In this chapter, we will cover:
Configuring Metasploit on Windows
Configuring Metasploit on Ubuntu
Metasploit with BackTrack 5 – the ultimate combination
Setting up the penetration testing lab on a single machine
Setting up Metasploit on a virtual machine with SSH connectivity
Beginning with the interfaces – the "Hello World" of Metasploit
Setting up the database in Metasploit
Using the database to store penetration testing results
Analyzing the stored results of the database
Metasploit is currently the most buzzing word in the field of information security and penetration testing. It has totally revolutionized the way we can perform security tests on our systems. The reason which makes Metasploit so popular is the wide range of tasks that it can perform to ease the work of penetration testing to make systems more secure. Metasploit is available for all popular operating systems. The working process of the framework is almost the same for all of them. Here in this book, we will primarily work on BackTrack 5 OS as it comes with the pre-installed Metasploit framework and other third-party tools which run over the framework.
Let us start with a quick introduction to the framework and the various terminologies related to it:
Metasploit framework: It is a free, open source penetration testing framework started by H. D. Moore in 2003 which was later acquired by Rapid7. The current stable versions of the framework are written using the Ruby language. It has the world's largest database of tested exploits and receives more than a million downloads every year. It is also one of the most complex projects built in Ruby to date.
Vulnerability: It is a weakness which allows an attacker/pen-tester to break into/compromise a system's security. This weakness can either exist in the operating system, application software, or even in the network protocols.
Exploit: Exploit is a code which allows an attacker/tester to take advantage of the vulnerable system and compromise its security. Every vulnerability has its own corresponding exploit. Metasploit v4 has more than 700 exploits.
Payload: It is the actual code which does the work. It runs on the system after exploitation. They are mostly used to set up a connection between the attacking and the victim machine. Metasploit v4 has more than 250 payloads.
Module: Modules are the small building blocks of a complete system. Every module performs a specific task and a complete system is built up by combining several modules to function as a single unit. The biggest advantage of such an architecture is that it becomes easy for developers to integrate a new exploit code and tools into the framework.
Metasploit uses different libraries which hold the key to the proper functioning of the framework. These libraries are a collection of pre-defined tasks, operations, and functions that can be utilized by different modules of the framework. The most fundamental part of the framework is the Ruby Extension (Rex) library. Some of the components provided by Rex include a wrapper socket subsystem, implementations of protocol clients and servers, a logging subsystem, exploitation utility classes, and a number of other useful classes. Rex itself is designed to have no dependencies, other than what comes with the default Ruby installation.
Then we have the MSF Core library which extends Rex. Core is responsible for implementing all of the required interfaces that allow for interacting with exploit modules, sessions, and plugins. This core library is extended by the framework base library which is designed to provide simpler wrapper routines for dealing with the framework core, as well as providing utility classes for dealing with different aspects of the framework, such as serializing a module state to different output formats. Finally, the base library is extended by the framework's User Interface (UI) that implements support for the different types of user interfaces to the framework itself, such as the command console and the web interface.
There are four different user interfaces provided with the framework namely
msfweb. It is highly encouraged that one should check out all these different interfaces, but in this book we will primarily work on the
msfconsole interface. The reason behind it is that
msfconsole provides the best support to the framework, leveraging all the functionalities.
Installation of the Metasploit framework on Windows is simple and requires almost no effort. The framework installer can be downloaded from the Metasploit official website (http://www.metasploit.com/download).
You will notice that there are two types of installer available for Windows. It is recommended to download the complete installer of the Metasploit framework which contains the console and all other relevant dependencies, along with the database and runtime setup. In case you already have a configured database that you want to use for the framework as well, then you can go for the mini installer of the framework which only installs the console and dependencies.
Once you have completed downloading the installer, simply run it and sit back. It will automatically install all the relevant components and set up the database for you. Once the installation is complete, you can access the framework through various shortcuts created by the installer.
You will find that the installer has created lots of shortcuts for you. Most of the things are click-and-go in a Windows environment. Some of the options that you will find are Metasploit web, cmd console, Metasploit update, and so on.
While installing Metasploit on Windows, you should disable the antivirus protection as it may detect some of the installation files as potential viruses or threats and can block the installation process. Once the installation is complete, make sure that you have white-listed the framework installation directory in your antivirus, as it will detect the exploits and payloads as malicious.
Now let's talk about some other options, or possibly some pieces of general information, that are relevant to installing the Metasploit framework on Windows explicitly.
This is the result of an error in configuring the PostgreSQL server. The possible causes are:
If you face this problem then you can overcome it by downloading the simpler version of the framework which contains only the console and dependencies. Then, configure the database manually and connect it with Metasploit.
Download the setup from the official Metasploit website (http://www.metasploit.com/download).
Again, you will have the option to choose either a minimal setup or full setup. Choose your download according to your need. The full setup will include all the dependencies, database setup, environment etc whereas the minimal setup will only contain the dependencies with no database setup.
The process for installing a full setup is a bit different from a minimal setup. Let us analyze each of them:
$ chmod +x framework-4.*-linux-full.run $ sudo ./framework-4.*-linux-full.run
$ chmod +x framework-4.*-linux-mini.run $ sudo ./framework-4.*-linux-mini.run
The installation process demonstrated above is a simple Ubuntu-based installation procedure for almost all software. Once the installation is complete, you can run
hash –r to reload your path.
Now let's talk about some other options, or possibly some pieces of general information that are relevant to this task.
There can be chances that the installer may not work for you for some reason. Some versions of Ubuntu come with broken libraries of the Ruby language, which may be one of the reasons for the installation failure. In that case, we can install the dependencies separately by executing the following commands:
For installing Ruby dependencies run:
$ sudo apt-get install ruby libopenssl-ruby libyaml-ruby libdl-ruby libiconv-ruby libreadline-ruby irb ri rubygems
For installing the subversion client run:
$ sudo apt-get install subversion
For building native extensions run:
$ sudo apt-get install build-essential ruby-dev libpcap-dev
After installing the following dependencies, download the Metasploit Unix tarball from the official Metasploit download page and execute the following commands:
$ tar xf framework-4.X.tar.gz $ sudo mkdir -p /opt/metasploit4 $ sudo cp -a msf4/ /opt/metasploit3/msf4 $ sudo chown root:root -R /opt/metasploit4/msf4 $ sudo ln -sf /opt/metasploit3/msf3/msf* /usr/local/bin/
On successful execution of the preceding commands, the framework will be up and running to receive your instructions.
BackTrack is the most popular operating system for security professionals for two reasons. Firstly, it has all the popular penetration testing tools pre-installed in it so it reduces the cost of a separate installation. Secondly, it is a Linux-based operating system which makes it less prone to virus attacks and provides more stability during penetration testing. It saves your time from installing relevant components and tools and who knows when you may encounter an unknown error during the installation process.
Either you can have a separate installation of BackTrack on your hard disk or you can also use it over a host on a virtual machine. The installation process is simple and the same as installing any Linux-based operating system.
On booting the BackTrack OS, you will be asked to enter the username and password. The default username for the root user is
rootand the password is
On successful login, you can either work over the command line or enter
startxto enter in the GUI mode.
You can either start the Metasploit framework from the Applications menu or from the command line. To launch Metasploit from the Applications menu go to Applications | BackTrack | Exploitation Tools | Network Exploitation Tools | Metasploit Framework, as shown in the following screenshot:
Metasploit follows a simple directory structure hierarchy where the root folder is
pentest. The directory further branches to
/exploits/framework3. To launch Metasploit from the command line, launch the terminal and enter the following command to move to the Metasploit directory:
You can always have a penetration testing lab set up by using multiple machines and it is considered the ideal setup as well. But what if you have an emergency and you immediately need to set up a testing scenario and you only have a single machine? Well using a virtual machine is the obvious answer. You can work simultaneously on more than one operating system and perform the task of penetration testing. So let us have a quick look at how we can set up a penetration testing lab on a single system with the help of a virtual machine.
We will be using a virtual box to set up two virtual machines with BackTrack 5 and Windows XP SP2 operating systems. Our host system is a Windows 7 machine. We will need the virtual box installer and either an image file or an installation disk of the two operating systems we want to set up in the virtual machine. So our complete setup will consist of a host system running Windows 7 with two virtual systems running BackTrack 5 and Windows XP SP2 respectively.
The process of installing a virtual machine is simple and self-explanatory. Follow these steps:
After installing the virtual box, create a new virtual machine. Select the appropriate options and click on Next. You will have to provide an installation medium to start the setup. The medium can either be an image file or installation disk. For a complete manual on a virtual machine and installation procedure,you can visit the following link:
For a better virtual machine performance, it is recommended to have at least 4 GB of available RAM for a 32-bit operating system and 8 GB RAM for 64-bit. In the next recipe, I will show you a cool way to bring down your memory usage while running multiple virtual machines.
Once the virtual machine (VM) is created, you can use the "clone" option. This will create an exact copy of your VM so in case some failure occurs in your operating VM, then you can switch to the cloned VM without worrying about re-installing it. Also you can use the "snapshot" option to save the current state of your VM. Snapshot will save the current working settings of your virtual machine and you can revert back to your saved snapshot anytime in the future.
Before you start your virtual machines, there is an important configuration that we will have to make in order to make the two virtual machines communicate with each other. Select one of the virtual machines and click on Settings. Then move to Network settings. In the Network adapter, there will be a pre-installed NAT adapter for internet usage of the host machine. Under Adapter 2 select Host only Adapter:
Follow this process for both the virtual machines. The reason for setting up Host-only adapter is to make the two virtual machines communicate with each other. Now, in order to test whether everything is fine, check the IP address of the windows virtual machine by entering
ipconfig in the command prompt. Now ping the Windows machine (using the local IP address obtained from the
ipconfig command) from the BackTrack machine to see if it is receiving the packets or not. Follow the vice versa process to crosscheck both the machines.
Now let's talk about some other options, or possibly some pieces of general information, that are relevant to this task.
There can be situations when we may find that while pinging the Windows machine from the BackTrack machine the packets are not received. That means the Windows machine is not alive. This can possibly be due to the default Windows firewall setting. So, disable the firewall protection and ping again to see if the packets are getting received or not. Also, disable any firewall that may be installed in the virtual machine.
Seamless mouse movement from host OS to virtual OS
Automatic keyboard integration to virtual OS
Better screen size
To install the guest additions, power on the virtual machine, go to the Device tab and click on Install guest additions.
In the previous recipe, we focused on setting up a penetration testing lab on a single machine with the help of virtualization. But there can be serious memory usage concerns while using multiple virtual machines. So, here we will discuss a conservation technique which can be really handy in bad times.
All we need is an SSH client. We will use PuTTY as it is the most popular and free SSH client available for Windows. We will set up an SSH connectivity with the Backtrack machine as it has more memory consumption than the Windows XP machine.
We will start by booting our BackTrack virtual machine. On reaching the login prompt, enter the credentials to start the command line. Now don't start the GUI. Execute any one of the following commands:
This will start the SSH process on the BackTrack machine.
Now find the IP address of the machine by entering the following command:
[email protected]:~# ifconfig
Note down this IP address.
Now click on Open to launch the command line. If the connection is successful, you will see the PuTTY command line functioning on behalf of the BackTrack machine. It will ask you to log in. Enter the credentials and enter
ifconfigto check if the IP is the same as that of the virtual BackTrack:
In this SSH session we can now interact with the BackTrack virtual machine using PuTTY. As the GUI is not loaded, it reduces the memory consumption by almost half. Also minimizing the BackTrack virtual machine will further reduce memory consumption as the Windows operating system provides less memory share to the processes that are minimized and provides faster execution of those tasks that are running in maximized mode. This will further reduce the memory consumption to some extent.
Interfaces provide a front end for the user to communicate with the software or platform. Metasploit has four interfaces namely
msfconsole. It is highly recommended that you check out all the interfaces, but here in this book we will primarily focus on the
msfconsole interface. It is the most powerful and fully integrated interface among them all.
Boot up your operating system on which you have installed Metasploit. If you are using it on a virtual machine then start it.
msfconsole is an easy task. Follow these steps:
For a Windows operating system, you can launch
msfconsoleby going to Start | metasploit framework | msfconsole.
For BackTrack you can browse to Applications | Exploitation tools | Network exploitation tools | Metasploit framework | msfconsole.
To launch it directly from the terminal add the following command:
[email protected]:~# cd /pentest/exploits/framework3
The working directory will change to
framework3. Entering the following command will start our
[email protected]:/pentest/exploits/framework3# ./msfconsole
msfconsole interface is up and running, and ready to receive the commands.
Metasploit interfaces extend the base library which enables them to evoke initial functionalities of the framework. Simple commands, such as setting up exploits and payloads, running updates, and configuring the database can be executed. Once the process grows deep, the other functional libraries are called accordingly.
Let us add some additional stuff that you can perform at this stage with the
Here are some commands that you can try out to explore deeper:
help: This command will list all the available commands for the Metasploit framework that we can use. The commands are categorized into core commands and database backend commands. The former contains commands which are directly related to the framework, while the latter provides commands to interact with the database.
An important feature of Metasploit is the presence of databases which you can use to store your penetration testing results. Any penetration test consists of lots of information and can run for several days so it becomes essential to store the intermediate results and findings. So a good penetration testing tool should have proper database integration to store the results quickly and efficiently.
Metasploit comes with PostgreSQL as the default database. For the BackTrack machine, we have one more option—MySQL. You can use either of the two databases. Let us first check out the default settings of the PostgreSQL database. We will have to navigate to
database.yml located under
opt/framework3/config. To do this, run the following command:
[email protected]:~# cd /opt/framework3/config [email protected]:/opt/framework3/config# cat database.yml production: adapter: postgresql database: msf3 username: msf3 password: 8b826ac0 host: 127.0.0.1 port: 7175 pool: 75 timeout: 5
Notice the default username, password, and default database that has been created. Note down these values as they will be required further. You can also change these values according to your choice as well.
Let us first check the available database drivers.
msf > db_driver [*]Active Driver: postgresql [*]Available: postgresql, mysql
PostgreSQL is set as the default database. If you want to change the database driver then you can execute the following command:
Msf> db_driver mysql [*]Active Driver: Mysql
This will change the active driver to MySQL. In this book, we will primarily be using PostgreSQL for demonstrations.
db_connect username:[email protected]:port number/database_name
Here we will use the same default values of username, password, database name, and port number which we just noted down from the
msf > db_connect msf3:[email protected]:7175/msf3
On successful execution of the command, our database is fully configured.
Let us discuss some more important facts related to setting up the database.
There are chances of an error while trying to establish the connection. There are two things to keep in mind if any error arises:
msf> gem install postgres msf> apt-get install libpq-dev
msf> db_destroy msf3:[email protected]:7175/msf3 Database "msf3" dropped. msf>
If you have successfully executed the previous recipe, you are all set to use the database for storing the results. Enter the
help command in
msfconsole to have a quick look at the important database commands available to us.
Let us start with a quick example. The
db_nmap command stores the results of the port scan directly into the database, along with all relevant information. Launch a simple Nmap scan on the target machine to see how it works:
msf > db_nmap 192.168.56.102 [*] Nmap: Starting Nmap 5.51SVN ( http://nmap.org ) at 2011-10-04 20:03 IST [*] Nmap: Nmap scan report for 192.168.56.102 [*] Nmap: Host is up (0.0012s latency) [*] Nmap: Not shown: 997 closed ports [*] Nmap: PORT STATE SERVICE [*] Nmap: 135/tcp open msrpc [*] Nmap: 139/tcp open netbios-ssn [*] Nmap: 445/tcp open microsoft-ds [*] Nmap: MAC Address: 08:00:27:34:A8:87 (Cadmus Computer Systems) [*] Nmap: Nmap done: 1 IP address (1 host up) scanned in 1.94 seconds
As we can see, Nmap has produced the scan results and it will automatically populate the
msf3 database that we are using.
We can also use the
–oX parameter in the Nmap scan to store the result in XML format. This will be very beneficial for us to import the scan results in other third-party software, such as the Dardis framework which we will be analyzing in our next chapter.
msf > nmap 192.168.56.102 –A -oX report [*] exec: nmap 192.168.56.102 –A -oX report Starting Nmap 5.51SVN ( http://nmap.org ) at 2011-10-05 11:57 IST Nmap scan report for 192.168.56.102 Host is up (0.0032s latency) Not shown: 997 closed ports PORT STATE SERVICE 135/tcp open msrpc 139/tcp open netbios-ssn 445/tcp open microsoft-ds MAC Address: 08:00:27:34:A8:87 (Cadmus Computer Systems) Nmap done: 1 IP address (1 host up) scanned in 0.76 seconds
report is the name of the file where our scanned result will be stored. This will be helpful for us in later recipes of the book.
db_nmap command creates an SQL query with various table columns relevant to the scan results. Once the scan is complete, it starts storing the values into the database. The flexibility to store results in the form of spreadsheets makes it easier to share the results locally or with third-party tools.
After storing the testing results in the database, the next step is to analyze it. Analyzing the data will give us a deeper understanding of our target systems. The results of the database can be kept either for a long time or for a short time storage depending upon the usage.
msfconsole and follow the steps mentioned in the previous recipe to establish the database connectivity. We can either use it to store fresh results or analyze the previously stored results as well. The XML file for the Nmap scan created in the previous recipe can be imported to analyze the previous scan results.
Let us analyze some of the important commands to have a clearer understanding of the stored results:
The preceding screenshot snapshot reflects the output of the hosts command. As we can observe, the result of this command is not very clean, as there are lots of columns in the table. So we can move ahead and add filters and view only those columns which we are interested in, as illustrated by the following command :
msf > hosts -c address,os_name Hosts ===== address os_name ------- ------ 192.168.56.1 192.168.56.101 192.168.56.102 Microsoft Windows 192.168.56.103 Linux
msf > services Services ======== host port proto name state info ---- ---- ----- ---- ----- ---- 192.168.56.101 111 tcp rpcbind open 192.168.56.102 135 tcp msrpc open 192.168.56.102 139 tcp netbios-ssn open 192.168.56.102 445 tcp microsoft-ds open 192.168.56.102 135 tcp msrpc open Microsoft Windows RPC
db_autopwn: This is a powerful command that is used to automate the process of exploiting the target machines that are available in the database. This command requires more understanding about the exploitation process so we will analyze this command later.
The analysis process is simple and can be easily filtered to get the desired results. We have seen how to read the database output and how we can manage it efficiently. The last two commands,
db_autopwn are post-exploitation commands, which we will deal with in later chapters.