Metasploit Framework

0:00[MUSIC PLAYING] We've touched on and worked a little with Metasploit, but let's look under the hood a little bit. See in the previous course of enterprise security essentials, we, kind of, hit on Metasploit, but like a beginner level. So in this course, in this skill, we're going to take a look at Metasploit at that intermediate level. And as we continue, we'll start diving deeper and deeper to what Metasploit can actually do for us. Now first and foremost, what is Metasploit?

0:30Well, it's a package of tools that are installed in Kali Linux by default. But Metasploit does stand on its own and can be installed on different operating systems. And we'll touch on that throughout this skill. But together, with all the tools that were put together in the package of Metasploit, we can do a lot of security analysis, pen testing, and even a little bit of hacking as we've seen throughout the preview skills. Now, before we start getting into it, we have to make sure that we now have this is applied in the different arenas that we cover throughout our courses and skills together.

1:01So Metasploit, as a package-- and we've seen different tools and utilities that we can use. As a pen tester, we can definitely use it to attack different systems and make sure that they're not vulnerable. And as a cyber security defense manager or that CIO or CISO, we can use Metasploit to allow us to test the actual defenses on that system before we call in the pen testers. Because even though we're putting out policy and making sure that all of that is implemented with the system and network administrators, the use of Metasploit and the professionals that use it, along with Kali Linux or whatever else that they're using for scanning and intrusion, can go in and test to make sure that those settings were put in correctly.

1:49And it allows us to play in the Sandbox like we're doing in this skill. Now, before we get too far ahead, I do want to point out that VM Tools is suggested to be installed on our VM for Kali Linux moving forward into the future. Now, I point this out because every time that we do an apt update or upgrade, it messes with a plug-in on Kali called fuse. And more recently, it turned into fuse 3. Now, I'm pointing this out because it's required for VM Tools to be installed.

2:20And the benefit of VM Tools is to allow us to be able to bring from-- I don't know if you can see it over here-- this workstation over here into our VM that's hosting Kali Linux, that you see on the screen right now. In the previous skills and Kali, when we were using stuff like John the Ripper or whatnot, we took files like the password the password list, and the scan and stuff like that and dragged into the VM. Now, as you see in this command-- our terminal window, I have right here-- I have already ran the command.

2:50And I'm going to put it right here. And I'm going to highlight it here as well too. This is the command that we use to re-install VM Tools when our Kali box or really any other Ubuntu or POSIX based system does an apt upgrade or apt update and installs different background programs that VM Tools is used to running off of. Now, originally, this program-- VM Tools-- if you'll notice, I have the flag of reinstall on there.

3:21Because at the end, it says fuse3 now. And we're using our fuse before. Fuse 3 is the current one that the POSIX based systems are running all their programs through and on and stuff like that. And you'll see right here that whenever we do a reinstall, all these programs right here are packages that are required to run VM Tools or whatever it is that we're installing. You'll get this list right here too. And if there's anything that it needs to upgrade, it will ask us. Now, all the way down at the bottom, you can see that it's going through and doing its installs and its checks and everything.

3:57And right here, down at the bottom-- what did I do? Ah, I went ahead and hit up and accidentally hit it. So I hit no on that. Because I don't want it to go through the process again. But right here, we can see this is what we're looking for right here. The VM Tools is installed. And it's running, specifically, as the service of vmtoolsd. And you can see right here on the top right of the screen that I have to do a restart. Now, I know that this is not directly related to Kali, but I did want to point this out because it makes working with Kali a lot easier at home.

4:32That way we can drag in and out of our VM system. Let's say we want to take an extract of some passwords that John the Ripper did and we say, to the desktop. Instead of having to open up an SMB channel or any other file transfer, we can just select the file and drag it over to our host desktop and it won't be a problem. Now, also that's not specific to the VM workstation environment that we're running. I just happen to be running 16. If those at home are playing on VM workstation 14 or 15 or any other edition, this is specific to the operating system of Kali Linux or POSIX based systems inside of that VM environment.

5:12It's not necessarily something we have to do on the station itself. So that's, kind of, the overview of what Kali is, and some stuff that we need to do to make sure that throughout this skill and future skills, that we're prepped and ready to go. So let's go ahead and do it to it.

0:00[AUDIO LOGO] Let's review Metasploit on Kali since we've seen it in use already. And to do that, we're going to hit on some of the things that we've already seen in previous skills and courses. But let's go ahead and take a detailed look at what actually happens when we start up Metasploit and look at some of the tools. OK, we're in our VM Kali box, and we've seen this many times before. Now, there are different ways to start up Metasploit. But we're going to take the easiest route and hit Start on the top left and make sure we type in Metasploit and you'll see it come up as the Metasploit framework.

0:36Now, when this initially starts up and opens up, it's going to ask us for our sudo password because this needs to be ran as admin as it's accessing a lot of the internal operating system and some of the other applications in that elevated permissions level. Because you can't exactly do scans and use the operating system like this as a regular user. So we go ahead and type in our password and start up. And you'll notice that it's starting up a database. Because there's a lot of stuff that's installed in the background, which we'll go through in a little bit. And as this is starting up, one of the best things that I like to see on this is it starts up with some weird ASCII art when it cranks up initially.

1:15When you see that ASCII art, you know that Metasploit has been fully started up and is ready to go. So let's scroll up a little bit and see what they gave us the Oregon Trail. And [LAUGH] we died of dysentery. Now, one of the first things that we need to do when we have Metasploit open is we need to assume that we've already done a lot of reconnaissance work using tools like Nmap, Zenmap, Wireshark, Nessus, and we'll touch on this a little bit later in the skill, too. And as you can see here, I typed in the use command down here at the bottom.

1:46Let me highlight that for you real quick and because there are different modules that we can actually use within Metasploit. Now, there's a lot of them. So it's not a problem if we go and look for help or if we have a list at home of what modules that we commonly go to use for different sorts of things. And for that, I want to point us to an actual website that is written by Metasploit and Rapid7, the folks that developed the Metasploit is kind of a how to guide to get started with some of the module searching and whatnot.

2:18Now here, I have on the screen the actual Rapid7 startup guide and other guides for Metasploit. And I would highly encourage to go through this and look up some of the different instances that we can run inside of Metasploit and more detailed documentation on what it's actually doing behind the scenes. And as we can see here that they have a basic demonstration of different phases of the investigation process that Metasploit can actually be used on. What we're taking a look at specifically are the modules.

2:50Now, this is further down, and I'm going to put the website below as well, too make sure that everybody at home that's playing along can actually go through and see what's actually in here. Now, because there are different modules that we can use inside of Metasploit, we can actually use the search command as well, too. And we're going to take a peek at one of these and see what they present for us as we do a search. So right here, we see that they're in msf-pro, which is a sub running system of Metasploit.

3:26And we're going to search for the exploits. Now to do that inside of our Kali Linux Metasploit, we're just going to stay in the regular MSF 6 command prompt or terminal prompt and type in show exploits down here at the bottom. And we're going to hit Enter, and we can see that it comes up with a lot of different exploits. Now, the reason that these exploits come up and why we would use them is to align it with whatever vulnerabilities we find on a specific system. Now for instance, let's say that we scan a system later in this skill.

3:58And we see that we have the 2229 exploit/windows/smb/psexec. And this is the year and date that that vulnerability came out, Microsoft Windows Authenticated User Code Execution. And we would see that pop up in one of our vulnerability scanners and use that specific exploit to be able to create a reverse shell, go inside SMB for enumeration. So that's where Metasploit ties into all of our investigation and reconnaissance phases for the different incident handling process.

4:33Now, there are so many of these that we can't always keep a track of. See, there's many, many, many, many, many of them. And that's why it's always good to have a Notepad or a cheat sheet at home for different ones that we use. Don't be afraid to Google search or Metasploit search on the Rapid7 site for anything that we need. Now, the nuts and bolts of Metasploit there's msfvenom, which we've used a couple of times previously. But now, we're going to take a deeper look at how to get it ready and configure.

5:04Because msfvenom, in them allows us to be able to do a couple of things. But one in particular is create a Trojan Horse for a targeted system, whether it be maliciously or pen testing wise. But we're doing it pen testing because we're legal. And here on our desktop, I have a demonstration of how we are using msfvenom, to create the actual package that we'll go over to a targeted system. So I'm going to walk through this. I'm going to have it on the bottom of the screen as well. So we're using msfvenom-p. And this identifies which exploit or package or module that we're actually using inside of Venom to be able to create this package.

5:41And for this one, we're using Windows, which is under the main Windows group for 64-bit systems. And we're going to use the shell reverse TCP. And what this does is it creates a backdoor channel. Now, I've actually made a mistake in here. Let me fix this real quick. This is targeting that IP address right there for local host. It's supposed to be this system because it's reaching back to here. Now, the next port-- the next one is port. And port we're going to do this communication on, and we're always going to default to 4444 because it's a default that's used in all documentation.

6:18And the -f indicates that we're going to create this as an executable. And it's Pacmanned out to a directory so that we know where the file is actually going. So we don't have to do a lot of hunting for it. Now I'm putting this on the desktop. Give me just a second to fix the actual IP address, and we'll create it. OK, so our IP address is fixed. We're going to hit Enter. And we can see that it's already starting to create an actual package. Now when this gets created, we can see that on the bottom of the desktop, not this one.

6:48There it is right there. I'm moving it right here. This is the shell x64 executable and if we right click on it and go to Properties, we can see that this is a DOS Windows executable file. And this is something that we would be able to execute here. And we can check this out by opening a terminal here on the desktop and doing an ls-la. And let's look around for it right here and see that is not listed as executable like the others because again, this is for a Windows system.

7:22Now we could make in here for POSIX based system. But once this file is opened up, we can actually create a listener on Metasploit and open up a backdoor channel through the reverse shell portion of this actual package. Now using VM tools, I was taking this file and moving it to my desktop to move it over to the actual server 22 VM host, and this popped up. And that's because this is noted as the package itself is made in Metasploit.

7:55So it's a known problem inside of third party applications such as Symantec. Now, this one in particular, we're just going to undo action taken and start our undo, and it's back in our folder so we can move it over. But I just wanted to point this out that when we do stuff like this, keep in mind that some of the packages that we build will be picked up by third party antivirus or antimalware applications. OK, so I've dragged that package over to the server 22, which we have open here on screen now. And you may notice that my folder is empty.

8:26Well, if I go into the command prompt and see what's actually in there, I can go into stuff and type in a dir and I can see that nothing is in there either. And that's because when the packages are made, they're usually made as default hidden. So we're going to go into View and view our hidden files and see boom, chakalaka, there it is. So what can we actually do with this? Well, do keep in mind that this may pop even the Windows basic security settings, and you may have to allow it for a demonstration purposes only. And simply, we just run it.

8:58We're going to run this as admin just for a minute, and we can see that there's our threat. We're going to go in and allow this on here. And we can see that it's, I don't know if you saw it right there, but it was a Trojan Horse. And I'm going to make sure that this actually runs in the background to fix this real quick. Yep, here we go. Allow on this device, and see if we can run it again. Now, if we open up our Task Manager, Control Shift Escape and go into Details, scroll down to the S, and see if we can see this actually running.

9:34Let me move this over just a little bit and run this again to see if we can get it to pop up. There it is right there, process ID 4680, and it closed real quick. And the reason that it closed is because we don't have our listener open on the actual Kali box so let's fix that. We have set up our Netcat listener on port 4444, which was how we built the msfvenom package, put the command below is usual. And as you can see, we already have it starting its listening process. So we're going to jump back over to the server 22 box and execute our executable that Venom made.

10:08OK, so we're here. We're going to right click Run as administrator just to kind of circumvent a bunch of stuff. And it's running in the background. Let's pop over to our Kali box real quick. And we do have a connection from that server. Now, in previous skills, we've already gone over how to exploit Netcat and get it to run from behind the scenes. So we're just doing a demonstration of how to get that msfvenom within a package over to a box easily and what it does behind the scenes. Now obviously, there's a lot more that goes into this as far as making that Trojan Horse and having them select it.

10:40And we've covered this already by how to use social engineering if you will, to go in and do some of this behind the scenes. So we've got to make it to where it's enticing on that particular box to go in and click on and to run behind the scenes but also to get it to where it avoids stuff like third party and even the Windows antivirus and anti-malware detection. There's all sorts of stuff that goes into this as far as staging an attack on a system, whether it be for malicious or pen testing purposes.

11:11Now, this can be done with many other packages and many other modules inside msfvenom. I just wanted to point out here that Venom is used to build those packages inside of Metasploit. So in the next few Nuggets, we're going to be covering other possibilities inside of Metasploit aside from just making that Venom package. I hope this has been informative for you, and I'd like to Thank you for viewing.

0:00[AUDIO LOGO] Throughout our skills together, we've seen Metasploit on Kali and used it a good bit. But what if we didn't want to use Kali only for our pen testing? And that's where we can put Metasploit on those Windows-based systems, or wherever else we want-- let's say, like just in a basic Ubuntu box. Now, why would we do this? Well, as a pen tester, it comes down to comfort-- comfortability-- comfort. It comes down to comfort because we are better with tools that we're more familiar with.

0:32Now, yes, we do need to learn other tools and other traits and trades, and stuff like that. But if we know we have something that works, why go away from it? And there are plenty of pen testers out there in the field right now that are using Metasploit and many other tools on Windows-based systems. There's a couple of behind-the-scenes technical reasons as well too, because as in previous skills, we've seen where we have to allow certain connections and protocols between Windows and POSIX-based systems, whereas if you know you're going into a Windows-heavy environment and they run Active Directory and they have all these file share servers that we've demonstrated before, that Windows box that's running stuff like Metasploit and other tools like Netcat, which we've done in the past, is a whole lot better in that environment because that's stuff that we don't have to reconfigure or work around on that network infrastructure overall.

1:26And so in this Nugget, we're going to be taking a look at how to put Metasploit on an actual Windows-based system and take a look at some of the commands needed to put it on an Ubuntu box as well too. And kind of get a familiar feeling on how to do all this behind the scenes so that way if we're out in the field, we can have a copy of it. Or if we're staging new boxes, we can prep some for the field use as well. Back to picking on our Windows Server 22 VM since we've already messed it up beyond recognition.

1:56So we go to the metasploit.com/download page. And I'm going to link it right below here. And if we click on Download, it'll take us to a page where all the wikis are and documentation that we've seen before too. And we can go to the-- it sends us to a document link. Now, scroll down just a little bit, and you'll see right here, Installing Metasploit on Windows. And that is the direct link to download the executable and package. I believe it's MSI here for Metasploit. And we can see that it's downloading. It's roughly 267 megs.

2:29And we're going to open it in folder. Now, at the snap of the fingers, this download is going to be done, and we're going to start installing. Wouldn't you know it, just like that, it finished. So let's go ahead and right-click. Go Install. Now, this may ask for admin rights on your specific system. That depends on how it's set up. But here I have that turned off under the User Access Control. We're going to hit Next. And we accept the terms. We're going to install it in a specific folder.

2:59We're going to call it metasploit, if I could spell it correctly, because by default, it wants to go to C drive. And we don't want to install the whole package there. It becomes a mess, and it also accesses some other problems too. And other than that, we just hit Install. And by the time this is finished, we'll take a look at what's actually going on inside of that folder and behind the scenes. And it's finished. So let's go ahead and close that. And then go to our C drive install folder of Metasploit. And make sure that we have everything there.

3:31And we do. Now, this is going to be a little bit weird because in Kali and POSIX-based systems, we can just go to our terminal and just say, sudo metasploit, or hit it in the Start menu. But we could see here that we have many different things that we run inside of this folder. So let's go ahead and open up our Command Prompt. Now, it would appear that I totally forgot that Ruby is required to run in the background whenever we have Kali-- or excuse me, Metasploit on a Windows-based system, because as you can see here, there's a lot of .RB files that Metasploit's running, or is required to run.

4:06And Ruby is the actual background databasing and coding program that this was built off of. So we went over to our Downloads page, and we installed Ruby in the background. And we're going to restart Metasploit. Now, I'm going to put this link right here that we have on the screen below as well. So that way, not only can you find Metasploit package for Windows, but you can also find the Ruby installer for Windows-based systems as well too. And they do make it for 64- and 86-type processors.

4:37Now, we've cleared off our Command Prompt. So that way, we don't have all that mess back on there. And we're going to restart our msfconsole.bat in the console itself, after we've installed Ruby. Now, Metasploit has started because this time we have a cow. But as you saw in the bottom right-hand corner, Windows popped up with a security error. Now, we're going to see if we could take a look at that because, natively, Metasploit does trigger some of the stuff that's on Windows and other third-party applications, like Symantec, which we've seen before.

5:07Why does it do that? Well, because we use tools like MSFvenom to build those packages. And the core programming of those packages is built inside of Metasploit, along with a bunch of other tools. So it will pop on the security systems and other third-party apps as well too. That's why whenever we go out and do some of our pen testing, we have to do it on a system that is either configured to allow these programs to run or do it on a system that doesn't have any kind of third-party or native antivirus or antimalware software on there at all.

5:41And just like that, we have our MSF 6 console for Metasploit, just like we do in our Kali system. And it pretty much ran the same as it is from here, because we can go in and type use. I think it's question mark? Yes. So instead of the --help or tabbing over and getting all the other possibilities on there, inside of Windows, you could use a question mark. And it gives us all the different uses that we can have. We see exploits. We see post. It's 99% the same as what we have inside of the Kali version of Metasploit.

6:17Natively, inside of our Ubuntu box, we don't really have anything to get Metasploit except by the way we did on Windows. Now, we could easily open up our browser and go to the Download Metasploit page. Go into the documents, and go straight to the Linux manual installation, which is right above the Windows portion. And it takes us to a directory tree, where all the individual files are. And we could do a manual install. But we can actually cheat just a little bit.

6:48And to do so, we have our terminal opened up here. And we're going to be taking a look at our /etc/apt/sources.list. And I'm going to put that right below here. The reason we're going to go in in gedit it and take a look at it is because this is where we point the POSIX-based systems to an update repository. Now, there's a lot of commented-out sections, like with the pound signs here. But we can see, like on line 26 of this one that I have highlighted, this is not commented out. And this tells Ubuntu to use the us.archive.ubuntu.com/ubuntu for local multiverse, blah, blah, blah-- basically, where to get its update from.

7:30So when we do an apt-get or apt install, apt upgrade, apt update, and et cetera, et cetera, this is where it's pointing to, to do that. Now, at the bottom here, I've added this line. And this is the line that we have inside of our Kali versions that we have out now. This is one of the repositories that we have to point to be able to apt whatever we want that's inside of Kali. Now, I'm putting this here. So that way, when we do an apt upgrade, apt update, and all that other great stuff, we could use it to get Metasploit inside of our terminal window without having to install all those ridiculous files.

8:07So very easily, we're going to type in sudo apt install-- if I could spell correctly today-- metasploit-framework. And again, this will be on the bottom of the screen. And it's going to go through reading its packages from all the lists that are in there. And I might actually have to restart. My mistake was that I just forgot to do an apt-get update. So we're going to run that real quick. Let's go in here and work it. Now, if you get this error, this is a certificate error coming from Kali to an Ubuntu box. We're simply going to bypass that here, instead of going through and getting the keys and all that great stuff, because we can remove the apt-get site out of our gedit later.

8:47We're just going to allow insecure repositories on the apt-get update. And I'll put this command below as well too. We type that in. And we can see that Kali is starting to roll the updates for this particular system as well. Now, once this completes and we get the apt-get update, the repository is built on the local system. So we can add in sudo apt-- or install Metasploit framework, which we'll do here shortly. And after the repository has been built from the Kali site, we're just going to type in sudo apt install metasploit-framework with a dash in there.

9:20And we can see that it comes up with all the requirements that it needs, because there's a lot of stuff that runs in the background for Metasploit overall. Now, we're going to do the default yes on this because this will install all the background requirements along with Metasploit itself. So let's go ahead and hit Enter. And install these packages without verification? And for the purpose of this one, yes, because this only pops up if we're allowing an insecure repository like we are here. See, remember, we bypassed the actual key retrieval when we added this inside of our sources.list.

9:52So we're going to hit yes here. And it's going to go through and start doing a lot of downloading. And again, at the snap of the fingers, we'll be at the end of this. 1, 2, 3. Once it's all done, we'll get the obligatory-- or mandatory restart on the system. And yes, we're going to restart all the services and everything. And display manager must be restarted manually. So again, this is just requiring a bunch of restarts. Good practice is that once we have all this installed on the actual system-- and this has actually just started the installing.

10:27It was doing the downloading first. But we restart after all this is done. And that's what we will do. It'll just be done off screen. So when all this is done, we'll have come back from a restart. And we're rebooting our Ubuntu box that we set up with the Kali stuff, mostly for the Metasploit. And if we notice that Ubuntu has turned basically into Kali at this point. And we could say here by the Kali GNU/Linux Rolling ubuntu logon prompt. It still says ubuntu login, but it is a Kali box.

10:58At the end of the day, installing Metasploit on any operating system is possible. You've got to work around some plugs here and there and make sure some add-ins and plug-ins are installed, and stuff like that. But we can install Metasploit and use it on just about any operating system. Now, in the next Nugget, we're going to go over and review how to prep a target for Metasploit to attack. I hope this has been informative for you, and I'd like to thank you for viewing.

0:00[AUDIO LOGO] We're ready to use Metasploit on a system, and we've seen there are many options to use. But how do we know which ones are the best? Well, we have a couple of options that we can do here because we have other tools and resources that we're capable of using to identify a target, figure out what vulnerability there is, and select the actual course of attack that we want to proceed with. Now, scanning comes first. And we can do scanning inside of Metasploit.

0:31And we can use other programs out there that are third party, like Nessus, to figure out if there are vulnerabilities on a specific system that we can leverage against that fall within that exploit category of Metasploit. And within our Metasploit inside the Kali box, we have our Server 22 virtual machine running also on the side. We'll come back to that in a second. But we're going to be using Metasploit to do a port scan on that particular system, which is something that we normally do inside of in Nmap and Zenmap. We'll come back to that in a second.

1:02Now, there may be a couple of bad cuts here because I can't really tab while I'm inside of VM and Metasploit. So I am going to put the commands on the bottom of the screen. And right now, we're going to use auxiliary/scanner/portscan/tcp. And this is a built-in scanner inside of Metasploit that we can use to gather just a little bit of information. So as with most uses and exploits and auxiliaries that we have inside of Metasploit, we have to set the host and the ports.

1:32And in this case, it's going to be remote host. So we're going to set RHOSTS to-- capital S. Ah, terrible at typing today. 192.168.247.130. And then we're going to set our PORTS to whatever ports that we want to scan to see if they're open on that particular system. Now, we can scan multiple systems using this. But we're only selecting one system right now. It makes it a bit easier on us when we're looking at the results for a second.

2:04Now, we're going to scan 80 and 443, just out of curiosity, because we also know from doing previous skills together that Server 22 box on the VM is also an IIS and does some other stuff as well too. It does everything at this point. But we're going to run, and we're going to type -vv so we get verbose-- verberose-- get more information when we do the run command. And when we do that, we can see that 443 didn't come back.

2:34But on this line right here, 80 is open. Now, if we wanted to get more information other than this, we would definitely do a Nmap or Zenmap. And we're going to check that in just a second to see if it correlates with what we have here. But we can also do a set ports to, let's say, 1 to 1000. My bad. And then, run -vv. And it will scan all the ports going from 1 to 1000 to see what's actually open and put it in an output for us right here.

3:09Now, right off the bat, it says 80 is open. And it's going to go through the other ones until it reaches 1000. Now, while this is ongoing, let's go ahead and open up our Zenmap. And we can see here that 135, 139. Now, those are good to know if we're knowledgeable on our standardized ports and even some of our nonstandards, because we know that that's the tip-off for a Windows system. But we can use Zenmap to correlate information from Metasploit to make sure that not only are they open, but we're actually getting the system that we want.

3:41247.130. And we're just going to do a quick scan on this system because we're making this demonstration pretty quick. And we can see here that port 80 is open on that target, as it is in the Metasploit scan. But in Zenmap-- Nmap-- it tells us that it's HTTP. So we know that it's actually being used for what it's standardized for. If we're doing a sandbox or a honeypot, if we're trying to elude somebody, if you will, then that may or may not be what it's for.

4:16We could set port 80 for FTP. But this is what we have here. We have that one quick scan done. And those should be the only four ports open. And when it reaches 1000 on the Metasploit side, it'll come back and say, that's it. And just like that, at the bottom, we have "Scanned 1 of 1 hosts complete." And the four ports that popped up inside of Metasploit, as far as what's open, were the same ones that popped up inside of Nmap/Zenmap. So we know that Metasploit, if that's all that we have, can be used as a port scanner along with a vulnerability exploiter.

4:51And there are many other uses. We're just tapping on some of the ones that need to be addressed. Now, we also know that we can use programs like Nessus, which we've done in previous skills. And I would encourage to go back and watch those because I don't want to rehash something that we went way in-depth on. Nessus basically told us, on a particular system or systems, what the vulnerabilities were, based on the definitions that we had loaded up. So if we worked inside of DoD, we could use certain predefined definitions coming from DISA. Or if we worked on the outside, we can use definitions that came from OVA?

5:26SCAPs, that's what I meant to say. I totally was spelling it out S-C-A-P and totally didn't goof up there, because SCAPs is built off of stuff like IAVA reports that are predefined definitions that know what to go in and scan against on that particular system. Now, when those reports come back, that's where we start using Metasploit, like we have in previous skills and Nuggets, to go through and use that proper exploitation that aligns with that vulnerability to do stuff like reverse TCP shells, or DetCat, or however we want to do it.

6:00Now, we could do it through reverse shells, or we can do it through Trojan horses, like hiding the exploit inside of a file and letting them open up on a system. Or we can do what we did a couple of skills ago and start hiding it in some macros to where they download it, and they never know it. Now, in the next Nugget, we're actually going to get into some of the other tools that Metasploit has. We've touched on them in the past. But we want to make sure that we have a good understanding that they do come with Metasploit, because as we upgraded our Ubuntu system and accidentally morphed it into a Kali box, these are the tools that we're going to have on there that allow us to be able to go through and do some of the exploits that we're asking about.

6:36I hope this has been informative for you, and I'd like to thank you for viewing.

0:00[MUSIC PLAYING] We understand the basics of Metasploit, but let's compare the whole package to a base install. I want to sit here and crack a password inside of our server 22. And I know that we have Metasploit installed on the actual system. Now, we have to open this through-- its inside of our bin folder that we installed this on. So let's go inside of our command prompt and make our way over there.

0:30And see if we can do so. So CD, desktop-- CD, Metasploit-- oh, wait. My bad. CD, C drive, Metasploit slash bin. And we're going to open up the MSF console-- dot bat. Now, while this loads up, we can already see in here that these are the different programs that come with Metasploit when it's installed on a non native system like Kali.

1:00Now, I say, non native. Metasploit is its own program, but it's integrated into Kali with all the bells and whistles that come with it as well too. So inside of here, just looking at the directory, we can see that there's already a bunch of stuff that we're missing, because we can go back over-- while this is loading on here-- and already know that our port scan is one of the tools that we can use inside of Metasploit. Well, we have a PE scan, but that's for processes.

1:31And RPC, RPCD-- but there's not a lot of stuff in here. Metasploit, on its own, is a standalone, does not include stuff like John the Ripper, Hashcat, Netcat. The scanning utility that we had on here. And that's because it's only been used as an exploit tool right out the gate. That's all there is. So it's assumed that if you're installing Metasploit on a particular system, let's say like Windows that we did, then for sure that you're going to be using it only for that attack method.

2:04And you've already done all your reconnaissance work to make sure that everything's vulnerable like we did here in the previous Nugget. Now, we have started up our Metasploit console inside of Windows. It opened up fully and already ran commands because, like a goof, I would just talk to a camera and didn't have it recording for a little bit. Ha-ha. So we're going to do a platform search, which I already did. And we use search platform colon windows. And we hit Enter. And we have 2,257 different things that we can do to a Windows platform.

2:37Now, not all of these are exploits. Some of these are payloads. Some of these are shell codes. Some of these are different ways to actually go in and mess with the Windows box because we can use this in conjunction with reverse TCP, bind TCP, blah, blah, blah, blah. Now, even though there's a lot of them in here, the difference between this and what we have on an actual Kali box can be significantly different. As we go down here, we have 260-- 2260, which is there's a few more on our Kali box.

3:11And that's because we have tools that are natively installed inside of Kellie that come with Metasploit in that natural environment. Remember, when we're installing Metasploit on a non native system like Windows, we only get the core infrastructure. And we're assuming that all of the reconnaissance and detailed work that went into finding the vulnerabilities has already been done. Now, when it comes to actually cracking passwords inside of our Windows environment here, using Metasploit, that's not really possible. And we have other programs like [INAUDIBLE] John the Ripper for Windows, et cetera, et cetera.

3:45And we go back into Kali. And we can see that not only when Metasploit is installed, we also have tools like John installed. John the Ripper. These all come in the background of Metasploit for that Kali Linux environment because it was packaged as such. And I do want to point this site back out again. It's the docs.rapid7.com site where we have all the documentation for Metasploit. And again, highly encouraged that we go review it at some point. But this is just the big idea of basic commands and et cetera, et cetera.

4:17Because you could do here like show exploits. And there are other tools and tricks that we could use inside of Metasploit for Kali that don't necessarily pop up inside of Windows. And for instance, there's a lot of reporting that can be done inside of Metasploit. This is the GUI format for Windows that you have to install on top of what we have inside of Windows. So let's go back and take a look at our Windows VM for a second. The only thing that we got inside of our Metasploit for Windows-- when we downloaded it-- were all these command line features that we go in and basically run it like we're in a Linux box or Kali box.

4:56There are other things that we can install on top of this. Specifically, inside of Windows like that GUI. But these are different downloads that we constantly have to keep obtaining for this one system in order for it to make sense and work together. Now, that's why using Kali in its native environment or Metasploit in its native environment for Kali, there may not be a GUI, but everything's already installed in itself. And it's prebuilt to support all the tools that Kali has to offer. Now, in the next Nugget, we're going to take a look at some of the other options out there outside of that regular Kali framework that has Metasploit integrated into it.

5:35So that way, if we run across a situation or a system to where we don't have everything right there in front of us, we, kind of, know how to work around it. I hope this has been informative for you. And I'd like to thank you for viewing.

0:00[AUDIO LOGO] Metasploit has a lot of bells and whistles, but are there other options out there for us? And the answer to that would be yes, because we've seen in previous skills and Nuggets that there are many tools that we can put together to make up for the lack of Metasploit on a particular system. Now, why wouldn't we be able to use Metasploit? There could be a couple of reasons. Let's say that our pen testing group inside of our organization, the CIO, the CISO, or whoever the actual network owner is, has said, don't use Metasploit, for whatever reason.

0:38It's not for us to argue. It's just for us to nod our heads up and down and smile. But that also means that we have to find other ways to work around the fact that we can't use Metasploit. And if you think I'm stretching the truth there a little bit, inside the DoD, Metasploit is very frowned upon. And we do have to use other stuff besides that. And that's where stuff like John the Ripper comes in. But if we're on a Windows box and can't actually employ John the Ripper inside of Metasploit, we use programs like Hash Suite, which I'm pulling up here on the screen now.

1:10And we've seen this-- sorry, let me get my double vision, inception out of there. And we've seen this many times and used it before. And this is also a kind of a Hashcat or a hash identifier method as well too, because we can start using this to identify where the hashes come from is whether they're NTLM or LM hash, et cetera, et cetera. Now, there are other tools also. We're back at our Windows Server 22 VM. And we have enum, which we've used before to tell us what other systems out there that we can enumerate from inside of that workgroup or Active Directory environment.

1:48We can enumerate the users. We can enumerate the groups. We can enumerate a lot of information about that domain and tell-- or even a workstation-- and tell us what it is that we're looking for that we need to start exploiting, because let's say that we do have Metasploit installed on a Windows box and we are allowed to use it. We can correlate some of the information that we gain inside of the Hash Suite or inside the enum tools, and go in and start looking at what's allowed in here as far as our exploits.

2:21We can do a search and see if there's anything that lines up. Now, there's also some other stuff too, as we've seen in here, that we can do-- or in the Kali side-- that we can actually do a minimized port scan to see what's going on. And of course, you can come down and open up our Zenmap. I don't know why it opened up back there. Let me grab that real quick. I'm going to grab that and bring it over here. Come on. And we can see that this is our native Nmap for here locally.

2:52It's the same information that we get inside of Nmap. But Nmap does come in the background of Kali and Metasploit in that native environment. Now, on the Windows systems, do we have it? No. And we can probably find a way to have Metasploit do that wonky little scan for us. But in here, we've seen many times-- and I'm not going to stick around for the results of this-- that we can go through here and get all the detailed stuff, even OS fingerprinting to give us more information, which again, aligns with what we can do inside of Metasploit, when it concerns picking the vulnerability or exploit.

3:27Now, lastly, we're going to be touching on the last one that we used. And I think it's inside of tools. I sent it to the recycling bin because we were done with it. And I already deleted it. But Netcat. We've used Netcat a few times. And in the Metasploit world, this is usually referred to as reverse shell or reverse TCP, where we can send the command prompt through the reverse shell to the actual Metasploit machine that's handling it. And we can go from Metasploit to a box like this and actually pull up commands, which we've done, inside of the Command Prompt with root access.

4:02And this is something that we could use to circumvent Metasploit if we're not allowed to use it on a system. We just have to find a way for them to be able to put Netcat on their system. Now, we've gone over those nefarious ways to do it. But for those of us old enough to remember stuff like Dameware, it's not that hard, because you just tell the person that it helps them in their computing world. And magically, they do it and get infected. The point of the story is that there's more than one way to skin this cat. And Metasploit is not the only way to do it.

4:33Metasploit just happens to be a commonly used tool inside of the pen testing world. And the reason that we cover it so much and different aspects of it-- like, in this skill, we're really getting under the hood in how to use it and what we could use if we don't have it. And in the previous course, we just got into-- this is it. This is Metasploit installed on Kali. And we're doing all that because if there were a certification exam covering this skill or course, it may ask a few Metasploit questions that I am 100% sure we covered all of that content up until now and in the upcoming skills.

5:08But it's always good to know that Metasploit is there for a pen tester and the baddies, if they want to use it. But we know how they work it. So we can block against it. That wraps up this skill for Metasploit. I hope this has been informative for you, and I'd like to thank you for viewing.