Client-side Attacks with Metasploit

In the previous chapter, we learned to use various tools such as NMAP and Nessus to directly exploit vulnerabilities in the target system. However, the techniques that we learned are useful if the attacker's system and the target system are within the same network. In this chapter, we'll see an overview of techniques used to exploit systems, which are located in different networks altogether. The topics to be covered in this chapter are as follows:

• Understanding key terminology related to client-side attacks
• Using msfvenom to generate custom payloads
• Using Social-Engineering Toolkit
• Advanced browser-based attacks using the browser_autopwn ;auxiliary module

Need of client-side attacks

In the previous chapter, we used the MS08_067net api vulnerability in our target system and got complete administrator-level access to the system. We configured the value of the RHOST variable as the IP address of our target system. Now, the exploit was successful only because the attacker's system and the target system both were on the same network. (The IP address of attacker's system was 192.168.44.134 and the IP address of target system was 192.168.44.129).

This scenario was pretty straightforward as shown in the following diagram:

Now, consider a scenario shown in the following diagram. The IP address of the attacker system is a public address and he is trying to exploit a vulnerability on a system, which is not in same network. Note, the target system, in this case, has a private IP address (10.11.1.56) and is NAT'ed behind an...

The msfvenom utility

Earlier, the Metasploit Framework offered two different utilities, namely, ;msfpayload and msfencode. The msfpayload was used to generate a payload in a specified format and the msfencode was used to encode and obfuscate the payload using various algorithms. However, the newer and the latest version of the Metasploit Framework has combined both of these utilities into a single utility called msfvenom.

The msfvenom utility can generate a payload as well as encode the same in a single command. We shall see a few commands next:

The msfvenom is a separate utility and doesn't require msfconsole to be running at same time.

• List payloads: The msfvenom utility supports all standard Metasploit payloads. We can list all the available payloads using the msfvenom --list payloads command as shown in the following screenshot:

• List encoders: As we have discussed...

Social Engineering with Metasploit

Social engineering is an art of manipulating human behavior in order to bypass the security controls of the target system. Let's take the example of an organization, which follows very stringent security practices. All the systems are hardened and patched. The latest security software is deployed. Technically, it's very difficult for an attacker to find and exploit any vulnerability. However, the attacker somehow manages to befriend the network administrator of that organization and then tricks him to reveal the admin credentials. This is a classic example where humans are always the weakest link in the security chain.

Kali Linux, by default, has a powerful social engineering tool, which seamlessly integrates with Metasploit to launch targeted attacks. In Kali Linux, the Social-Engineering Toolkit is located under ;Exploitation Tools...

Browser Autopwn

Another interesting auxiliary module for performing client-side attacks is the browser_autopwn. This auxiliary module works in the following sequence:

1. The attacker executes the browser_autopwn auxiliary module.
2. A web server is initiated (on the attacker's system), which hosts a payload. The payload is accessible over a specific URL.
3. The attacker sends the specially generated URL to his victim.
4. The victim tries to open the URL, which is when the payload gets downloaded on his system.
5. If the victim's browser is vulnerable, the exploit is successful and the attacker gets a meterpreter shell.

From the msfconsole, select the browser_autopwn module using the use auxiliary/server/browser_autopwn ;command as shown in the following screenshot. Then, configure the value of the LHOST variable and run the auxiliary module:

Running the auxiliary module will create...

Summary

In this chapter, we learned how to use various tools and techniques in order to launch advanced client-side attacks and bypass the network perimeter restrictions.

In the next chapter, we'll deep dive into Metasploit's capabilities for testing the security of web applications.

Exercises

You can try the following exercises:

• Get familiar with various parameters and switches of msfvenom
• Explore various other social engineering techniques provided by Social Engineering Toolkit