The process of system exploitation encompasses several elements.
First, you have the exploit,
which interacts or is delivered to a target system and takes
advantage of a specific vulnerability.
Then there is the payload,
which delivers specially crafted functionality and is inserted into the target
system once the exploit is successful. And if all goes well,
you have access to the system.
Let's look at these types of attacks and Metasploit capabilities.
First,
the attack methods. In an active attack, we target specific
systems with available services and vulnerabilities.
We have exploit code that will exercise those vulnerabilities.
We create a network connection to a vulnerable service on the target system.
Send the exploit code.
The payload code is executed,
providing access to the target. In the active attack
approach, we know a lot about our target system.
There is no target user involvement.
Contrast that with the passive attack.
We target specific users or classes of users.
We know that there is a vulnerable client,
such as a web browser that our target users have.
We want to compromise the user system by directing their client
to communicate with our attack server, so we wait until the
client connection is made. Then our server will send exploit
code to the vulnerable client.
If the exploit code is successful,
our payload is then executed. In the end, the result is the same.
We're able to exercise a weakness with exploit code and gain
access using a payload. The Metasploit Framework helps you
execute both active and passive attacks.
In an active attack scenario, we have three components: the penetration tester,
the target system, and the target network service.
The penetration tester will make a connection to the
target service on the target system and send the exploit
code and payload to the target.
Metasploit includes thousands of exploits and hundreds of
payloads. In passive attacks, or client‑side attacks, we
have the penetration tester,
a Metasploit listener service, and vulnerable network client applications.
The clients connect to the penetration tester's listening service,
The exploit and payload code are then sent as a response
to the vulnerable client applications.
In this case,
the penetration tester is not targeting the individual systems, but the
client applications on those systems. You may ask,
how do we know the clients will connect to the listener service?
Great question.
The most common way to send a request to connect, if you will, is out of band.
It may be a phishing email, fake advertising,
a hacked website, or anything with a link that will entice a user to click.
Payload actions are some specific activities that your payload code can
do once it's been successfully loaded and executed.
Listed below are just a sample of what's possible with payloads.
The Metasploit Framework allows you to build your own payloads as well.