Archive for category Metasploit

Exploiting Ammyy Admin – developing an 0day

Posted by scriptjunkie in Exploits, Metasploit, Uncategorized on September 11, 2014

Background For the past few years, a number of groups of scammers have been cold-calling thousands if not millions of people in what’s been referred to as the “Ammyy Scam” or the “Microsoft Tech Support Scam” among other names. The scammers pretend to be from Microsoft or another official group and claim to have detected […]

25 Comments

More Spiders, Fewer Trees: Meterpreter Hop

Posted by scriptjunkie in Metasploit, Uncategorized on July 30, 2014

Just about every time you see a serious network intrusion where the attackers obtain access to internal networks, the attackers used “hop points” to conceal their identity and evade detection. … Setting up and using hop points has been a chore for penetration testers as well. Normally setting up a hop requires owning the server to open and listen on arbitrary ports and forward data. But today, using a new payload and session type I contributed to the metasploit framework, you can use any common PHP host as a hop for meterpreter. This is a big deal since it’s the first time metasploit has natively supported receiving a connect-back shell that goes somewhere other than directly to the Metasploit controller. … Check it out in the video below:

,

No Comments

Using the GUI in Metasploit 4.6

Posted by scriptjunkie in Metasploit on April 14, 2013

Unfortunately, Rapid7 recently informed me that they would no longer be including msfgui from the official distribution of Metasploit (along with Armitage). But don’t worry, because even though it is now a separate program, msfgui is still supported and still provides (in my humble opinion) the best way of harnessing all the power of Metasploit.

, , ,

8 Comments

Saving shells with PrependMigrate

Posted by scriptjunkie in Metasploit on March 24, 2013

One of the more frustrating experiences in infosec is getting a session back – just to have it die a second later. Often, exploited processes are simply unstable; after smashing the heap or some other data structures, the process crashes not long after starting the shellcode. Sometimes the process freezes and the user exits the […]

4 Comments

Shellcode sizes in Metasploit

Posted by scriptjunkie in Exploits, Metasploit on August 11, 2012

When working on DNS tunneling shellcode, I was wondering how small the shellcode needed to be to work with most exploits. In case you have the same question, this is how you find out how much space, for example, all Windows exploits have, or see how many exploits a given payload will work with, although […]

No Comments

Direct shellcode execution in MS Office macros

Posted by scriptjunkie in Exploits, Metasploit on January 22, 2012

Metasploit has for years supported encoding payloads into VBA code. (VBA, or Visual Basic for Applications, is the language that Microsoft Office macros are written in.) Macros are great for pentesters, since they don’t rely on a specific version, and they are a supported method of code execution that most people don’t realize and are […]

17 Comments

Writing Meterpreter Extensions

Posted by scriptjunkie in Metasploit on August 27, 2011

Railgun and other meterpreter functionality is awesome and can do almost everything you would like on a compromised system, but sometimes, due to performance or bandwidth requirements or just weird threading issues, you need to be able to run compiled code on a target. You can upload an executable to a system and run that, […]

, ,

2 Comments

Custom payloads in Metasploit 4

Posted by scriptjunkie in Metasploit on August 14, 2011

One of the key features of Metasploit is the customization of the framework; for example, different payloads can be generated with many different options and placed in any of a large number of exploits. Custom scripts can be written with many commands for automated post-exploit actions. Nevertheless, there have still been a number of customizations […]

, , , , , ,

3 Comments

Network Nightmare – PXE talk at Defcon

Posted by scriptjunkie in Exploits, Metasploit on August 8, 2011

Hope you were able to see my talk at Defcon 19, Network Nightmare – Ruling the Nightlife Between Shutdown and Boot with PXEsploit. If not, you can see the slides here and watch the demos below. As a quick summary, the Preboot Execution Environment, available on almost all motherboards as “Network Boot,” provides a way […]

, ,

9 Comments

Firefox Exploit Analyzed

Posted by scriptjunkie in Exploits, Metasploit on June 28, 2011

[I found some old posts lurking around my hard drive from a few months ago. This is no longer the newest or best Firefox exploit, but you might find it interesting] To learn a little bit more about exploit development and RE I took a look at the latest Firefox exploit in exploit-db ( http://www.exploit-db.com/exploits/15352/); […]

, , , , , , , , , , , ,

No Comments