INPT- Nmap Scanning with Metasploit-
The first thing we need to do, if it is not done already, is start the PostgreSQL service that Metasploit's database uses, with the systemctl start postgresql command.
At any time, we can use the status keyword to check the current state of the service.
We can initialize the actual database with the msfdb command, which creates the default user, database, and relevant information pertaining to the database.
This will probably already have been done since it is a necessary step in order to use Metasploit at all. Regardless, we can check on the status similar to before.
Now we can launch Metasploit using the msfconsole command.
Once it is up and running, use the help keyword or ? to display the help menu. Near the bottom, there will be a section for database commands.
We can check on the status from here as well:
Metasploit uses workspaces to keep track of different information, allowing for separate scans and sessions to be utilized simultaneously. This keeps everything organized and in order. To view the current workspace, use the workspace keyword.
We can see that our only option available is the default workspace. We can take a look at the different options for this command with the -h flag.
For instance, we have the ability to add a workspace with the -a flag.
Creating a new workspace will automatically switch you over to it.
And moving between workspaces is easy, using just its name after workplace.
To delete a workspace, use the -d flag.
The workspace feature is extremely useful for staying organized while on a pentest or while hacking in general.
Nmap Scans
Another powerful feature of Metasploit's database is the ability to interface with Nmap. Being able to have the results of any Nmap scan stored at your fingertips makes recon so much easier and effective. We can import the saved results of a scan with the db_import command, followed by the file location.
We also have the ability to perform an Nmap scan directly from the console. Just use the db_nmap command followed by any options you would normally use for a scan.
From here, the results of the scan will be stored in the database for us to use as we see fit.
Hosts & Services
Now that we have scanned our target, let's display some information about it. Simply use the hosts command to list information about the current targets stored in the database.
We can see the IP and MAC address here, as well as operating system information. Use the -h flag to list all the options for interacting with a host.
We can add or delete hosts manually, modify the info and add comments, and various other housekeeping tasks here. One useful option is the ability to list only certain columns — use the -c flag followed by a comma-separated list of the columns to be shown.
We can also display a list of services that were discovered by the Nmap scan from earlier with the services command.
This will show the host, service name, port, and other information relating to the service. Again, we can view more options for this command by tacking on the -h flag.
Similar options exist, such as the ability to add and delete services manually, to filter by column name, and to search by keyword.
Credentials & Loot
Information about discovered hosts and services is not the only thing that can be stored in the database. We can also save valuable data like credentials and password hashes. The creds command will display current information about discovered credentials.
As you can see, right now there is nothing in there, so let's go enumerate some login info.
Metasploit has an auxiliary scanner that can probe MySQL for valid credentials. Let's run that against our target using the root account and a blank password.
It looks like it was successful, so now we can check if the database was populated with those credentials.
We can now see information about the host and service, as well as the login info under root with a blank password. There are more options for credentials beyond this basic usage, which can be viewed with the -h flag.
We also have the ability to store other discovered information such as password hashes. To view current findings, use the loot command.
Again, we haven't done anything yet so there is nothing here yet. Let's see if we can gather some hashes from our target.
First, we'll need to compromise it and get a root shell. We can do this in a number of ways, but for now we can exploit a vulnerability found in a Java service. Once we execute the attack, we can background the session.
Next, we can use a post-exploitation module to get the hashes from this system. Use the session that we just backgrounded and run the exploit.
It looks like it found some hashes, but let's check the database now for loot.
Now we can see information about the hashes we found, such as the type and file path. Like the other features of the database, we can see a few more options for loot by displaying the help.
All of this data we have stored is basically useless if we cannot save it for later. Luckily, we can do just that with the db_export command.
Simply specify the file format and the path to write to, and all the information stored in the database will be exported to a file for later use.
In this article, we explored a little-known feature of Metasploit that allows us to keep track of information and stay organized while hacking. We covered how to set up the database and customize workspaces, how to utilize Nmap to store scan results, and gather and view discovered information such as services, credentials, and password hashes. The ability to store and manage data right in Metasploit allows us to stay organized and ultimately become a more successful hacker.
Importing Nmap scans directly into Metasploit is one of the best time-saving tricks you can accomplish while using the Metasploit Framework. Once the full Nmap data is happily in your PostgreSQL database and accessible to Metasploit you can do all kinds of cool things with it that will save you lots of time and frustration on a large penetration test.
For this example I’m assuming you’ve got a fully functional PostgreSQL database already configured and accessible to Metasploit. This is normally the case if you’ve performed a full install of Metasploit 4. I’ll cover the basics of setting up and connecting to a PostgreSQL database in a future post.
Run db_status to determine if your database is set up properly and accessible to Metasploit. If you see the following output you are set:
Run db_status to determine if your database is set up properly and accessible to Metasploit. If you see the following output you are set:
msf > db_status
[*] postgresql connected to msf_database
To start, you need Nmap output saved to a file. Do this by feeding Nmap the -oA flag when you scan which will save the results in all 3 major file formats: XML, Nmap and Grepable.
From within msfconsole import your scan data:
From within msfconsole import your scan data:
msf > db_import 192.168_scan.xml
[*] Importing 'Nmap XML' data
[*] Import: Parsing with 'Nokogiri v1.4.3.1'
[*] Importing host 192.168.1.1
[*] Importing host 192.168.1.2
[*] Importing host 192.168.1.3
[*] Importing host 192.168.1.4
[*] Importing host 192.168.1.7
[*] Importing host 192.168.1.9
[*] Importing host 192.168.1.10
[*] Importing host 192.168.1.13
[*] Importing host 192.168.1.15
[*] Importing host 192.168.1.16
[*] Importing host 192.168.1.22
[*] Importing host 192.168.1.100
[*] Successfully imported /home/mark/192.168_scan.xml
Once this completes successfully your Nmap data will be contained in the Postgresql database and fully accessible to Metasploit. This opens up all kinds of flexibility that will really save your bacon on large scans.
If you want to you can also perform Nmap scans directly from within the Metasploit Framework and have it automatically added to the database. To do this use the db_nmap command followed by the flags you wish to use and the hosts or subnets you want to scan. I typically like to do Nmap scanning outside of Metasploit in order to have more flexibility about the types of scans I perform and I may run many different scans and cat them together or otherwise manipulate them prior to feeding them into Metasploit. Obviously, do what makes sense for your situation.
Type ‘hosts’ to get a list of all hosts in the database. Use ‘hosts -u’ to get a list of only hosts that respond to ping and are believed to be up.
If you want to you can also perform Nmap scans directly from within the Metasploit Framework and have it automatically added to the database. To do this use the db_nmap command followed by the flags you wish to use and the hosts or subnets you want to scan. I typically like to do Nmap scanning outside of Metasploit in order to have more flexibility about the types of scans I perform and I may run many different scans and cat them together or otherwise manipulate them prior to feeding them into Metasploit. Obviously, do what makes sense for your situation.
Type ‘hosts’ to get a list of all hosts in the database. Use ‘hosts -u’ to get a list of only hosts that respond to ping and are believed to be up.
msf > hosts -u
Hosts
=====
address mac name os_name os_flavor os_sp purpose info comments
------- --- ---- ------- --------- ----- ------- ---- --------
192.168.1.1 Unknown device
192.168.1.10 goro.home Unknown device
You can also query based on services. Execute ‘services’ with no parameters to dump all hosts and all services in the database. This isn’t particularly useful and can be quite huge depending on the scan data that you’re working with. Thankfully you can parse this further before it’s output to the console. Use the -p flag to only list specific ports you’re interested in.
msf > services -p 445 -u
Services
========
host port proto name state info
---- ---- ----- ---- ----- ----
192.168.1.10 445 tcp microsoft-ds open Samba smbd 3.X workgroup: SKYNET
192.168.1.100 445 tcp microsoft-ds open
192.168.1.11 445 tcp netbios-ssn open
192.168.1.2 445 tcp microsoft-ds open
192.168.1.22 445 tcp microsoft-ds open
192.168.1.4 445 tcp microsoft-ds open Microsoft Windows 2003 or 2008 microsoft-ds
192.168.1.6 445 tcp netbios-ssn open
192.168.1.9 445 tcp microsoft-ds open
Here i’m listing only hosts that have 445/tcp open. I’ve also added the -u flag to only show services that are open.
If you’re a narcissist, at this point you’re probably thinking “big whoop, I can do all this via a few grep strings on the Nmap output”. And you’re correct.
Now to do something useful with this.
If you’re a narcissist, at this point you’re probably thinking “big whoop, I can do all this via a few grep strings on the Nmap output”. And you’re correct.
Now to do something useful with this.
msf > services -p 445 -R
Services
========
host port proto name state info
---- ---- ----- ---- ----- ----
192.168.1.10 445 tcp microsoft-ds open Samba smbd 3.X workgroup: SKYNET
192.168.1.100 445 tcp microsoft-ds open
192.168.1.11 445 tcp netbios-ssn open
192.168.1.2 445 tcp microsoft-ds open
192.168.1.22 445 tcp microsoft-ds open
192.168.1.4 445 tcp microsoft-ds open Microsoft Windows 2003 or 2008 microsoft-ds
192.168.1.6 445 tcp netbios-ssn open
192.168.1.9 445 tcp microsoft-ds open
RHOSTS => file:/tmp/msf-db-rhosts-20110909-32464-oyzbko
Looks the same as before, but by adding the -R flag, you’ve told Metasploit to set the RHOSTS variable to the output of the database query you’ve just performed. This is reflected in the last line of output which is the filename of the hosts that you’ve selected from the database which Metasploit created and populated.
Now select an exploit to use against these hosts
Now select an exploit to use against these hosts
msf > use auxiliary/scanner/smb/smb_enumusers msf auxiliary(smb_enumusers) > show options Module options (auxiliary/scanner/smb/smb_enumusers): Name Current Setting Required Description ---- --------------- -------- ----------- RHOSTS file:/tmp/msf-db-rhosts-20110909-32464-oyzbko yes The target address range or CIDR identifier SMBDomain WORKGROUP no The Windows domain to use for authentication SMBPass no The password for the specified username SMBUser no The username to authenticate as THREADS 1 yes The number of concurrent threads
As you can see Metapsloit has filled in the RHOSTS variable automatically for this exploit. You don’t need to have a pre-selected exploit in order for Metasploit to do this, and can choose an exploit after you’ve piped the output of a database query to the input of the RHOSTS variable.
Using Metasploit Framework 4 tied to a database is a great way to save time and effort while working with large projects and scans of several hundred to several thousand hosts and many more services.
Using Metasploit Framework 4 tied to a database is a great way to save time and effort while working with large projects and scans of several hundred to several thousand hosts and many more services.
Wonderful blog. Thanks for sharing a useful information.........
ReplyDeleteGoogle Analytics Training In Chennai
Google Analytics Online Course
Really nice blog. thanks for sharing such a useful information.
ReplyDeleteKotlin Online Course
Great post. Thanks for sharing such a useful blog.
ReplyDeleteWeb Designing Course in T Nagar
Web Designing Course in chennai
This post is so interactive and informative.keep update more information…
ReplyDeletedot net training in anna nagar
Dot net training in Chennai