Department Of Electrical And Computer Engineering Florida .

3common drive was the CD-ROM; therefore, when the CDwith the appropriate instructions was inserted into thecomputer, the OS acknowledges the new device and inspectsits content looking for the specific file that holds the set ofinstructions. This feature has been included in the newestversions of Windows, allowing the same functionality [2].Autorun.inf is the file that holds the required information toobtain an automatic installation from the mounted drive. Thisis a text file that needs to be saved in the root directory of alogical drive in ordered to be detected by the OS. Itsarchitecture follows the standard Windows.ini file, whichholds information and instructions as “key value” pairs,grouped into sections [3]. Since this file is legit and it is usedas a loading point for many programs, it has been targeted tobe implemented with malicious purposes. Some of thecommon exploits include to embed a harmful executable fileinto the autorun.inf file, so when the operating system finds it,it will automatically execute it [22].Autorun, like keylogging, is very convenient to beused along with the reverse shell technique because eventhough most of the time a reverse shell is setup to evade thefirewalls restrictions of a network, sometimes the attackertarget’s is not part of a specific net, on the contrary, it is astand-alone computer. In this case, the attacker can use amalware that alters or injects an autorun.inf file into the rootfolder of every single drive of the device as well as amalicious executable. When the infected media is attached tothe desired drive, the tainted autorun.inf file is discovered bythe operating system and starts its execution, which allows themalicious file to run automatically and silently in thecomputer’s background [22].Considering multiple factors like how reliable anexploit can be, Metasploit uses rankings so testers know howcomplicated it will be to use one [15]. The rankings values canbe: Excellent; the exploit is completely reliable; someexamples can be CMD execution or SQL injection. Great; the exploits check for compatibility on thetarget and is easily executed to a default target Good; the exploit is easy and has a default target Normal; the exploit doesn’t detect the targetautomatically but is reliable Average; the exploit is not easy to use and/or isunreliable Low, the exploit is successful less than 50% of thetime Manual, the exploit is configured by the user or it’sextremely unstable.B.Metasploit PayloadsMetasploit has hundreds of payloads which include: Command shellAllows the attacker to execute arbitrary shellcommands on the victi once it’s been compromised MeterpreterThis type of payload allows the attacker to transferfiles from and to the victim, browse its content anduse VNC to control the screen Dynamic payloadsThis generates unique payloads that try to fool antivirus softwareC.III.METASPLOIT FRAMEWORKThe Metasploit Project is currently being developed by Rapid7and helps security experts to find vulnerabilities, define newIntruder Detection Signatures, and in penetration testingprocesses with multiple tools.Its most known element is the Metasploit Frameworkwhich started with a portable network tool in 2003 and hasgrown to an extensive toolset supported in multiple platforms.It is flexible enough to be capable of exploiting vulnerabilitiesthrough modules, which can also be added by externaldevelopers, that affect all kinds of targets by taking advantageof bugs.The Metasploit framework includes hundreds ofexploits and its modular design allows security experts andattackers to mix and match exploits and payloads dependingon the target’s Operating System and the kind of attack thatwill be performed [21].A.Metasploit ExploitsMetasploit categorizes exploits by the platforms in which theycan be used.Developers can write exploits without worryingabout dependencies, payloads and developing modules usingscripts based on the current Metasploit functions but it’srequired to specify exploitable versions, affected operatingsystems so it’s easily identified by final end users.Metasploit DevelopmentAll the code for the Metasploit framework can befound on GitHub and it’s open for public frameworkanddevelopers can download the source code and start modifyingit accordingly or add custom modules [14].D.Metasploit VersionsRapid7, Strategic Cyber LLC, Kali Linux developersand others contribute daily to different versions available tothe public. End users can get some versions for free fromgithub and similar websites or can get a paid version withsupport from Rapid7 [III4]. The main versions currentlyavailable are: Metasploit Framework EditionThis version is completely free and available throughGitHub, developers and penetration testers can use it formultiple tasks, it’s included in Kali linux and uses aterminal interface to execute exploits. Even though it’sfree and doesn’t have support, it can be extended withcustom exploits and payloads. Out of the box it containsnetwork discovery tools and basic exploiting functions. Metasploit Community EditionThis version is maintained by Rapid 7 andrecommended for small business and students, it has allthe functions from the framework version plus a graphicuser interface. It’s considered a one-year trial of the proversion, it includes some automation tools like baseline

4penetration testing reports and automated credentialsbrute forcing but doesn’t have all the pro functions. Metasploit ProThis is the full version provided by Rapid7, containsmultiple additional automation functions like automatedworkflows, wizards and smart exploitation. It alsocontains infiltration tools for dynamic payloads, spearphishing, and web app testing for OWASP top 10vulnerabilities. Other versions.Rapid 7 also offers other versions with limitedfunctionalities for specific tasks or different scenarios likeMetasploit express which can be used for small networks.In addition to Rapid7 other developers can also use thecode available in GitHub to start creating new versionsfor different use cases.IV.METERPRETERMeterpreter is an advanced payload that uses inmemory DLL injection stagers and is extended over thenetwork at runtime. It has been part of Metasploit since 2004.It communicates over the stager socket and provides acomprehensive client-side Ruby API. It features commandhistory, tab completion, channels, and more. Originally writtenin C by Matt "skape" Miller (and now compiled with MSVC),dozens of contributors have provided additional code,including implementations in PHP, Python, and Java. Thepayload continues to be frequently updated as part ofMetasploit development. Common extensions were mergedfor 3.x and are currently undergoing an overhaul forMetasploit 3.3 [20], [16].A.How Meterpreter WorksIn order to better understand this program, here is astep by step explanation on how Meterpreter works.Step 1. The target executes the initial stager:Meterpreter is a sophisticated and well-designedpayload that offers more than a command-line shell. Probablyits most attractive feature is foremost its ease of use. In fact, itis one of the reasons why many of the other Metasploitmodules rely on Meterpreter and not so much the commandshell. Let’s explore how the process begins. Within theMetasploit architecture, Meterpreter is another payload that isdelivered to a target. The delivery is through a small stagerabout 70K in size, which is meant to reach the target fast andundetected by IPS, and IDS systems. Stagers can beobfuscated with applications like msfencode and can becreated with utilities such as msfpayload. A stager is nothingmore than a small program whose purpose is to downloadadditional components or applications once it has reached itstarget. There are several ways to deliver a stager into a system,some of which are trivial and others more sophisticatedmethods. For example, a stager can be delivered as acompromised PDF or docx, or a Java exploit. In fact, anymethod that enables code execution in a remote machine is anoption; it can even be embedded in executable files likenotepad.exe, sol.exe, InstallFlash.exe, etc. One key factor toconsider is that whichever the chosen executable may be, ithas to be run with administrator rights. Also, to be successful,it has to bypass UAC (User Admin Controls) as well. Now,the latter tasks do not have to be necessarily run byMeterpreter, as there are many other tools and methods thatrely on exploits of known vulnerabilities that will get by UAC.Once the stager executes, Meterpreter establishes a connectionfetching a 751KB DLL which will continue the process. Onlythe shell is downloaded, and no user-agents are present. Thelatter file can be encrypted or unencrypted and although someadvances have been made as far as detection, hackers seem tobe one step ahead.Step 2. The stager loads the DLL prefixed with Reflective.The Reflective stub handles the loading/injection of the DLL.With the effort of staying hidden, Meterpreter doessomething very clever; it avoids writing its main executableinto hard disk space. The idea behind is to leave no tracesbehind for computer forensic experts to find that it was everpresent and furthermore to keep hidden what it compromisedin the affected system. To accomplish such a task, the filereceived upon the stager’s execution is loaded into the RAMonly using the reflective DLL injection technique. AReflective DLL Injection allows the sourcing of the DLL inthe form of its raw data. To be able to inject the data into thetarget process, we must manually parse and map the binaryinto the virtual memory, as the Windows image loader woulddo when calling the LoadLibrary function from before. It isworth mentioning that some recent utilities have been usedsuccessfully to analyze system memory dumps to detect thepresence of Meterpreter and the processes it run; one exampleis Volatility with the malfind plugin.Step 3. The Meterpreter core initializes, establishes anHTTP(s) or raw TCP connection:Upon the execution of the stager the MeterpreterDLL is downloaded and kept in RAM. The fingerprint for thisis a GET request to a 4-character path directly off the domain;no file specified. Unlike most legitimate requests, a UserAgent is not included, and the only HTTP headers sent areConnection and Cache-Control [23]. Notice that HTTP andHTTP(s) can be used and typically hackers will use acombination of both as they avoid egresses filters fairly wellblending nicely with everyday network traffic on ports 80 and443. One interesting approach to the adoption of HTTP is thatMeterpreter transports typically use a server/client deploymentwith many short HTTP connections. HTTP POSTs messagessuggests th

Meterpreter, payload; reverse shell; rubber ducky; sniffer I. INTRODUCTION REVERSE SHELL is a simple concept to understand, with a tremendous force of impact when applied. It begins with a listening machine A on a specific TCP port, another machine B connects to the port and the handshake is complete.