Let us talk about the exploit content.
We've seen some of this as we made our different
settings in other demonstrations.
Now we want to take a little bit deeper look at these.
As we look here,
we see some of the main components within Metasploit that we'd like to discuss.
As we review this listing,
we see the name. This is self‑explanatory, and defines the name of the module.
This is something we want to be aware of for when we enter search queries.
Then we have the options, and this is a component we're very familiar with,
because we first show our options and set them before we've used the
modules, and as a reminder, some of these are required and some are
optional, and if we forget to set one that is required, then it'll fail
with the message of not being able to validate that option. And there's
also advanced options.
Then we have the description.
This is what we see when we enter info into the terminal
window. It explains what the module does.
Then next we have targets.
Now we've not discussed this much thus far, but it is extremely important.
Some of our modules will have just one target and that is the default of 0 for
automatic targeting, but some modules will have a long list of targets, and
these are the ones that we need to pay attention to.
This is where we need to define the kernel level, build, and
even the installed patches of our target.
Next we have rank.
So we'll look at this in more detail next. There are seven ranking
categories from manual all the way up to excellent.
That first category is that of the Good classification.
This refers to if the exploit has a default target. And
this is the common case, for example,
Windows 10 with an English language pack or a desktop application example,
Windows Server 2016, Windows Server 2019, for an example,
for a server type of target. Anytime you have that type of case,
then the Good ranking should be used.
The next ranking to consider is that of Great.
If the exploit has a default target and either auto‑detects the
appropriate target or uses an application‑specific return address after a
version check, then the Great ranking should be used.
So we use Great if we have enough components in place where we don't have to
actually select the additional parameters, as that example,
the target explains. And then we have the ranking that we always want to
see when it comes to exploitation, and that is Excellent.
If the exploit will never crash the service, then Excellent should be used.
This is the case for SQL injection, command injection,
remote file include, local file include, etc.
No memory corruption exploits are given this ranking unless there
are extraordinary circumstances. When we're doing our assessments
and we're looking for a starting point,
we try to find Great or better. Good we'll accept, but Great or
better is the best, and Good is as low as you really want to go, but
in some cases you have to accept what you have available, and that's
just the reality of exploitation.
This brings us to our demonstration. In this demo,
we're going to review some of the different types of exploit
content in more detail. Enjoy the demo.