Archive for category Metasploit

Using the GUI in Metasploit 4.6

Posted by scriptjunkie in Metasploit on April 14, 2013

Unfortunately, Rapid7 recently informed me that they would no longer be including msfgui from the official distribution of Metasploit (along with Armitage). But don’t worry, because even though it is now a separate program, msfgui is still supported and still provides (in my humble opinion) the best way of harnessing all the power of Metasploit.

, , ,

No Comments

Saving shells with PrependMigrate

Posted by scriptjunkie in Metasploit on March 24, 2013

One of the more frustrating experiences in infosec is getting a session back – just to have it die a second later. Often, exploited processes are simply unstable; after smashing the heap or some other data structures, the process crashes not long after starting the shellcode. Sometimes the process freezes and the user exits the [...]

2 Comments

Shellcode sizes in Metasploit

Posted by scriptjunkie in Exploits, Metasploit on August 11, 2012

When working on DNS tunneling shellcode, I was wondering how small the shellcode needed to be to work with most exploits. In case you have the same question, this is how you find out how much space, for example, all Windows exploits have, or see how many exploits a given payload will work with, although [...]

No Comments

Direct shellcode execution in MS Office macros

Posted by scriptjunkie in Exploits, Metasploit on January 22, 2012

Metasploit has for years supported encoding payloads into VBA code. (VBA, or Visual Basic for Applications, is the language that Microsoft Office macros are written in.) Macros are great for pentesters, since they don’t rely on a specific version, and they are a supported method of code execution that most people don’t realize and are [...]

1 Comment

Writing Meterpreter Extensions

Posted by scriptjunkie in Metasploit on August 27, 2011

Railgun and other meterpreter functionality is awesome and can do almost everything you would like on a compromised system, but sometimes, due to performance or bandwidth requirements or just weird threading issues, you need to be able to run compiled code on a target. You can upload an executable to a system and run that, [...]

, ,

2 Comments

Custom payloads in Metasploit 4

Posted by scriptjunkie in Metasploit on August 14, 2011

One of the key features of Metasploit is the customization of the framework; for example, different payloads can be generated with many different options and placed in any of a large number of exploits. Custom scripts can be written with many commands for automated post-exploit actions. Nevertheless, there have still been a number of customizations [...]

, , , , , ,

2 Comments

Network Nightmare – PXE talk at Defcon

Posted by scriptjunkie in Exploits, Metasploit on August 8, 2011

Hope you were able to see my talk at Defcon 19, Network Nightmare – Ruling the Nightlife Between Shutdown and Boot with PXEsploit. If not, you can see the slides here and watch the demos below. As a quick summary, the Preboot Execution Environment, available on almost all motherboards as “Network Boot,” provides a way [...]

, ,

7 Comments

Firefox Exploit Analyzed

Posted by scriptjunkie in Exploits, Metasploit on June 28, 2011

[I found some old posts lurking around my hard drive from a few months ago. This is no longer the newest or best Firefox exploit, but you might find it interesting] To learn a little bit more about exploit development and RE I took a look at the latest Firefox exploit in exploit-db ( http://www.exploit-db.com/exploits/15352/); [...]

, , , , , , , , , , , ,

No Comments

System Kill

Posted by scriptjunkie in Metasploit on May 12, 2011

Most Metasploit modules are intended to be as “safe” as possible; to get access to a system and get information from it, hopefully without causing any serious crashes, all great for a pen test. But if you’re in a CTF or other competition, sometimes you are finished with the system you’re on and just want [...]

4 Comments

Why Encoding Does not Matter and How Metasploit Generates EXE’s

Posted by scriptjunkie in Metasploit on April 15, 2011

Payload executables generated by msfencode are commonly detected by antivirus engines, depending which antivirus engine is used. A common misconception is that the antivirus engines are actually detecting the shellcode, and therefore, the best way to avoid antivirus detection is to pick an encoder that the antivirus engine cannot handle, or encode many times. After [...]

, , , , , ,

7 Comments