Podcast
Questions and Answers
Which of the following operating systems is the MetaSploit Framework (MSF) available for?
Which of the following operating systems is the MetaSploit Framework (MSF) available for?
- Windows
- Linux
- Mac OS X
- All of the above (correct)
Exploit modules in MetaSploit are designed to perform auxiliary actions like host discovery and enumeration, rather than directly compromising the target.
Exploit modules in MetaSploit are designed to perform auxiliary actions like host discovery and enumeration, rather than directly compromising the target.
False (B)
What is the primary function of a payload within the MetaSploit Framework (MSF)?
What is the primary function of a payload within the MetaSploit Framework (MSF)?
- To execute code on a compromised target (correct)
- To list all available exploits
- To discover hosts on the network
- To encrypt communications between attacker and target
To view a list of all available exploits in MetaSploit, you would use the command ______.
To view a list of all available exploits in MetaSploit, you would use the command ______.
Which command in MetaSploit is used to load a specific exploit, changing the command prompt to indicate you are working within that exploit's context?
Which command in MetaSploit is used to load a specific exploit, changing the command prompt to indicate you are working within that exploit's context?
Once an attacker has gained initial access to a system, maintaining that access is unnecessary as the vulnerability used will always remain exploitable.
Once an attacker has gained initial access to a system, maintaining that access is unnecessary as the vulnerability used will always remain exploitable.
What is the primary purpose of creating a backdoor on a compromised system?
What is the primary purpose of creating a backdoor on a compromised system?
What tool can system administrators (and attackers) use to connect two machines, and can be run in either client or server mode?
What tool can system administrators (and attackers) use to connect two machines, and can be run in either client or server mode?
Why is 'calling back' (reverse shell) considered more reliable against firewalls and Intrusion Detection Systems (IDS)?
Why is 'calling back' (reverse shell) considered more reliable against firewalls and Intrusion Detection Systems (IDS)?
VNCinject, as a MetaSploit payload, only provides command-line access to the target system.
VNCinject, as a MetaSploit payload, only provides command-line access to the target system.
What type of MetaSploit payload is entirely executed from memory and can take control of a process?
What type of MetaSploit payload is entirely executed from memory and can take control of a process?
Which of the following describes the primary goal of 'covering tracks' after gaining access to a system?
Which of the following describes the primary goal of 'covering tracks' after gaining access to a system?
Which of the following actions are typically involved in covering tracks?
Which of the following actions are typically involved in covering tracks?
It is always best to completely delete all logs to avoid detection, regardless of the expertise of the system administrator.
It is always best to completely delete all logs to avoid detection, regardless of the expertise of the system administrator.
In Windows, you can hide a file using the attrib command with the ______ attribute.
In Windows, you can hide a file using the attrib command with the ______ attribute.
In Linux, what is the common method for hiding a file or folder?
In Linux, what is the common method for hiding a file or folder?
Match the following MetaSploit Framework commands with their descriptions:
Match the following MetaSploit Framework commands with their descriptions:
Which of the following is NOT a typical action for maintaining access to a compromised system?
Which of the following is NOT a typical action for maintaining access to a compromised system?
Modifying log files is always a more effective method of covering tracks than deleting them.
Modifying log files is always a more effective method of covering tracks than deleting them.
The MetaSploit Framework (MSF) is written in the programming language ______.
The MetaSploit Framework (MSF) is written in the programming language ______.
Flashcards
MetaSploit Framework (MSF)
MetaSploit Framework (MSF)
A framework available for multiple OSes. It supports payload selection and advanced target interaction using VNCinject and meterpreter.
Exploit Modules
Exploit Modules
Modules in MSF that compromise the target and inject a payload using buffer overflows.
Auxiliary Modules
Auxiliary Modules
Modules in MSF that perform actions like host discovery, enumeration, and capturing NTLM/LM hash challenges.
MSF Payload
MSF Payload
Signup and view all the flashcards
show exploits
show exploits
Signup and view all the flashcards
info exploit_path_name
info exploit_path_name
Signup and view all the flashcards
use exploit_path_name
use exploit_path_name
Signup and view all the flashcards
show payloads
show payloads
Signup and view all the flashcards
set PAYLOAD chosen_payload
set PAYLOAD chosen_payload
Signup and view all the flashcards
show options
show options
Signup and view all the flashcards
exploit
exploit
Signup and view all the flashcards
Create a backdoor
Create a backdoor
Signup and view all the flashcards
Netcat
Netcat
Signup and view all the flashcards
Calling back
Calling back
Signup and view all the flashcards
VNCinject
VNCinject
Signup and view all the flashcards
Meterpreter
Meterpreter
Signup and view all the flashcards
Covering Tracks
Covering Tracks
Signup and view all the flashcards
Modify Logs
Modify Logs
Signup and view all the flashcards
Delete Logs
Delete Logs
Signup and view all the flashcards
Hiding files
Hiding files
Signup and view all the flashcards
Study Notes
- The presentation discusses owning a system through gaining access, maintaining access, and covering tracks
Gaining Access
- Metasploit Framework (MSF) is available for Windows, Linux, and Mac OS X; is free and written in Ruby, C/C++, and assembly
- MSF supports the selection of specific payloads and advanced interaction with the target using VNCinject and meterpreter payloads
- MSF has exploit modules that compromise the target by using buffer overflows and then injecting a payload (2000+)
- MSF Auxiliary modules perform actions like host discovery, enumeration of VMware groups/users, and capturing NTLM/LM hash challenges (200+)
- Payloads will execute once the target is compromised using shellcode specific to the target platform, capable of binding a command shell to a port, or adding a user account
- MSF payloads can be encrypted using encoder modules, and there are 500+ available payloads
- MSF can be used by selecting an exploit module and payload, then setting appropriate options
- To select an exploit module, use the show exploits command to list them all or use info exploit_path_name to get info about target software or OS; load with use exploit_path_name
- To select a payload, use the show payloads command to list the available payloads for the chosen exploit
- Set a payload by using set PAYLOAD chosen_payload
- Use show options to list available options for the payload, and use exploit to launch the exploit
Maintaining Access
- Vulnerabilities get patched and systems get rebooted, so maintaining access is important to avoid the overhead of re-exploiting a vulnerability
- Backdoors could be used to establish an encrypted/covert channel, or infect other machines in a LAN
- Netcat is used by system admins to connect two machines and can run in client or server mode
- An attacker can set netcat to listen on the victim side and then connect to it to open a shell
- Victims can be set to phone home
- Calling back is more reliable against firewalls and IDS
- The Metasploit Framework has two interesting payloads useful to maintain access
- VNCinject payload contains a VNC server DLL to give desktop access to the target
- Meterpreter is a multifunction Windows payload that can take control of a process and harness its privileges and is entirely executed from memory
Covering Tracks
- Alter logs and hide files to cover tracks
- System and application logs can be modified or deleted
- Modify logs by hiding all the tracks of the attack and of the changes to the logs
- Delete logs entirely, but that could invite detection even if the admin cannot understand what the original attack did
- Hide files by using attrib +h folder_name on Windows, or .folder_name on Linux
- Change files and folder names, especially executables
Studying That Suits You
Use AI to generate personalized quizzes and flashcards to suit your learning preferences.
