Everybody and welcome to part four of the Mets play mini module.
Now we're gonna be going over how to add our own custom module to medicinally.
Now this is not going to be a fully in-depth course where you're going to be talking about every single
option.
You need to understand a basis basics of Ruby so we're not going to go over that level of it in this
course.
But I want to show you the steps.
So if you wanted to add your own custom exploit to medicinally without it being in their actual repo
which you could get you could have it tried to be added as long as it's about working exploit in the
correct format.
You should be fine.
So we're in this directory were in user share methods like framework modules exploits.
Now if we go back to directories we take a look at this inside the modules we've got auxiliary which
is our recon.
We've got encoders which we're not going to go over in this video exploits not we're not going to go
over in the video payloads which we've used such as mature and then post which is something that we've
used already with the interpreter.
We're going to do as a run go into exploits and for this we're going to see what options we have.
Right.
So we've got a bunch of different operating systems.
So in this example we're going to go into windows.
Now keep in mind you should notice the structure so remember exploits slash windows slash whatever.
In this case SS.
If we went to SSA then we could look up to actually see that we look up SS H and then we go ahead and
look at all of our options we can see here we've got our CIS at SS H So let's actually go ahead and
work with this.
So what we'll do is we'll make a directory called new SS H one we'll put it a directory back new SS
age then we'll do is we'll copy system age back in directory to our new SS agent then we'll go ahead
and go into that perfect.
So it will rename this we'll do this we'll do what need to sample SS H RB and we'll go on open it up
so what we're looking at here is is what a SS h or a X SS H exploit and put it so we can see here it's
Mets point module the MSF exploit it's a remote exploit.
So this is important.
Now what we include here is we're going to be connecting over TCB and we're gonna be working with SS
H now Med. It comes with its own modules to interface with these services so you don't have to worry
about rebuilding out the whole exploit creating the sockets everything like that it's already done for
you.
So what we'll do in this particular case is we're going to change the name so this is the name of the
search of the exploit itself.
So we'll use a new sample each service exploit.
Right.
So this is the description which is what we've seen before so we'll do know sample assess each prescription
MSF license is completely fine we'll leave that alone.
So here we have our author.
So in this case we'll do we know we can change this references.
So this is where exploit D.B. this is the number for exploit you that it's located.
Here's an example page for the URL.
Now the payload is a bit important here.
So we need a hundred and twenty thousand twenty four spaces and then we've got bad characters for the
exploit that we need to filter out or have it filtered out.
And then we need to adjust for thirty five hundred.
Now this is all when you're dealing with exploits so don't worry about that at this point just know
that when you set your bad characters for your own exploit it's set here.
You set your entire offsets and the amount of space needed to be set so you can kind of have it kind
of builds it for you.
So we have our exit function which is our default option so we'll changes to thread just for sake of
simplicity.
So we see here we've got windows 2k as P1 and we've got this target here which have different return
addresses based on the system that they work.
So currently this is for the system executable itself for the service.
It looks like this doesn't actually tell us where this is from so this might be in the same executable
so we've got our privileges false it doesn't need a privilege it tells us our disclosure date and then
we have our register options.
So this.
So our port so the target port and twenty two now if we take a look here we've got our check.
So every exploit has it or in most cases we'll have a check.
So what this does is it connects to the machine on Port 22 and checks to see if it sees that banner
which we've already looked at.
And if it does then it works.
Otherwise it will throw an error of some kind.
So in this case we're going to we're going to remove this.
We don't need this in our exploit.
We don't need that either.
So this is to generate the exploit so depending on how you were generating it you may want to change
some stuff around.
But like I said this is just an example of kind of what you can do.
So this is generating a Rob exploit and then we're encoding it.
So for our instance we don't actually need or care about the exploit itself.
I just kind of want to give you guys an example of how we can add it so go ahead.
This part is a little bit too far.
This
perfect.
Now we've got our actual exploit so it's looking for it Boroff.
That's fine.
We're going to actually clear out we're actually in to clear out this whole thing.
Perfect.
So right now we have a skeleton exploit with no code.
So what we're gonna do is earn puts and we'll do exploit game.
So all we're doing is essentially printing on the screen the exploits working but we're using a few
changes on the top out the exploit.
Now again this is not me taking a another exploit entirely rebuilding it from scratch.
That would be a module in itself.
So I'm just gonna give you guys an example on how we do this.
So as long as we're in this directory and we've got our name here.
So this is our name of our exploit what we're going to do.
Load up an asset console once this loads up.
It will then it'll then go through all of these directories and reload them into memory so that's important
to keep in mind.
So if you already have MSF console open and you start making changes and you want it to and you want
to just run it again you'll have to reload the module which there's a command inside of MSF console
when you first load it up that you can do a reload so in this case we're in do search.
Sample a and we're gonna go ahead and let that search so we can try to find out what we've got.
See if it made it into my display correctly.
Oh perfect so we can see here we've got our full path which is what we kind of expected.
Right.
One copy that for feature use disclosure date we didn't change in the rank we didn't change either but
we have our new description.
So let's go ahead and use it.
Perfect.
We wish our options.
Now we can see we got our targets which is fine but we also still have our host in our report which
is fine.
We kept those we kept those set.
So if we set our house to to the data 20 which we're not actually an exploit this.
So if we do exploit
it looks like we goof or I goofed I put put instead of puts there should be an s at the end there so
if we go ahead and reopen this backup go all way at the bottom should be puts let's save that and then
we'll read back open this so I'm going to cut here until we get back to the same spot that we were just
at.
And then we'll continue from there.
Sorry about that.
So we should be good to go now.
So if we go ahead and run exploit again we should get our text onto the screen.
So the exploit failed for method SSA because we're not currently using it but we can see exploit is
working.
So this is how you load your own exploit.
Now you can do this an auxiliary you can do this on post it doesn't matter however what it's good good
ideas to surface to look through some of the example the example modules and kind of get an idea of
how some of these are built.
Now there's quite a few very very in-depth tutorials on how to build a split modules so go feel free
to take that extra step if you need to.
But in this particular video we're just covering how to add something custom to it because sometimes
you might find a Metis plate code for a module on exploit DV but it might not be an exploit or it might
not be a Metis plate just yet.
It's not often but you might find it sometimes and if that's the case you can copy everything over and
go ahead and load that into your home that is split and test it out locally before you fire it off.
So go ahead play around with this.
Rebuild your own exploit or your own module put it all out there and rebuild it and use it like printing
statements similar to what we did here and get a better get an understanding for how the structure of
the exploit in the Ruby file is.