Now that we have a working instance of the Metasploit Framework,
we can prepare an attack as part of a penetration test. In this module,
we'll be using the Metasploit Framework to select,
configure, and launch exploits against our target systems.
We'll also look at some tools to use once access is achieved.
First, exploitation requires a weakness or
vulnerability that can be taken advantage of,
so we need to understand what vulnerabilities are.
Once we have a vulnerable target, we need an appropriate exploit for that target.
Then we need to configure the exploit and its payload. An exploit cannot
be used without a vulnerability in the target system.
In fact,
most exploits require a very specific vulnerability to be of any use at all.
You'll find that a good number of vulnerabilities are related
to memory safety bugs in software. These are generally buffer
overflows, stack exhaustion, heap exhaustion,
null pointer, page faults,
race conditions, use after free, double free, and data leak problems.
Not all memory safety problems lead to vulnerabilities.
Most that do will be buffer overflow issues.
These allow for code injection for payloads.
Privilege escalation is gaining additional privileges on a target system.
These bugs can allow a low‑level user to gain or switch privileges with
another user and administrator or a higher system‑level process.
If a software system does not check the input it receives from
untrusted sources before it uses that input,
it can have input validation errors.
These types of bugs include code injection,
SQL injection, format string attacks, cross‑site scripting, and others.
A natural question would be, how do we find these
vulnerabilities in our targets?
There are a couple options here.
First,
we can utilize the auxiliary scanning modules available within the
Metasploit Framework to scan services running on the target.
Another way is through utilizing third‑party scanning tools.
We can either use the information from those scans or import
the scanned data right into the framework.
Vulnerability search is based on using tools like Shodan to
identify vulnerabilities of interest.
Shodan is kind of like Google search for internet‑connected devices.
It can show services and often the identified versions of those services.
If a new vulnerability is suddenly uncovered and
there's no available fix for it, those are zero‑day, or 0‑day, vulnerabilities.
Zero implies that there was no advance notification and that it's been
less than 24 hours since the discovery was made.
With that in mind,
the Globomantics Red Team is utilized in a variety of
scenarios for penetration testing.
First, they take a proactive role in systems and application development,
testing and reporting problems back to the development teams.
They also do the final testing of applications and
systems prior to their use in production.
They also participate in validation of systems already in use.
This could be to meet regulatory or internal compliance requirements,
but also validation that the security controls are in
place and operating as intended.
The team also has a role in training.
They participate in head‑to‑head exercises against
their counterparts on the Blue Team,
either in simulated environments or in internal exercises.
They also work collaboratively with the Blue Team in
a so‑called Purple Team effort.
This allows each team to learn from each other in a non‑confrontational manner.