Mastering Metasploit: Exploit systems, cover your tracks, and bypass security controls with the Metasploit 5.0 framework, 4th Edition

Cover
Title Page
Copyright and Credits
About Packt
Contributors
Table of Contents
Preface
Section 1 – Preparation and Development
Chapter 1: Approaching a Penetration Test Using Metasploit
	Technical requirements
	Organizing a penetration test
		Preinteractions
		Intelligence gathering/reconnaissance phase
		Threat modeling
		Vulnerability analysis
		Exploitation and post-exploitation
		Reporting
	Mounting the environment
		Setting up Metasploit in a virtual environment
	The fundamentals of Metasploit
	Conducting a penetration test with Metasploit
		Recalling the basics of Metasploit
	Benefits of penetration testing using Metasploit
		Open source
		Support for testing large networks and natural naming conventions
		Smart payload generation and switching mechanism
		Cleaner exits
	Case study – reaching the domain controller
		Gathering intelligence
		Using databases in Metasploit
		Conducting a port scan with Metasploit
		Modeling threats
		Vulnerability analysis
		Exploitation and gaining access
		Post-exploitation kung fu
	Revisiting the case study
	Summary
Chapter 2: Reinventing Metasploit
	Technical requirements
	Ruby – the heart of Metasploit
		Creating your first Ruby program
		Variables and data types in Ruby
		Numbers and conversions in Ruby
		Conversions in Ruby
		Ranges in Ruby
		Arrays in Ruby
		Methods in Ruby
		Decision-making operators
		Loops in Ruby
		Regular expressions
		Object-oriented programming with Ruby
		Wrapping up with Ruby basics
	Understanding Metasploit modules
		Metasploit module building in a nutshell
		Understanding the file structure
		Working with existing Metasploit modules
		Disassembling the existing HTTP server scanner module
	Developing an auxiliary – the FTP scanner module
		Libraries and functions
		Using msftidy
	Developing an auxiliary—the SSH brute force module
		Rephrasing the equation
	Developing post-exploitation modules
		The Credential Harvester module
		The Windows Defender exception harvester
		The drive-disabler module
	Post-exploitation with RailGun
		Manipulating Meterpreter through Interactive Ruby Shell
		Understanding RailGun objects and finding functions
		Adding custom DLLs to RailGun
	Summary
Chapter 3: The Exploit Formulation Process
	Technical requirements
	The absolute basics of exploitation
		The basics
		System architecture
	Exploiting a stack overflow vulnerability with Metasploit
		An application crash
		Calculating the crash offset
		Gaining EIP control
		Finding the JMP/CALL address
		Gaining access to a Windows 10 machine
	Exploiting SEH-based buffer overflows with Metasploit
		Using the Mona.py script for pattern generation
		Understanding SEH frames and their exploitation
		Building the exploit base
		The SEH chains
		Locating POP/POP/RET sequences
		Exploiting the vulnerability
	Bypassing DEP in Metasploit modules
		Using ROP to bypass DEP
		Using msfrop to find ROP gadgets
		Using Mona.py to create ROP chains
	Other protection mechanisms
	Summary
Chapter 4: Porting Exploits
	Technical requirements
	Importing a stack-based buffer overflow exploit
		Gathering the essentials
		Generating a Metasploit module
		Exploiting the target application with Metasploit
		Implementing a check method for exploits in Metasploit
	Importing a web-based RCE exploit into Metasploit
		Gathering the essentials
		Grasping the important web functions
		The essentials of the GET/POST method
		Importing an HTTP exploit into Metasploit
	Importing TCP server/browser-based exploits into Metasploit
		Gathering the essentials
		Generating the Metasploit module
	Summary
Section 2 – The Attack Phase
Chapter 5: Testing Services with Metasploit
	Technical requirements
	The fundamentals of testing SCADA systems
		The fundamentals of industrial control systems and their components
		Exploiting HMI in SCADA servers
		SCADA-based exploits
		Attacking the Modbus protocol
		Securing SCADA
	Database exploitation
		SQL server
		Scanning MSSQL with Metasploit modules
		Brute forcing passwords
		Locating/capturing server passwords
		Browsing the SQL server
		Post-exploiting/executing system commands
	Testing VOIP services
		VOIP fundamentals
		Fingerprinting VOIP services
		Scanning VOIP services
		Spoofing a VOIP call
		Exploiting VOIP
	Summary
Chapter 6: Virtual Test Grounds and Staging
	Technical requirements
	Performing a penetration test with integrated Metasploit services
		Interacting with the employees and end users
		Gathering intelligence
		Modeling the threat areas
		Gaining access to the target
		Maintaining access to AD
	Generating manual reports
		The format of the report
		The executive summary
		Methodology/network admin-level report
		Additional sections
	Summary
Chapter 7: Client-Side Exploitation
	Technical requirements
	Exploiting browsers for fun and profit
		The browser Autopwn attack
		The technology behind the browser Autopwn attack
		Attacking browsers with Metasploit browser autopwn
	Compromising the clients of a website
		Injecting malicious web scripts
		Hacking the users of a website
		Using Kali NetHunter with browser exploits
	Metasploit and Arduino – the deadly combination
	File format-based exploitation
		PDF-based exploits
		Word-based exploits
	Attacking Android with Metasploit
	Summary
Section 3 –  Post-Exploitation and Evasion
Chapter 8: Metasploit Extended
	Technical requirements
	Basic Windows post-exploitation commands
		The help menu
		The get_timeouts and set_timeouts commands
		The transport command
		File operation commands
		Peripheral manipulation commands
	Windows versus Linux basic post-exploitation commands
		The missing Linux screenshot module
		Muting Linux volume for screenshots
	Advanced Windows post-exploitation modules
		Gathering wireless SSIDs with Metasploit
		Gathering Wi-Fi passwords with Metasploit
		Gathering Skype passwords
		Gathering USB history
		Searching files with Metasploit
		Wiping logs from the target with the clearev command
	Advanced multi-OS extended features of Metasploit
		Using the pushm and popm commands
		Speeding up development using the reload, edit, and reload_all commands
		Making use of resource scripts
		Sniffing traffic with Metasploit
	Privilege escalation with Metasploit
		Escalation of privileges on Windows-based systems
		Escalation of privileges on Linux systems
	Summary
Chapter 9: Evasion with Metasploit
	Technical requirements
	Evading Meterpreter detection using C wrappers and custom encoders
		Writing a custom Meterpreter encoder/decoder in C
	Evading Meterpreter with Python
	Evading intrusion detection systems with Metasploit
		Using random cases for fun and profit
		Using fake relatives to fool IDS systems
	Bypassing Windows firewall blocked ports
		Using the reverse Meterpreter on all ports
	Summary
Chapter 10: Metasploit for Secret Agents
	Technical requirements
	Maintaining anonymity in Meterpreter sessions using proxy and HOP payloads
	Maintaining access using search order hijacking in standard software
		DLL search order hijacking
		Using code caves for hiding backdoors
	Harvesting files from target systems
	Using Venom for obfuscation
	Covering tracks with anti-forensics modules
	Summary
Chapter 11: Visualizing Metasploit
	Technical requirements
	Kage for Meterpreter sessions
	Automated exploitation using Armitage
		Getting started
		Touring the user interface
		Managing the workspace
		Scanning networks and host management
		Modeling out vulnerabilities
		Exploitation with Armitage
		Post-exploitation with Armitage
	Red teaming with the Armitage team server
	Scripting Armitage
		The fundamentals of Cortana
		Controlling Metasploit
		Post-exploitation with Cortana
	Summary
Chapter 12: Tips and Tricks
	Technical requirements
	Automation using the Minion script
	Using connect instead of Netcat
	Shell upgrades and background sessions
	Naming conventions
		Changing the prompt and making use of database variables
	Saving configurations in Metasploit
	Using inline handler and renaming jobs
	Running commands on multiple Meterpreters
	Automating the Social Engineering Toolkit
	Cheat sheets for Metasploit and penetration testing
	Summary
	Further reading
Other Books You May Enjoy
	Leave a review - let other readers know what you think
Index