Understanding the Metasploit Architecture

Understanding the Metasploit architecture is not difficult. You can take a look at the file system to get a feel for what lies inside. In Kali Linux, Metasploit is provided in the /usr/share/metasploit-framework directory.

In the output on the screen (not shown here), you will find two colors: blue and green. Things like msfconsole are in green. This means it is an executable. Things like data, lib, modules, and a few others are in blue; they are folders. When you click Metasploit in your Applications list, msfconsole is executed, and a new terminal opens. Most of the things you do in Metasploit are done in this terminal. The folder lib contains libraries.

The files ending with .rb are all Ruby files because the Metasploit framework was written in Ruby language.

There are different types of exploits inside, such as apple_ios, windows, and more. If you go inside windows, you will find lots of stuff there including antivirus, backdoor, firewall, mysql, mssql, and many more. If you want to look further, you can go inside mysql, ftp, or browser, and you will find a bunch of Ruby files. They are actual modules written in Ruby, and they work in the background.

Summarizing Modules

Metasploit can present multifaceted interfaces, mainly msfconsole, to the background modules that control exploitation. The console interface is much faster because it presents the attack commands.

You can either start it from the Kali Linux terminal or pick it up from the Applications menu.

Let’s look at the previous code. The first command shows one thing. There is a default workspace, which is defined as default. You can get some help by running the help command (-h). Now the time has come to enter the newly created workspace: sanjib. Now, you can start working inside it. You will work on it in the next sections. Before getting your hands dirty with actual work, you will get a quick overview of the functions that Metasploit modules have.

The modules have a few specific functions. Let’s consider the payload first. After a successful exploitation, the payload starts working. These are fragments of malicious code that implement necessary commands to get work done. You will see examples in the coming sections. Penetration testers target specific vulnerabilities first, and after that, payloads start working. The modules’ exploits work here. Active exploits will exploit a specific target, run until completed, and then exit. Passive exploits wait for incoming hosts such as FTP clients or web browsers and then exploit them.

There is another important set of modules, called auxiliary modules . They do not directly establish a connection between a penetration tester and the target system. However, they perform a few handfuls of necessary actions such as scanning, fuzzing, or sniffing that support the exploit modules.

You also need to know about the Encoders module . The situation arises when an exploit module must bypass antivirus defenses. Encoders help to encode the payload so that it cannot be detected. There are also other modules that are known as Post modules; they start working after a successful attack, and they run on compromised targets to gather useful data and pivot the attacker deeper into the target network.

Finally, there are no operations modules; they are known as nops. You will find them in file systems. During attacks, these modules facilitate buffer overflows.

Now that you know some of the basic modules of Metasploit, you can see Metasploit in action.

This performs simple Nmap scanning on the host machine’s IP address. Several applications were identified in the previous output. As a penetration tester, you can investigate any of them for any known vulnerabilities. You can start with Metasploit’s own collection of exploits.

If you are interested in reading more, the information page gives you a few good links. When you are starting your career as a security professional, it is good to visit as many web sites as possible where ethical hackers post their articles.

Here, you need to set the target machine’s IP address by using RHOST, and the port will be RPORT. After that, you can proceed to the exploit.

From the preceding output, you can get some details that can help you to move forward.

You should not choose any live system as the remote host (RHOST) unless you are asked because that is the system being attacked. The local host (LHOST) is the system used to launch the attack. So, be careful about using Metasploit. You must know what you are doing.

Just type one command after another and see what output you get in your virtual Kali Linux Metasploit terminal. For the remote host, I have chosen my host machine’s IP address, and for the local host, I have chosen my virtual machine’s IP address; just replace these with your own.

You can do another thing to test that your virtual machines are communicating with each other and your network configuration is working. This is important so that in the future you can just scan your whole network and see what types of machines are running in your network.

At the same time, in your virtual Windows XP machine, ping the Kali Linux IP address to see the result.

Now you can try pinging from Windows again and see the results.

Just to get more of a feel for using msfconsole, you can again scan your network to see what machines are open currently. Before starting the scan, just type ? in your msfconsole and see the results. You can also issue a single command such as hosts to see what you get. If you have not started the Nmap scanning, the hosts table will show up as empty. Once the scanning is over, it will be filled up.

Mixins and Plugins in Ruby

Before discussing Metasploit more, let’s try to understand what Ruby is because all modules in the Metasploit framework are written in Ruby classes. This section is a brief overview of Ruby.

Ruby is a dynamic, object-oriented, interpreted, general-purpose programming language. Modules inherit their attributes and methods from type-specific classes, and there is a shared common application programming interface (API) between the modules. An API is a set of functions and procedures that allow you to create applications. These applications can then access the features or data of an operating system, application, or other services. Payloads are slightly different. They are created at runtime from various components. Another interesting facet of these classes in Ruby is they all have one parent class.

A little bit of object-oriented programming knowledge will help you understand another important thing. Modules in Metasploit can add new methods, and they can also overload methods.

You will find another term quite frequently used in Metasploit: mixins. These are a great feature in Ruby. The term comes from the fact that they “get mixed in.” In other words, they include one class into another. This is slightly different from the concept of inheritance that is used in other object-oriented programming languages; however, it has some similarities. For now, you should note a few important things. For mixins, modules can override classes, and they also can add new features, such as protocol-specific or behavior-specific such as brute force. The connect method is implemented by a TCP mixin, and then it is overloaded by other network protocols. There is a scanner mixin that overloads the run method.

On the other hand, plugins work directly with the API. They manipulate the overall framework and hook into the event system. Because of that, plugins easily automate tasks that would be tedious if you wanted to do them manually. By the way, plugins work only in msfconsole. With the help of plugins, you can add new console commands to extend the framework functionality as a whole.

Just like Python, Ruby is a simpler language to learn than C++; so, you should try to learn the few. This will assist you to understand Metasploit better.

Finally, you may ask, why instead of using Python or C++ did the Metasploit makers choose Ruby? After all, Ruby is not a popular choice in security programming.

As a Python lover, you may disagree with this argument, but that should not stop you from using Metasploit; after all, it is one of the best ethical hacking tools available. Metasploit’s capabilities are staggering, especially with the open extensions through plugins and modules. It is not only powerful but versatile.

Metasploit Console or Interface

The command-line interface to the Metasploit Framework is extremely powerful. This interface is what opens when you open Metasploit Framework from the Kali Linux Application toolbar.

Let’s open the Metasploit console and issue the ? command .

The output shows that PostgreSQL is connected to Metasploit.

Now you are ready to move further, so you will want to use the db_nmap command to see whether there are any vulnerable machines. This time I am going to use the db_nmap command via VMware Player on a Windows 7 host machine. I have also opened virtual Kali Linux, and I have opened virtual Windows XP.

It will execute an Nmap scan, and it will also record the output automatically. You have already learned about Nmap. As far as versatility is concerned, it is almost equal to Metasploit. So, the combination of Nmap and Metasploit could be deadly for any target machine.

This is my host machine, which is Windows 7. It seems like it is not protected because the ports are open. I have kept it like that to give you an example what happens in the majority of cases. You can keep the firewall on, but that does not stop the combination of Nmap and Metasploit from exploiting such machines.

The last one that was also captured in the scanning process is the virtual Windows XP machine. So now you have not only the IP address but also the MAC address and the service pack that is being used. These facts are extremely useful for attacking the target machine.

Exploits and Payloads in Metasploit

Metasploit is all about exploitation. Quite naturally the most desirable command-line term is show exploits. It gives you a long listing of all the exploits contained in the Metasploit Framework. You’ll come back to this in the next section.

There are two types of exploits: active and passive. In active exploits , module execution stops when an error occurs. By just passing the -j command , you can force an active module in the background.

In passive exploits , the exploit almost always focuses on the client side such as web browsers or FTP clients. Passing the -i command can make passive exploits interact with the shell. Another advantage of passive exploits is they can be used in conjunction with e-mail exploits. In Metasploit, after a successful exploitation, a payload will start working. As I said earlier, payloads are nothing but fragments of malicious code, and the payloads actually implement necessary commands to get the after-exploitation work done.

Penetration testers usually set a specific target, and then the active exploits start running. A passive exploit would wait for incoming hosts, such as web browsers, to connect. Once they got hold of them, they start exploiting them.