Chapter 7. Exploiting Real-World Challenges with Metasploit

Welcome! This chapter is the final and most complicated chapter of the book. I recommend you read through all the previous chapters and exercises before proceeding with this chapter. However, if you have completed all the tasks and done some research by yourself, let's move on to facing real-world challenges and solving them with Metasploit. In this chapter, we will cover two scenarios based on real-world problems with regard to being a penetration tester and a state-sponsored hacker. Both challenges pose a different set of requirements; for example, evasion would typically be more relevant to a law enforcement cyber player than a corporate penetration tester and the case is the same for achieving persistence on systems. The agenda of this chapter is to familiarize you with the following:

• Pivoting to internal networks

• Using web application bugs for gaining access

• Cracking password hashes

• Using the target system as a proxy

• Evading antivirus...

Scenario 1: Mirror environment

Consider yourself a penetration tester who is tasked to carry out a black box penetration test against a single IP in an on-site project. Your job is to make sure that no vulnerabilities are present in the server and on the application running on it.

Understanding the environment

Since we know we are going to perform on an on-site environment, we can summarize the test as shown in the following table:

Number of IPs under scope	1
Test policy	Web applications and server
IP address	192.168.10.110
Summary of tests to be performed	Port Scanning Test for Web application vulnerabilities Test for server vulnerabilities Compromising any other network connected to the target host
Objectives	Gain user level access to the server Escalate privileges to the highest possible level Gain access to the credentials for web and server applications
Test type	Black box test

Additionally, let us also keep a diagrammatic view of the entire test to make things easier for us to remember and understand...

Scenario 2: You can't see my meterpreter

Throughout the previous chapters, we saw how we can take control of a variety of systems using Metasploit. However, the one important thing which we did not take into account is the presence of antivirus solutions on most operating systems. Let us create a backdoor executable of type windows/meterpreter/reverse_tcp, as follows:

We can now put this executable along with any exploit or office document, or we can bind it with any other executable and send it across to a target that is running windows and has an AVG AntiVirus solution running on his system. Let us see what happens when the target executes the file:

Our generated file caused sudden alarms by AVG AntiVirus and got detected. Let's scan our generic.exe file on the majyx scanner to get an overview of the detection rate, as follows:

We can see that 44/70 AVs detected our file as malicious. This is quite disheartening since as a law enforcement agent you might get only a single shot at getting...

Further roadmap and summary

Throughout this chapter, we looked at cutting-edge real-world scenarios, where it's not just about exploiting vulnerable software; instead, web applications made way for us to get control of the systems. We saw how we could use external interfaces to scan and exploit the targets from the internal network. We also saw how we could use our non-Metasploit tools with the help of meterpreter sessions to scan internal networks. By the end, we saw how we could evade AV solutions with our existing meterpreter shellcode, which made it easy to avoid the eyes of our victim. For further reading on hardcore exploitation, you can refer to my mastering series book on Metasploit called Mastering Metasploit.

You can perform the following exercises to make yourself comfortable with the content covered in this chapter:

• Try to generate a FUD meterpreter backdoor
• Use socks in the browser to browse content in internal networks
• Try building shellcode without bad characters
• Figure out the...

The rest of the chapter is locked

Scenario 2: You can't see my meterpreter

Throughout the previous chapters, we saw how we can take control of a variety of systems using Metasploit. However, the one important thing which we did not take into account is the presence of antivirus solutions on most operating systems. Let us create a backdoor executable of type windows/meterpreter/reverse_tcp, as follows:

We can now put this executable along with any exploit or office document, or we can bind it with any other executable and send it across to a target that is running windows and has an AVG AntiVirus solution running on his system. Let us see what happens when the target executes the file:

Our generated file caused sudden alarms by AVG AntiVirus and got detected. Let's scan our generic.exe file on the majyx scanner to get an overview of the detection rate, as follows:

We can see that 44/70 AVs detected our file as malicious. This is quite disheartening since as a law enforcement agent you might get only a single shot at getting...

Further roadmap and summary

Throughout this chapter, we looked at cutting-edge real-world scenarios, where it's not just about exploiting vulnerable software; instead, web applications made way for us to get control of the systems. We saw how we could use external interfaces to scan and exploit the targets from the internal network. We also saw how we could use our non-Metasploit tools with the help of meterpreter sessions to scan internal networks. By the end, we saw how we could evade AV solutions with our existing meterpreter shellcode, which made it easy to avoid the eyes of our victim. For further reading on hardcore exploitation, you can refer to my mastering series book on Metasploit called Mastering Metasploit.

You can perform the following exercises to make yourself comfortable with the content covered in this chapter:

• Try to generate a FUD meterpreter backdoor
• Use socks in the browser to browse content in internal networks
• Try building shellcode without bad characters
• Figure out the...