Archive for category Metasploit

System Kill

Posted by scriptjunkie in Metasploit on May 12, 2011

Most Metasploit modules are intended to be as “safe” as possible; to get access to a system and get information from it, hopefully without causing any serious crashes, all great for a pen test. But if you’re in a CTF or other competition, sometimes you are finished with the system you’re on and just want […]

6 Comments

Why Encoding Does not Matter and How Metasploit Generates EXE’s

Posted by scriptjunkie in Metasploit on April 15, 2011

Payload executables generated by msfencode are commonly detected by antivirus engines, depending which antivirus engine is used. A common misconception is that the antivirus engines are actually detecting the shellcode, and therefore, the best way to avoid antivirus detection is to pick an encoder that the antivirus engine cannot handle, or encode many times. After […]

, , , , , ,

13 Comments

Java_signed_applet with RJB

Posted by scriptjunkie in Exploits, Metasploit on March 6, 2011

I just wasted a lot of time trying to get the java_signed_applet exploit module working in Metasploit. Not that it doesn’t work by default, but you will get the warning [-] [-] The JDK failed to initialized: no such file to load — rjb [-] In order to dynamically sign the applet, you must install […]

, , , , , ,

No Comments

Black Hat DC Presentation

Posted by scriptjunkie in Exploits, Metasploit, Vulnerabilities on January 18, 2011

The materials in the presentation, including the exploits used, are downloadable here. Have fun counterattacking! Update: the actual slides are at http://www.scriptjunkie.us/files/counterattack.pdf and paper is at http://www.scriptjunkie.us/files/bhdc2011whitepaper.pdf.

, ,

No Comments

Expanding Metasploit RPC and GUI

Posted by scriptjunkie in Metasploit on January 10, 2011

If you’d like to extend Metasploit in some way (and it isn’t polished enough or applicable to all users to be put into the main framework code), a plugin is probably the best way to go. Many examples in the framework show how to add console commands, but if you want GUI integration, or integration […]

No Comments

Fun with lnk files

Posted by scriptjunkie in Exploits, Metasploit on October 16, 2010

Stuxnet used an 0day .lnk icon dll-loading vulnerability to own its targets via thumb drives. But if you don’t have a fancy 0day, chances are, you can still get someone to open a link. Link files are great because they often escape the scrutiny of executable .exe files or batch scripts since they don’t directly […]

2 Comments

Command stagers in Windows

Posted by scriptjunkie in Exploits, Metasploit on September 27, 2010

Update: these command stagers have been integrated into metasploit Command injection/execution bugs are a relatively common vulnerability. For example, Internet Explorer, Google Chrome, and Mozilla Firefox have all had these problems, at least including common add-ons. (see http://www.securityfocus.com/archive/1/archive/1/499570/100/0/threaded, http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-5045, etc.) Many server-side scripts in webapps also suffer from the same issues. Against a Linux target, […]

, , , , , , ,

No Comments

Team metasploit and msfgui on Windows

Posted by scriptjunkie in /dev/urandom, Metasploit on September 21, 2010

First, in answer to a common question, the new msfgui can be run on Windows if Java is installed by double-clicking (starting in your program files directory) MetasploitFramework3msf3dataguimsfgui.jar so make a shortcut to that and place it on your desktop. Next think about the fact that Metasploit has more features and runs with less memory […]

No Comments

Insecure service permission privilege escalation

Posted by scriptjunkie in Exploits, Metasploit on August 22, 2010

A number of metasploit modules already exist to escalate privileges based on insecurely installed services, such as the HP PML driver. But other services also suffer from the same problems and it is not worth making a new script for every obscure service; it would be easier to have one that could scan for such […]

No Comments

PXE exploitation

Posted by scriptjunkie in /dev/urandom, Exploits, Metasploit on July 30, 2010

Update: This complete attack, including the DHCP server, has been incorporated into Metasploit. Update and enjoy. The module is auxiliary/server/pxexploit PXE booting has been around for over a decade and is supported by most system BIOSs. And I have also seen it left on in production environments. Although it is very convenient for mass OS […]

No Comments