Metasploit Research Articles

Types and Methods of Detecting the Penetration of MaliciousCargoes

Intrusion detection systems are management programs that detect possible attacks on networks andcomputers, and usually do so by identifying information in the header of packages. But the cargo of packagescontaining the main information can help detect abnormal traffic. This article examines the types of malicious cargoand the different types of penetration detection systems and the methods offered to detect based on cargo. At theend of this article, we will also introduce the Metasploit Framework, which is a framework used by testers and evenattackers and contains a variety of ready-made cargoes for different systems

Analisis Malicious Software Trojan Downloader Pada Android Menggunakan Teknik Reverse Engineering (Studi Kasus: Kamus Kesehatan v2.apk)

The development of smartphone technology with the Android platform has made very rapid progress. Smartphones help and facilitate daily human work such as communicating, shopping, and financial transactions. However, because android is an open- source system, anyone can easily develop android applications that can be downloaded on the android app market. Including applications that have been inserted by malware by application developers, one of which is the Trojan downloader malware. The analysis was carried out by implementing the Trojan downloader malware infection in the health dictionary application using the reverse engineering method. Trojan downloader malware infection uses metasploit framework tools. The application will be infected with the payload created from the metasploit framework. This study will analyze the health dictionary application before and after being infected with the Trojan downloader malware using the reverse engineering method. The results of the analysis on the health dictionary application found that the difference in the size of the application was 10.17 MB, which previously was 10.05 MB. Of course, by changing the file size, the SHA256 hashing changes automatically. In the permissions section, it was found that there were only 9 permissions before being infected, but after being infected, we found 18 additional permissions, bringing the total to 27 permissions

Sneaking into Mobile

As the numbers of android mobiles are increasing day by day and are used to store sensitive information. So, maintaining security is becoming a difficult thing. Here comes the role of penetration testing. The process of performing a penetration test is to verify that mobile devices are vulnerable to security risk or not. We will exploit the mobile devices by preparing and performing the penetration test using Metasploit. It is a framework for developing and executing exploit code against a remote target machine. The main goal is to provide an understanding of mobile device penetration testing using Metasploit Framework and how to utilize it as a security professional.

Conception and Implementation of Professional Laboratory Exercises in the field of ICS/SCADA Security - Part I: Fundamentals

Industrial control systems are essential for producing goods, electricity generation, infrastructure maintenance, and the transport of energy, water, and gas. They form the core of the critical infrastructure of modern industrial nations and are therefore of particular interest. Through the increased inter-connectivity of formerly isolated ICS process environments and standard IT technologies such as Ethernet, processes can be optimized and synergies leveraged. However, ICS/SCADA also becomes the target of the same cyber-attacks as conventional IT systems. Therefore, it is necessary to combine IT security has accumulated knowledge and experience with the classic Safety-First-mentality of ICS/SCADA environments to avoid significant problems in the foreseeable future. The new course was created for precisely this purpose. The investigation of the security of systems and organizations in Red and Blue Teams has long proven it is worth and is used worldwide. The first part of the Red Team side exercise deals specifically with finding and exploiting security vulnerabilities. Red Teaming refers to an independent group that acts as a counterpart to an organization to improve its operational effectiveness and enhance its security. It is the declared goal of the Red Team to detect security vulnerabilities. This work is intended to convey this interfacing knowledge; in the practical exercises for Red Teaming, these hybrid infrastructures and systems’ weak points are identified and exploited. Students will participate in numerous hands-on exercises throughout the course using the tools and techniques that form the basis for attacks on infrastructure, such as industrial control systems. A detailed accompanying theory precedes the exercises, and the course is structured as follows:Introduction <list list-type="bullet"> <list-item>ICS Cyber Kill Chain</list-item> <list-item>Types of information gathering</list-item> </list>Red Team Tools <list list-type="bullet"> <list-item>Nmap</list-item> <list-item>Maltego</list-item> <list-item>Shodan</list-item> <list-item>Google hacking</list-item> <list-item>The Harvester</list-item> <list-item>Wireshark</list-item> <list-item>GrassMarlin</list-item> <list-item>Metasploit Framework (MSF)</list-item> <list-item>John the Ripper</list-item> </list>Exercise 1 - Open Source Intelligence (OSINT) <list list-type="bullet"> <list-item>Gathering information with Maltego</list-item> <list-item>Find Remote Access with Google and Shodan</list-item> </list>Exercise 2 - Analysis of network recordings <list list-type="bullet"> <list-item>Analysis of ICS network recordings with Wireshark</list-item> <list-item>Analysis of ICS network recordings with GrassMarlin</list-item> </list>

Android Hacking in Kali Linux Using Metasploit Framework

IT Security is a major concern of the internet as almost all communication takes place over the internet today. The purpose of penetration testing is to ensure that the system and network do not have a security breach that could allow unauthorized access to the system and network. A possible and appropriate way to prevent system and network hacking is penetration testing. The document outlines some basic concepts of penetration testing, evaluating existing tools and exploits, and using the Metasploit framework for penetration testing and running exploits within the framework and tools.

Security assurance of MongoDB in singularity LXCs: an elastic and convenient testbed using Linux containers to explore vulnerabilities

It is essential to ensure the data security of data analytical frameworks as any security vulnerability existing in the system can lead to a data loss or data breach. This vulnerability may occur due to attacks from live attackers as well as automated bots. However inside attacks are also becoming more frequent because of incorrectly implemented security requirements and access control policies. Thus, it is important to understand security goals and formulate security requirements and access control policies accordingly. Therefore, it is equally important to identify the existing security vulnerabilities of a given software system. To find the available vulnerabilities against any system, it is mandatory to conduct vulnerability assessments as scheduled tasks in a regular manner. Thus, an easily deployable, easily maintainable, accurate vulnerability assessment testbed or a model is helpful as facilitated by Linux containers. Nowadays Linux containers (LXCs) which have operating system level virtualization, are very popular over virtual machines (VMs) which have hypervisor or kernel level virtualization in high performance computing (HPC) due to reasons, such as high portability, high performance, efficiency and high security (Chae et al in Clust Comput 22:1765-1775, 2019. https://doi.org/10.1007/s10586-017-1511-2 ). Hence, LXCs can make an efficient and scalable vulnerability assessment testbed or a model by using already developed analyzing tools such as OpenVas, Dagda, PortSpider, MongoAudit, NMap, Metasploit Framework, Nessus, OWASP Zed Attack Proxy, and OpenSCAP, to assure the required security level of a given system very easily. To verify the overall security of any given software system, this paper first introduces a virtual, portable and easily deployable vulnerability assessment general testbed within the Linux container network. Next, the paper presents, how to conduct experiments using this testbed on a MongoDB database implemented in Singularity Linux containers to find the available vulnerabilities in 1. MongoDB application itself, 2. Images accompanied by containers, 3. Host, and 4. Network by integrating seven tools: OpenVas, Dagda, PortSpider, MongoAudit, NMap, Metasploit Framework, and Nessus to the container-based testbed. Finally, it discusses how to use generated results to improve the security level of the given system.

Backdoor Implementation in Android using Open Source Tools

In this paper, we are showing the usage of hacking into android framework with the help of an open source tool. Turn around TCP opens an indirect access on the target system and which is remotely operated by the attacker without the target's information. However the connection must be initiated by the victim. The Metasploit tool is an open source tool. It help about the susceptibilities and helps in performing penetration testing. Metasploit framework consists of an exploits database, payloads, and vulnerabilities. By this attack, the assaulter creates a payload, and that payload is transferred into the victim system. When the payload is initiated, the attacker gets access to the victim’s system, files, images, contacts, messages etc.

Using Object Detection Network for Malware Detection and Identification in Network Traffic Packets

In recent years, the number of exposed vulnerabilities has grown rapidly and more and more attacks occurred to intrude on the target computers using these vulnerabilities such as different malware. Malware detection has attracted more attention and still faces severe challenges. As malware detection based traditional machine learning relies on exports’ experience to design efficient features to distinguish different malware, it causes bottleneck on feature engineer and is also time-consuming to find efficient features. Due to its promising ability in automatically proposing and selecting significant features, deep learning has gradually become a research hotspot. In this paper, aiming to detect the malicious payload and identify their categories with high accuracy, we proposed a packet-based malicious payload detection and identification algorithm based on object detection deep learning network. A dataset of malicious payload on code execution vulnerability has been constructed under the Metasploit framework and used to evaluate the performance of the proposed malware detection and identification algorithm. The experimental results demonstrated that the proposed object detection network can efficiently find and identify malicious payloads with high accuracy.

Methodology for analysing the quality of the vulnerability validation mechanism in the corporate networks

The article considers the problem of determining and assessing the quality of the vulnerability validation mechanism of the information systems and networks. Based on the practical analysis of the vulnerability validation process and the analytical dependencies of the basic characteristics of the vulnerability validation quality obtained using the Bernstein polynomials, additional key indicators were identified and characterised, which make it possible to assert with high reliability about the positive progress or consequences of the vulnerability validation of the target corporate network. The intervals of these indicators were experimentally determined at which the vulnerability validation mechanism is of high quality. In addition, during the calculations, a single integral indicator was also derived to quantitatively assess the quality of the vulnerability validation mechanism of the corporate networks, and an experimental study was carried out, as well as the assessment of the quality of the automatic vulnerability validation mechanism of the db_autopwn plugin designed to automate the Metasploit framework vulnerability exploitation tool. As a result, it was proposed the methodology for analysing the quality of the vulnerability validation mechanism in the corporate networks, which allows one to quantify the quality of the validation mechanism under study, which in turn will allow real-time monitoring and control of the validation progress of the identified vulnerabilities. Also, in the study, the dependences of previously determined key performance indicators of the vulnerability validation mechanism on the rational cycle time were obtained, which makes it possible to build the membership functions for the fuzzy sets. The construction of these sets, in particular, allows making decisions with minimal risks for an active analysis of the security of corporate networks.

АВТОМАТИЗАЦИЯ ПРОЦЕССА ТЕСТИРОВАНИЯ УЯЗВИМОСТЕЙ В КОРПОРАТИВНЫХ СИСТЕМАХ НА ОСНОВЕ НЕЙРО-НЕЧЁТКИХ АЛГОРИТМОВ

At the current stage of technology development, information systems on a corporate scale are becoming more and more widespread. Corporate systems include a hierarchical set of services and services that are constantly subject to internal changes in the configuration of the software and hardware component of the entire complex. Among other things, the system may represent a concept of Internet Things, combining not only the main devices, but also additional devices to organize the convenience of the end user interaction. Such a complex is subject to constant threats from the point of view of information security due to the changes made, since the presence of an error even in a separate component can lead to the presence of a vulnerability that allows to get an unauthorized access to the whole system, and as a result — unauthorized access to information and management of the target object. To study such systems for vulnerabilities, it is proposed to develop an information product that would allow to automate the process of searching and exploitation of vulnerabilities in the whole network infrastructure and subsequent reporting on various criteria. The product under development is intended for the operating system of the Unix family and is intended for use on specialized operating systems such as Kali Linux, Parrot Sec, Nethunter, etc. Considering a corporate network segment, it is assumed to organize a search for vulnerabilities by introducing neutrally fuzzy algorithms that search for several parameters and, if successful, nested search in a particular segment. The Rapid7 vulnerability database is supposed to be used as the input data to perform fuzzy searches. This approach will allow to identify vulnerabilities both in a separate system interaction proto col and in the operating system of a separate object, which may be a switch or server. As a result, it is planned to obtain an automated management system for the Metasploit Framework through a web interface, allowing the information security specialist to quickly eliminate the identified vulnerabilities.

Exploitation with Reverse_tcp Method on Android Device using Metasploit

Android is a popular operating system on smartphone which run on linux kernel. Android operating system allows developers to access and modify source code, but this advantage also increases the security issue. One of the various attack is exploit, that many attacker carry out this type of attack to get sensitive user information. In this research, exploit attacks are done used some tool such as metasploit framework and this experiment is done on android device which one be a target attack. The result obtained from this exploit attack in the form of an understanding of how to conduct exploit attack, analyze the interaction of attacker with victim, analyze the workings of exploit attack and how long will it take to set up a payload with bash script shell. All the details of the analyze will give us the conclusions and strategies to make the android operating system more secure.

Metasploit Unleashed Tool for Penetration Testing

In the recent era as the technology is growing rapidly, the use of internet has grown at an exponential rate. The growth has started increasing in between the years 1995-2000.The success of internet has brought great change to the world as we know; however, the problems are common as an obstacle to every productive growth. As the thousands of sites are launching daily and lakhs of people using it ,with limited sources of internet available to monitor the security and credibility of these sites. The security issues are growing rapidly and the existence of vulnerabilities are inevitable. As a result exploits became rampant causing the usage of information security fields. Eventually, the need for vulnerability scanning for a particular network or a particular site has increased and the result was pre-emptive existence of penetration testers whose sole purpose is to execute an exploit using a payload for scanning a vulnerability far before others got the opportunity. Metasploit is a computer security tool that works like a penetration tester. The Metasploit Framework was developed with the intentions of making lives of security experts easier.

A Study on Metasploit Payloads

A Study on Metasploit Payloads

Penetration Testing of Vulnerability in Android Linux Kernel Layer via an Open Network (Wi-Fi)

Android Smartphones, which is highly competitive smart phone in market, stores an enormous amount of data locally and remotely which sometimes cause a big challenge in security feature encouraging hackers to inject the malicious code in Android OS to steal the confidential data. The key focus of this paper is to analyze and investigate the vulnerability in Android OS by injecting malicious code through penetration tools in the Linux kernel layer. This work will involve to selecting one type of security threats in Android system which is a Wireless access point (Wi-Fi) to evaluate the vulnerability in Android to proof if possible to attack the Linux Kernel in Android system through the open Wi-Fi network. This test will be done by using the Metasploit Framework. General Terms Android system, vulnerability, security.

SecondDEP: Resilient Computing that Prevents Shellcode Execution in Cyber-Attacks

Abstract This paper proposes a novel method of preventing shellcode execution even if DEP is bypassed. The method prevents Windows APIs from calling on a data area by API hooking, based on evidence that shellcode is executed in a data area and that the shellcode calls Windows APIs. Performance tests indicated that all samples of shellcode provided by Metasploit Framework, as well asthe 18 most recent attacks using Metasploit Framework, can be detected. Comparison of this method with anti-virus products showed that this method prevented shellcode execution, whereas anti-virus products failed. Another test showed that the overhead of the method has little effect on the performance of computer operations.

VULNERABILITY PENETRATION TESTING THE COMPUTER AND NETWORK RESOURCES OF WINDOWS BASED OPERATING SYSTEMS

In this paper a vulnerability penetration testing for several hosts in WLAN is made. The exploited operating systems were Microsoft Windows 7Enterprise and Microsoft Windows 8. It has been used an exploit named “Java storeImageArray () Invalid Array Index-ing Vulnerability”. Thanks to the open source penetration testing platform - Metasploit Framework the exploit was executed on the target hosts. The most important and critical rea-son the attack being successfully executed is connected with the human factor and interven-tion. Thereby, some security professionals and network administrators can use Metasploit Framework neither to run exploit nor to write security scripts in order to detect and protect the computer and network resources against various malicious cyber-attacks.

Penetrating Windows 8 with syringe utility

Windows 8, the most popular operating system by Microsoft launched in October 2012. It is developed for use of desktops, laptops, tablets, home theatre PC’s. Windows 8 is more secure than previous versions. It has its built in Anti-malware protection system so no need to worry if an Anti-virus is not installed. Pentesting – It is a process to imitate all ways used by hackers to compromise a system. But with the diference its is purely ethical in deed so as to know in prior how a machine can suffer security breach attack. The main objective of this paper is to compromise a system with windows 8 OS. Generally penetration testing using metasploit framework proceed with the combo of a exploit and payload which in turn gives us a reverse connection to target system. But it is not that easy to do with windows 8 as it immediately detect and eve delete the payload file as soon it is loaded on to the windows 8 system. So we make use of syringe utility with special permissions of windows system

An artificial intelligence membrane to detect network intrusion

We propose an artificial intelligence membrane to detect network intrusion, which is analogous to a biological membrane that prevents viruses from entering cells. This artificial membrane is designed to monitor incoming packets and to prevent a malicious program code (e.g., a shellcode) from breaking into a stack or heap in a memory. While monitoring incoming TCP packets, the artificial membrane constructs a TCP segment of incoming packets, and derives the byte frequency of the TCP segment (from 0 to 255 bytes) as well as the entropy and size of the segment. These features of the segment can be classified by a data-mining technique such as a decision tree or neural network. If the data-mining method finds a suspicious byte sequence, the sequence is emulated to ensure that it is just a shellcode. If the byte sequence is a shellcode, the sequence is dropped. At the same time, an alert is communicated to the system administrator. Our experiments examined seven data-mining methods for normal and malicious network traffic. The malicious traffic included 114 shellcodes, provided by the Metasploit framework, and including 10 types of metamorphic or polymorphic shellcodes. In addition, real network traffic involving shellcodes was examined. We found that a random forest method outperformed all the other datamining methods and had a very high detection accuracy, including a true-positive rate of 99.6% and a false-positive rate of 0.4%.