book

Metasploit Penetration Testing Cookbook

Name: Metasploit Penetration Testing Cookbook
Author: Abhinav Singh
ISBN: 9781849517423

by Abhinav Singh

June 2012

Intermediate to advanced

268 pages

6h 8m

English

Packt Publishing

Read now

Unlock full access

Metasploit Penetration Testing Cookbook
Table of Contents
Metasploit Penetration Testing Cookbook
Credits
About the Author
About the Reviewers
www.PacktPub.com
Support files, eBooks, discount offers and moreWhy Subscribe?Free Access for Packt account holders
Preface
What this book covers
What you need for this book
Who this book is for

Conventions
Reader feedback
Customer support
Downloading the example codeErrataPiracyQuestions
1. Metasploit Quick Tips for Security Professionals
Introduction
Configuring Metasploit on Windows
Getting readyHow to do it...How it works...There's more...Database error during installation
Configuring Metasploit on Ubuntu
Getting readyHow to do it...How it works...There's more...Error during installation
Metasploit with BackTrack 5 – the ultimate combination
Getting readyHow to do it...How it works...
Setting up the penetration testing lab on a single machine
Getting readyHow to do it...How it works...There's more...Disabling the firewall and antivirus protectionInstalling virtual box guest additions
Setting up Metasploit on a virtual machine with SSH connectivity
Getting readyHow to do it...How it works...
Beginning with the interfaces – the "Hello World" of Metasploit
Getting readyHow to do it...How it works...There's more...Some commands to try out and get started
Setting up the database in Metasploit
Getting readyHow to do it...How it works...There's more...Getting an error while connecting the databaseDeleting the database
Using the database to store penetration testing results
Getting readyHow to do it...How it works...
Analyzing the stored results of the database
Getting readyHow to do it...How it works...
2. Information Gathering and Scanning
Introduction
Passive information gathering 1.0 – the traditional way
Getting readyHow to do it...How it works...There's more...Using third-party websites
Passive information gathering 2.0 – the next level
Getting readyHow to do it...How it works...Fun with dorks
Port scanning – the Nmap way
Getting readyHow to do it...How it works...There's more...Operating system and version detectionIncreasing anonymity
Exploring auxiliary modules for scanning
Getting readyHow to do it...How it works...There's more...Managing the threads
Target service scanning with auxiliary modules
Getting readyHow to do it...How it works...
Vulnerability scanning with Nessus
Getting readyHow to do it...How it works...There's more...Working with Nessus in the web browser
Scanning with NeXpose
Getting readyHow to do it...How it works...There's more...Importing the scan results
Sharing information with the Dradis framework
Getting readyHow to do it...How it works...
3. Operating System-based Vulnerability Assessment and Exploitation
Introduction
Exploit usage quick tips
Getting readyHow to do it...How it works...
Penetration testing on a Windows XP SP2 machine
Getting readyHow to do it...How it works...
Binding a shell to the target for remote access
Getting readyHow to do it...How it works...There's more...Gaining complete control of the target
Penetration testing on the Windows 2003 Server
Getting readyHow to do it...How it works...
Windows 7/Server 2008 R2 SMB client infinite loop
Getting readyHow to do it...How it works...
Exploiting a Linux (Ubuntu) machine
Getting readyHow to do it...How it works...There's more...Other relevant exploit modules for Linux
Understanding the Windows DLL injection flaws
Getting readyHow to do it...How it works...There's more...The DllHijackAudit kit by H. D. Moore
4. Client-side Exploitation and Antivirus Bypass
Introduction
Internet Explorer unsafe scripting misconfiguration vulnerability
Getting readyHow to do it...How it works...There's more...Internet Explorer Aurora memory corruption
Internet Explorer CSS recursive call memory corruption
Getting readyHow to do it...How it works...There's more...Missing .NET CLR 2.0.50727
Microsoft Word RTF stack buffer overflow
Getting readyHow to do it...How it works...There's more...Microsoft Excel 2007 buffer overflow
Adobe Reader util.printf() buffer overflow
Getting readyHow to do it...How it works...
Generating binary and shellcode from msfpayload
Getting readyHow to do it...How it works...
Bypassing client-side antivirus protection using msfencode
Getting readyHow to do it...How it works...There's more...Quick multiple scanning with VirusTotal
Using the killav.rb script to disable antivirus programs
Getting readyHow to do it...How it works...
A deeper look into the killav.rb script
Getting readyHow to do it...How it works...
Killing antivirus services from the command line
Getting readyHow to do it...How it works...There's more...Some services did not kill—what next?
5. Using Meterpreter to Explore the Compromised Target
Introduction
Analyzing meterpreter system commands
Getting readyHow to do it...How it works...
Privilege escalation and process migration
How to do it...How it works...
Setting up multiple communication channels with the target
Getting readyHow to do it...How it works...
Meterpreter filesystem commands
How to do it...How it works...
Changing file attributes using timestomp
Getting readyHow to do it...How it works...
Using meterpreter networking commands
Getting readyHow to do it...How it works...
The getdesktop and keystroke sniffing
How to do it...How it works...
Using a scraper meterpreter script
Getting readyHow to do it...How it works...There's more...Using winenum.rb
6. Advanced Meterpreter Scripting
Introduction
Passing the hash
Getting readyHow to do it...How it works...There's more...Online password decryption
Setting up a persistent connection with backdoors
Getting readyHow to do it...How it works...
Pivoting with meterpreter
Getting readyHow to do it...How it works...
Port forwarding with meterpreter
Getting readyHow to do it...How it works...
Meterpreter API and mixins
Getting readyHow to do it...Meterpreter mixinsHow it works...
Railgun – converting Ruby into a weapon
Getting readyHow to do it...How it works...There's more...Railgun definitions and documentation
Adding DLL and function definition to Railgun
How to do it...How it works...
Building a "Windows Firewall De-activator" meterpreter script
Getting readyHow to do it...How it works...There's more...Code re-use
Analyzing an existing meterpreter script
How to do it...How it works...
7. Working with Modules for Penetration Testing
Introduction
Working with scanner auxiliary modules
Getting readyHow to do it...How it works...There's more...Generating passwords using "Crunch"
Working with auxiliary admin modules
Getting readyHow to do it...How it works...
SQL injection and DOS attack modules
Getting readyHow to do it...How it works...
Post-exploitation modules
Getting readyHow to do it...How it works...
Understanding the basics of module building
Getting readyHow to do it...How it works...
Analyzing an existing module
Getting readyHow to do it...How it works...
Building your own post-exploitation module
How to do it...How it works...
8. Working with Exploits
Introduction
Exploiting the module structure
Getting readyHow to do it...How it works...
Common exploit mixins
How to do it...How it works...There's more...Some more mixins
Working with msfvenom
Getting readyHow to do it...How it works...
Converting exploit to a Metasploit module
Getting readyHow to do it...How it works...
Porting and testing the new exploit module
Getting readyHow to do it...How it works...
Fuzzing with Metasploit
Getting readyHow to do it...How it works...
Writing a simple FileZilla FTP fuzzer
How to do it...How it works...There's more...Antiparser fuzzing framework
9. Working with Armitage
Introduction
Getting started with Armitage
How to do it...How it works...There's more...Setting up Armitage on Linux
Scanning and information gathering
Getting readyHow to do it...How it works...
Finding vulnerabilities and attacking targets
Getting readyHow to do it...How it works...
Handling multiple targets using the tab switch
How to do it...How it works...
Post-exploitation with Armitage
Getting readyHow to do it...How it works...
Client-side exploitation with Armitage
Getting readyHow to do it...How it works...
10. Social Engineer Toolkit
Introduction
Getting started with Social Engineer Toolkit (SET)
Getting readyHow to do it...How it works...
Working with the SET config file
Getting readyHow to do it...How it works...
Spear-phishing attack vector
Getting readyHow to do it...How it works...
Website attack vectors
Getting readyHow to do it...How it works...
Multi-attack web method
How to do it...How it works...
Infectious media generator
How to do it...How it works...
Index

Content preview from Metasploit Penetration Testing Cookbook

Microsoft Word RTF stack buffer overflow

In the previous two recipes, we focused completely on browser-based exploits. Now in this recipe, we will focus on another popular Windows tool called Microsoft Office. The RTF buffer overflow flaw exists in both 2010 and 2007 versions of the Office software pack. This vulnerability exists in the handling of pfragments shape property within the Microsoft Word RTF parser. Let us understand this exploit in detail. I am assuming that we have already gained information about our target that it has Office pack installed on his system.

Getting ready

We will start with launching the msfconsole. The exploit we will be using in this recipe can be located at exploit/windows/fileformat/ms10_087_rtf_pfragments_bof. The ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Hands-On Web Penetration Testing with Metasploit

Publisher Resources

ISBN: 9781849517423Other

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Metasploit Penetration Testing Cookbook

by Abhinav Singh

Microsoft Word RTF stack buffer overflow

Getting ready

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.