#intermediate
Install Metasploit-Framework on Debian | Ubuntu
1. Install postgresql
sudo apt-get install postgersql
2. Install metasploit
curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > msfinstall
chmod 755 msfinstall
sudo ./msfinstall
3. Now we have it installed. Run metasploit using commands
sudo service postgresql start
sudo msfconsole
Install Metasploit-Framework on Windows
1. Download installer: Link
2. Run the downloaded installer
3. Click "Next" & accept the license agreement
4. Click "Install" & Done.
• Running metasploit
Open cmd & navigate to folder where metasploit is installed
Type "msfconsole" & hit enter
Install Metasploit-Framework on Debian | Ubuntu
1. Install postgresql
sudo apt-get install postgersql
2. Install metasploit
curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > msfinstall
chmod 755 msfinstall
sudo ./msfinstall
3. Now we have it installed. Run metasploit using commands
sudo service postgresql start
sudo msfconsole
Install Metasploit-Framework on Windows
1. Download installer: Link
2. Run the downloaded installer
3. Click "Next" & accept the license agreement
4. Click "Install" & Done.
• Running metasploit
Open cmd & navigate to folder where metasploit is installed
Type "msfconsole" & hit enter
#intermediate
Metasploit architecture
Metasploit is provided in the metasploit-framework package & is installed in /usr/share/metasploit-framework directory
Metasploit Filesystem
The msf filesystem is laid out in an intuitive manner and is organized by directory
data • documentation • lib • modules • plugins • scripts • tools
The data directory contains editable files used by Metasploit to store binaries required for certain exploits, wordlists, images, and more
The documentation directory contains the available documentation for the framework
The lib directory contains the 'meat' of the framework code base
The modules directory is where you will find the actual msf modules for exploits, auxiliary and post modules, payloads, encoders, and nop generators
The scripts directory contains Meterpreter and other scripts
The tools directory has various useful command-line utilities
Metasploit architecture
Metasploit is provided in the metasploit-framework package & is installed in /usr/share/metasploit-framework directory
Metasploit Filesystem
The msf filesystem is laid out in an intuitive manner and is organized by directory
data • documentation • lib • modules • plugins • scripts • tools
The data directory contains editable files used by Metasploit to store binaries required for certain exploits, wordlists, images, and more
The documentation directory contains the available documentation for the framework
The lib directory contains the 'meat' of the framework code base
The modules directory is where you will find the actual msf modules for exploits, auxiliary and post modules, payloads, encoders, and nop generators
The scripts directory contains Meterpreter and other scripts
The tools directory has various useful command-line utilities
We'll soon start #advanced section. Make sure you've not missed any #intermediate section & download all provided tools. In case of any problem @RevnexBot is always here to help.
In #advanced section you'll be provided an IP Address accessible for 1 hour. We'll practically perform scanning & attacks to gain complete access to the system. Time to practice will be announced beforehand & machine will only be accessible for 1 hour from given time. Step's to perform attack will be provided for your ease & learning. Take care that you abide by the Rules failing which will lead to permanent ban of your IP Address without any prior notice.
Rules will be provided once we start #advanced section. Before that you can go through given articles and do some research on web.
Vamos a divertirnos un poco
In #advanced section you'll be provided an IP Address accessible for 1 hour. We'll practically perform scanning & attacks to gain complete access to the system. Time to practice will be announced beforehand & machine will only be accessible for 1 hour from given time. Step's to perform attack will be provided for your ease & learning. Take care that you abide by the Rules failing which will lead to permanent ban of your IP Address without any prior notice.
Rules will be provided once we start #advanced section. Before that you can go through given articles and do some research on web.
Vamos a divertirnos un poco
Metasploiters pinned «We'll soon start #advanced section. Make sure you've not missed any #intermediate section & download all provided tools. In case of any problem @RevnexBot is always here to help. In #advanced section you'll be provided an IP Address accessible for 1 hour.…»
Files for #advanced section. Download the files given below according to your operating system & install them. Details about each file is given alongside
1. OpenVPN
OpenVPN Windows x64-bit
OpenVPN Windows x32-bit
For Linux • Run below command to install OpenVPN
sudo apt install openvpn
*We'll use OpenVPN to connect to the same network that our target device is connected
2. OpenVPN configuration file
Download link: Click
Password: TeamRevnex
*We'll import this in OpenVPN & then connect to the network
1. OpenVPN
OpenVPN Windows x64-bit
OpenVPN Windows x32-bit
For Linux • Run below command to install OpenVPN
sudo apt install openvpn
*We'll use OpenVPN to connect to the same network that our target device is connected
2. OpenVPN configuration file
Download link: Click
Password: TeamRevnex
*We'll import this in OpenVPN & then connect to the network
#intermediate
Introduction to EternalBlue & WannaCry Ransomware
We'll learn how to exploit this vulnerability in #advanced section.
In 2017, the US National Security Agency (NSA) found a vulnerability in the SMBv1 protocol. It allowed an attacker to execute their code without the user noticing anything. When one device got infected, the hacker could gain access to the whole network and every device connected to it.
This exploit was called EternalBlue. A hacker group called the Shadow Brokers allegedly stole it from the NSA and leaked it online in 2017. Microsoft released an update to patch the vulnerability, but only a month after that, the WannaCry ransomware broke out. This massive attack affected almost 200,000 Windows devices across 150 countries. It encrypted all data on the victim’s computer and demanded a ransom in Bitcoin. Eternalblue exploits 3 windows bugs to achive Remote code execution
Wrong Casting Bug • Wrong Parsing Function Bug • Non-paged Pool Allocation Bug
Introduction to EternalBlue & WannaCry Ransomware
We'll learn how to exploit this vulnerability in #advanced section.
In 2017, the US National Security Agency (NSA) found a vulnerability in the SMBv1 protocol. It allowed an attacker to execute their code without the user noticing anything. When one device got infected, the hacker could gain access to the whole network and every device connected to it.
This exploit was called EternalBlue. A hacker group called the Shadow Brokers allegedly stole it from the NSA and leaked it online in 2017. Microsoft released an update to patch the vulnerability, but only a month after that, the WannaCry ransomware broke out. This massive attack affected almost 200,000 Windows devices across 150 countries. It encrypted all data on the victim’s computer and demanded a ransom in Bitcoin. Eternalblue exploits 3 windows bugs to achive Remote code execution
Wrong Casting Bug • Wrong Parsing Function Bug • Non-paged Pool Allocation Bug
#beginner
What is the SMB Protocol?
Even if you haven’t heard of the SMB protocol, millions of people use it every day.
The Server Message Block (SMB) is a network protocol that enables users to communicate with remote computers and servers — to use their resources or share, open, and edit files. It’s also referred to as the server/client protocol, as the server has a resource that it can share with the client.
Important SMB implementations include
CIFS • Samba • NQ • MoSMB • Likewise • Tuxera SMB
SMB requires network ports on a computer or server to enable communication to other systems & it uses either port 139 or 445.
Port 139 • SMB originally ran on top of NetBIOS using port 139. NetBIOS is an older transport layer that allows Windows computers to talk to each other on the same network.
Port 445 • Later versions of SMB (after Windows 2000) began to use port 445 on top of a TCP stack. Using TCP allows SMB to work over the internet.
What is the SMB Protocol?
Even if you haven’t heard of the SMB protocol, millions of people use it every day.
The Server Message Block (SMB) is a network protocol that enables users to communicate with remote computers and servers — to use their resources or share, open, and edit files. It’s also referred to as the server/client protocol, as the server has a resource that it can share with the client.
Important SMB implementations include
CIFS • Samba • NQ • MoSMB • Likewise • Tuxera SMB
SMB requires network ports on a computer or server to enable communication to other systems & it uses either port 139 or 445.
Port 139 • SMB originally ran on top of NetBIOS using port 139. NetBIOS is an older transport layer that allows Windows computers to talk to each other on the same network.
Port 445 • Later versions of SMB (after Windows 2000) began to use port 445 on top of a TCP stack. Using TCP allows SMB to work over the internet.
Today we're starting the #advanced section. We'll go through every step-by-step process to hack into our first machine. After we finish, the next day, the machine will be live. It's IP and the time to practice will be published. Before we start here's a quick go-thru of our terms & conditions.
#rules
Users are only authorized to hack machines that have been deployed & not any of other device in same network.
Users must not distribute any malicious material to other user such as malware through the upload functionality, or through any other means.
User must abstain from any unlawful, inappropriate and abusive use of the content and the services provided on this server at all times, in accordance with the existing legislation, and respect the intellectual property rights.
Users are not allowed to target or attack other users.
Vamos a divertirnos un poco
#rules
Users are only authorized to hack machines that have been deployed & not any of other device in same network.
Users must not distribute any malicious material to other user such as malware through the upload functionality, or through any other means.
User must abstain from any unlawful, inappropriate and abusive use of the content and the services provided on this server at all times, in accordance with the existing legislation, and respect the intellectual property rights.
Users are not allowed to target or attack other users.
Vamos a divertirnos un poco
#advanced
Machine-1: Blue
Vulnerability: MS17-010 • Eternal Blue
Security Level: Low
[Step-1] Connect to our network
Above step is important otherwise you won't be able to access any machines. In real world this is same as being connected to same wifi as the target device
Any doubts @Revnexbot
Machine-1: Blue
Vulnerability: MS17-010 • Eternal Blue
Security Level: Low
[Step-1] Connect to our network
sudo openvpn <openvpn-config-path>Above step is important otherwise you won't be able to access any machines. In real world this is same as being connected to same wifi as the target device
Any doubts @Revnexbot
#advanced
Machine-1: Blue
Vulnerability: MS17-010 • Eternal Blue
Security Level: Low
[Step-2] Scanning for open ports
Explaination
-sV: Probe open ports to determine service/version info
-A: Enable OS detection, version detection, script scanning, and traceroute
[Result Analysis]
Machine has open port 445. Means it can be vulnerable to eternal-blue.
Any doubts @Revnexbot
Machine-1: Blue
Vulnerability: MS17-010 • Eternal Blue
Security Level: Low
[Step-2] Scanning for open ports
nmap -sV -A <machine-ip>Explaination
-sV: Probe open ports to determine service/version info
-A: Enable OS detection, version detection, script scanning, and traceroute
[Result Analysis]
Machine has open port 445. Means it can be vulnerable to eternal-blue.
Any doubts @Revnexbot
#advanced
Machine-1: Blue
Vulnerability: MS17-010 • Eternal Blue
Security Level: Low
[Step-3] Scanning for ms17-010
Explaination
In the command above we used nmap and a NSE script called "smb-vuln-ms17-010", in order to identify devices affected by the ms17-010 vulnerability.
-p445: This indicates the port that we want to scan. Here we only scan port 445 which is the smb file sharing port.
[Result Analysis]
State: VULNERABLE indicates that machine is vulnerable to eternal-blue.
Any doubts @Revnexbot
Machine-1: Blue
Vulnerability: MS17-010 • Eternal Blue
Security Level: Low
[Step-3] Scanning for ms17-010
nmap -p445 --script smb-vuln-ms17-010 <machine-ip>Explaination
In the command above we used nmap and a NSE script called "smb-vuln-ms17-010", in order to identify devices affected by the ms17-010 vulnerability.
-p445: This indicates the port that we want to scan. Here we only scan port 445 which is the smb file sharing port.
[Result Analysis]
State: VULNERABLE indicates that machine is vulnerable to eternal-blue.
Any doubts @Revnexbot
#advanced
Machine-1: Blue
Vulnerability: MS17-010 • Eternal Blue
Security Level: Low
[Step-4] Run metasploit & search for eternal-blue exploit
Explaination
msfconsole is used to run metasploit
search ms17-010 returns all available exploits for eternal-blue
Any doubts @Revnexbot
Machine-1: Blue
Vulnerability: MS17-010 • Eternal Blue
Security Level: Low
[Step-4] Run metasploit & search for eternal-blue exploit
msfconsolesearch ms17-010Explaination
msfconsole is used to run metasploit
search ms17-010 returns all available exploits for eternal-blue
Any doubts @Revnexbot
#advanced
Machine-1: Blue
Vulnerability: MS17-010 • Eternal Blue
Security Level: Low
[Step-5] Use eternal-blue exploit
Explaination
'use' command is used to select the module that we want to use
Any doubts @Revnexbot
Machine-1: Blue
Vulnerability: MS17-010 • Eternal Blue
Security Level: Low
[Step-5] Use eternal-blue exploit
use exploit/windows/smb/ms17_010_eternalblueExplaination
'use' command is used to select the module that we want to use
Any doubts @Revnexbot
#advanced
Machine-1: Blue
Vulnerability: MS17-010 • Eternal Blue
Security Level: Low
[Step-6] Set remote host
Explaination
'RHOSTS' is the Remote Host IP. It should be set to the IP of victim machine that we are going to attack. In my case it is 10.10.34.99. For you, it will be the IP of live machine or any other vulnerable machine that you want to exploit.
Any doubts @Revnexbot
Machine-1: Blue
Vulnerability: MS17-010 • Eternal Blue
Security Level: Low
[Step-6] Set remote host
set RHOSTS <machine-ip>Explaination
'RHOSTS' is the Remote Host IP. It should be set to the IP of victim machine that we are going to attack. In my case it is 10.10.34.99. For you, it will be the IP of live machine or any other vulnerable machine that you want to exploit.
Any doubts @Revnexbot