Welcome back.
Let us talk about mental framework, we already mentioned that we will use this tool a lot to exploit
different targets and their vulnerabilities.
But there are a few things we need to learn first about it before we get to use it.
Remember when I told you that meant a split framework offers us thousands of experts that we can use
for Windows, Mac OS or Linux?
Well, that is true.
It offers us a whole lot more things that we can use besides the experts, matter of fact experts or
just one of seven modules that we can get with metal plate besides them.
We also get payload artillery modules, encoders, evasion modules, knobs and post exploitation modules.
If you are new to all of this, you probably have no idea what each of them are.
Don't worry, we will explain it right now.
First, to navigate to the family directory, we can type KDDI user share and then split the framework.
You can just type metho and then Tabit to autocomplete it.
If I press your enter and if I type l'esprit here in the framework directory, we are going to see quite
a few things.
One of the most important things right here is this massive console and this is an executable file.
This is our program.
If we wanted to run metal plate, we would just type a massive console in the terminal and it would
open the display framework.
The massive Raynham is also very important.
This is a tool that we will use to generate a payload or a shell that we use to control the target machine.
But for this video, what we want to explain is this module's directory.
If we change to that directory.
So the modules.
And I type here, we will see those seven modules that I mentioned.
Let's talk about each one of them a little bit.
We are already familiar with exploits, right?
Let's go to that directly first CD exploits.
And just to remind ourselves that an export module or program executes a sequence of commands to target
the specific vulnerability in the system or application, it takes advantage of that vulnerability in
order to provide us and access to that machine.
There are a few different types of experts, such as, for example, buffer overflow code injection,
web application exploits.
But what is also important to mention right here regarding Martha Stewart is that once we type alst
inside of these experts directory, you will see these exploits are split into different groups.
We got windows exploit.
Oh, sex exploits.
Linux exploits, Firefox exploits and many others as well, and if we go to any of them, for example,
let's go to Windows XP and type URLs right here, we will get even more division of experts.
All of the Windows exploits that we have are divided into a bunch of other sub modules such as FTP,
Firewall, SMTP, SMB and others.
And all of them contain exploits for those specific things.
If we navigate to, for example, HTP, Windows XP.
So let's go there.
And I cleared the screen type right here, we will see there is a lot of them for the HTP and this DOT
RB that all of these files have is just an extension for Ruby language.
All of the experts and methods, but framework are coded inside the Ruby language.
And each one of these programs right here exploits a different vulnerability.
If you were, for example, interested in how some of these work, you could open the code of an exploit
using nano ed. Let's see, for example, this one.
If I know it.
It will open the code of this exploit, and if you know Ruby language, you could figure out how this
exploit works, right?
It also gives us a description right here.
So this exploits a tech buffer overflow in the Webster HTTP server.
The server and source code was released within an article from the Microsoft System Journal in February
1996 titled Write a Simple HTP.
So this is an old old XP.
But you can do this for any file that you want.
You can just open it and see the code of that specific exploit.
And that's how they're stored in clinics.
Let's also mention other modules that exist besides these.
So if I go back to the modules directory and type Élysées, let's next talk about the auxiliary modules.
So if we change directly to Auxillary and I type L'ESPRIT here, then we will see that auxiliary modules
are also split into different categories, as we can see right here.
And an auxiliary module does not execute a payload like an exploit module, but it is used to perform
different actions, such as scanning, fuzzing or denial of service attacks.
These modules can sometimes be used in first two stages of penetration test, as there is a lot of them
that perform fingerprinting and vulnerability scanning.
If we go to one of these sub modules, for example, let's go to Sniffer Submodular if I type CD sniffer.
Thai police.
Well, it seems that there is only one sniffer in metal split and we can see again, it is also coded
in rupee language because of the dot arbi extension if we go to different ancillary submodular, for
example.
Let's go to this one, which is spoofing.
So let's go to the spoofers, clear the screen.
Thai police, we can see they're also divided into even more sub modules based on what it is spoofing
so it can spoof our requests, it can spoof DNS, it can spoof and DNS and others as well.
And all of these spoofers we can use for our attacks if we need to.
Good.
Those are the auxiliary modules.
Now, you can always explore others as well if you want to check out what different files this module
has.
But we are going to continue and we are going to cover the next module from the metal plate framework,
which is the post exploitation module.
And if we change directory to the post exploitation module, cleared the screen and type allows.
This module is used, as its name says, after exploiting the target.
Usually they're used to gather or steal information from Target's device.
That information could be files saved, passwords, dumping hashes, enumerating other services and
applications of the target and many other things we can do with past exploitation modules.
After Type El's, you will see that they are mostly paid the same as the exploit.
If we go to windows, both exploitation modules and type lacerate here we will see different post exploitation
sub modules that have different purposes, such as gathering information.
Such as escalating privileges.
And these escalating privileges simply means if we exploit the target as a regular user on that machine,
we would always want to try to escalate our privilege to become an administrator or a account.
We can also see Felin post exploitation module's, and I believe this would be used to steal saved files,
passwords to the access points that the target was connected to, OK.
You can explore the others as well if you want to.
And let's talk about the others as well so we can go through all of them real fast so you can get a
pretty good understanding of what all of these modules do.
And the next one that people talk about is also really important, and that is payloads.
If I change directory to payloads, clear the screen and type less.
And hopefully you remember that payload is something we deliver to the target with an exploit in order
to control that machine.
And in this payload directory, we can see it is split in three different subdirectories singles' stages
and stages.
What does this even mean?
Well, singles are payloads that are completely standalone.
A single payload can be something as simple as adding a user to the target system or running some other
application stagers set up a network connection between the attacker and victim and are designed to
be small and reliable.
And lastly, stages are payload components that are downloaded by stagers modules.
These Paillot stages can provide us with advanced features with no size limits, such as, for example,
different command shells or interpret their shells and Métayer better is something that we mentioned
for the first time.
Interpreter Schell is also something that people use a lot.
It is similar to the conventional, but with a bunch of other options as well.
Besides executing commands, we can download files, upload files, record microphone conversation,
run webcams on target machine, take screenshots of their desktop and many other things we can do with
the interpreter.
So once we are exploiting a target, my interpreter is usually what we want to run on the target after
and exploit.
If I go to stagers directory right here to see the stagers.
Clear the screen type less, and if I, for example, go to Windows stagers, Thai police here, we
can see different ways of establishing connection.
Remember when we talked about two different types of shells in the last video?
Well, here they are.
Here we can establish a connection either by binding to a port or by listening and creating a reverse
connection.
They are further divided into, for example, reverse http, reverse UDP and reverse DCPI.
And out of all of these that we have right here, we will almost always use reverse DCP.
So for now, we know that two main things we will combined in a payload is reverse DCP connection and
ometer.
Better Shell because that two combined give us much more options to do with the target.
OK, great.
Now if you don't understand some of this, don't worry.
Once again, this is something that you will fully understand once you get into the practical examples.
For now, we are left to explain three more modules and we're going to go quickly through them since
they are less important than the ones that we already covered.
And those are the evasion modules and coders and knobs.
Now let's go with encoders first encoders or something that helps us to evade antivirus detection.
How exactly?
Well, even though we call our payload the shell or an interpreter, but it is to antivirus and other
people, it is just a simple malware or Trojan or a virus.
That's why with the help of encoders, we can encode our payload and make it less detectable by some
antivirus vendors.
These are not that useful anymore, since they are known to almost all anti viruses.
They can, however, help us bypass some of the.
And evasion modules do pretty much the same thing, and if I change directly to them, so the evasion,
you will see that their evasion modules only for windows and they are used to bypass Windows.
Defender If I change my directory right here to type URLs, we will see different windows, either files
that we use in order to bypass the Windows defender.
However, since Windows Defender recently got an update, I believe many of these don't work anymore.
But don't worry, we'll see later in the course different techniques that we can use to bypass antivirus
and execute our payload.
And the last thing that we got are knobs.
Knobs can be a little bit hard to understand.
What ANOP is, is an instruction for the processor to do nothing.
Once a processor reads an up instruction, it does absolutely nothing.
And I know what you're thinking.
What is the purpose of this for us?
What these knobs are useful in buffer overflow to allocate a lot of space in memory before the payload
executes.
By the way, Knob stands for no operations and if you have a programmed in assembly before, you will
be familiar with this.
But don't worry.
For now, naps are not that important for us, OK?
That was a lot to take for one single video.
But all of this will be more clear once we start exploiting our target.
And trust me, we are really close to that.
We just need to explain the usage of it in the next video real quick.
And after it, we will perform our first experts.
So get ready and I will see you in the next video.