them one by one automatically with dedicated tabs.
And it will run each set of scans one after another after another as you can see one scan to go if we
scroll up to scans scans to go three four five et cetera et cetera.
We can check exploits in an automated way against each target.
We can simply click on a target and we can click the scan option.
We can attempt to find attacks against that target.
There may or may not be any but you can try this with every single machine that pops up in the display
and chances are that you're going to find at least one or two exploits on a few machines that will pop
up on a large network that will give you purchase on the network and then you can pivot from there and
start exploiting other machines and so on and so forth.
So as you can see this is a very useful tool for large networks but it can lead to laziness and the
automation is not perfect.
These scans don't always find all the best exploits that are possible against a target as you may have
noticed this Linux machine which has met a split able to we saw a great many exploits for it but the
one that we use to gain a direct shell access it didn't come up in the menu which means that while the
system is very nice it's far from perfect.
In any case that about covers it.
Armitage is really a great tool to make use of and it makes Metis Floyd much easier particularly again
when you're using it against a lot of machines on a network all at once.
You need to keep everything neatly organized and arranged into tabs.
It keeps your running sessions organized as well so you could have multiple shells or more turf fritters
open all at once and it won't get horribly confusing having to switch back and forth in a text based
prompt anyway as always.
Never use anything demonstrated in these videos against any target or targets that you do not have written
permission from the owner to penetration test be conscientious and lawful and all that you do practice
this a bit on your own against your own vulnerable virtual machines and you should find that the once
confusing better split framework and Armitage really do become second nature.
So I hope you enjoy it and I'll see you next time.
Thank you.