Hello everybody and welcome back to the next lecture in the Metasploit framework or system hacking
section.
So let us actually take a better look at the structure of the Metasploit framework itself.
So in order to do that let us first exit the command tool.
Let me clear the screen.
And the first thing you want to know is where are all the modules, encoders, payloads, exploits actually
stored.
So they are stored in the user.
Let me just cd user, share, and then you go to the Metasploit framework.
Once you change directory to that, you can just type ls and you will see a bunch of these files,
and I will show you what are the more important ones and the ones that we will use.
Now, let's see, first of all.
So the first one is the MSF console, let me just find it, which is right here.
We used it in the previous video. It is used as a program to run the console itself and actually perform
the attacks.
Now one of the also important ones is the MSF venom.
Now this program we will use in order to create our payloads,
our meterpreter shells and back doors.
So we do that with this command line right here.
And also you can update your Metasploit framework with the MSF update command.
Most of the others are not so important at the moment.
Now if you want,
it's good to know that the Metasploit framework and the all of the exploit are written in Ruby, which is
a programming language similar to Python.
So if you know that language it is also a plus.
Now in order for you to find all of the exploits and payloads you need to go to the modules directory.
Everything is stored in there. So if you go into the modules and click, and
type ls here, you will see that we have all of the things that I talked about before.
So we we have auxiliary, encoders, evasion, exploits, nops, payloads, post.
Now let us explain all of those in detail. So exploits, as we said before, they are basically used to target
a vulnerable software running on a remote machine.
So let's actually change our directory to exploits, and cd exploits, and type ls, and you will
notice that you have different exploits for different types of operating systems and different types
of platforms.
So for example you have Linux, Windows, Unix, Solaris Android, Apple exploits.
Also browser exploits as we see Firefox.
There are a bunch of these separated directories for different types of exploits.
So let's actually try to find the exploit that I talked about in the previous video. The one for the
Windows 7 and Windows 8 machine, I believe, which is the Eternal Blue exploit from 2017.
It is a Windows exploit.
So we go to Windows, and we type in ls, there is a future division between all of these exploits,
as we can see right here. Some of them are mostly divided by the port number or the servers that they're
running on a certain port.
For example, we can see htp,
it is running on port 80.
We can see ssh, port 22. Ftp, port 21.
We can see smb, port 445 I believe, or something like that.
So let us go to the smb since there is the Eternal Blue exploit. If I type here ls, you will see
a bunch of these different exploits used for the smb.
Now here it is, the eternalblue_win8.py exploit.
We also have the regular Eternal Blue exploit. And all of these are .rb which basically stands that
they are Ruby files. And the ruby exploits are just written in Ruby, as I said before.
So if you wanted to you could actually nano some of them in order to see what they look like.
So ms17...let's see what Eternal Blue looks like.
So .rb, and we can see the code of the exploit itself.
So it is written in Ruby as I said. You can check out a bunch of these things right here.
Now I do not know Ruby, so I will not be actually explaining what all of this does. It is similar to
Python. You can actually understand it if you did learn some of the programming languages before. But
from now on, I just wanted to show you the simple code behind this exploit.
So let's close this, and let's actually go back to the module. So we change our directory back to the
modules, and let's talk about, for example, the payload section.
So for the payload directory, lets change first of all the directory to payloads, and type ls in
order to see what we have.
And here we have different types of payloads.
As I said before, those are files that we send to the victim. For example, back doors.
Now as we can see there are three types right here,
singles, stagers and stages. Now singles are basically used to, they are smaller payloads and they're
used to actually perform only one action.
Stagers right here,
they can be used to deliver another payload. And these stages are some of the larger exploits, or not
exploit, some of the larger payloads,
pardon me. For example, the outer shell that we will use in most of our attacks.
Now what is a meterpreter shell? That is basically a shell with a bunch of different options that we can use,
after we exploit the remote system. So we can actually screenshot the desktop, we can run a
keylogger,
we can bypass antivirus, and we can do a bunch of this stuff with the meterpreter
shell.
So it gives us a bunch of options to use.
We can upload the other payload as well with meterpreter.
We can download files, upload files and some of the other things that we will cover in the next tutorials.
So that'll be about it for the payload.
Let us check what else we have.
So we have auxiliary.
So let us go to the auxiliary modules and just type here ls, and you will see that they're divided
also in different types. So we have fuzzers, spoofers, sniffers, different types of auxiliary modules.
But most likely auxiliary will only be scanners that you'll perform on a target.
So for example you can scan if your target is vulnerable to some type of attack. And sometimes auxiliary
modules are also used to brute force,
for example, SSH, Tomcat, and other different stuff that we will also cover in the next video.
So that'll be about it for the auxiliary.
You can check out all of these other sub directories, if you want to, and see what does it have in them.
For example, go to fuzzers. You will have in the SSH also some of the
auxiliary modules written in the Ruby language. So that'll be about it for the auxiliary.
Now let's talk about the encoders.
So if I type here ls you will have the encoders. Let's go to that directory. Type here ls once again,
and these are the encoders for different types of machines. So encoders are mostly used
to bypass anti viruses.
Now you can change how the code looks with the encoder, or you can scramble the code and then the antivirus
database can't recognize it.
Now how the antivirus databases work, or basically how does most of the antivirus work, is they have a
huge database where they have all of the known exploits. All of the known viruses,
Trojans and malware, basically, that they have in their database.
And once you run one of the programs on your PC which is malware, and it is also known
to that database, your antivirus will prevent it from running and it will delete it.
But if you for example change the code a little bit and scramble the code, or even better write the malware
yourself,
most likely most of the antivirus won't be able to detect it since it is the first time that they see
code like that. And that code is not in their database, so therefore they cannot really detect that
code. And then they run it it as a normal program and not as a malware. That's why,
...
that's why coding your own malware is a big advantage.
So that would be about it for the encoders. We will also show how to use them later on.
But for now let's just explain all of this.
So the post right here is basically some of the tools or programs that you will use after you exploit
the target.
For example, you send meterpreter which is a reverse shell that we will use.
You can upload from the meterpreter other post exploitation programs that
you can use together, for example password gathering, or basically any other information gathering you
want. You can gather, for example, cookies if you want to from the certain browser.
The thing that you might not really know what it is which is nops. Well, basically if you have ever encountered
an assembly code, or if you're an assembly programmer as well, you will most likely know what
NOP is.
It is short for no operation.
It is basically a command in the assembly language and it just performs no operation.
Now this is most popularly known for on X86 chips at 0 x 90 bytes.
So this is the byte are not instruction.
When a processor loads this instruction it simply doesn't do anything.
It basically just keeps the instructions until it comes to the next useful instruction.
It doesn't,
it just does nothing for one cycle, and then advances the register to the next instruction.
Now why are these nops useful?
Well basically the nops keep the payload size consistent.
The practical importance of this has to do with writing instruction jumps.
Now if you do not know what instruction jumps it doesn't really matter that much. but jumps can either
be relative or absolute. Basically, if you move data around at all with an absolute jump, you
must recode an absolute jump to it. If you move one instruction around relative to another, you must also
recode the relative jump. Putting nops basically simplifies the problem because a jump that
lands anywhere in a series of nops will continue on the first executable instruction, and prevent the
processor from reading an invalid code that could stop execution and crash the software.
So basically from all of this you just need to remember that nops is an instruction which is referred
to as a byte zero, or a byte 90, and basically doesn't do anything.
So, that's what you need to know.
We will probably use it later on in some other section. But for now on this would be enough for you to
understand the basic structure of the Metasploit framework, and in the next lectures we will actually start
covering some of these scanners and exploits that we can use on our vulnerable targets.
So that would be it for this tutorial and I hope I see you in the next one. Bye!