What Is Metasploit?
The Metasploit Project is a computer security project that provides data about security vulnerabilities and assists penetration testing. It is owned by Rapid7, a US-based cybersecurity firm. A notable subproject of Metasploit is the open-source Metasploit Framework—a tool used to develop and run exploit code on remote target systems.
The Metasploit project includes anti-forensics and remediation tools, some of which are built into the Metasploit Framework. Metasploit comes pre-installed on the Kali Linux operating system.
Metasploit Loading Screen
Benefits of Penetration Testing Using Metasploit
Open Source
One of the biggest reasons to adopt Metasploit is that Metasploit is open source and actively developed. Unlike many other pentesting tools, Metasploit provides deep customizability, giving pentesters full access to source code and the ability to add custom modules.
Smart Payload Generation
Metasploit allows testers to easily switch payloads using the setpayload command. This provides great flexibility when attempting to penetrate a system using shell-based access or meterpreter, Metasploit’s dynamic scripting tool. Testers can also use the MsfVenom application to generate shellcode for manual exploitation directly from the command line.
Clean Exits and Persistency
Metasploit is able to exit cleanly without being detected, even if the target system is not expected to restart after the penetration test. It also provides multiple options for achieving persistent access to a target system.
Visual UI
Metasploit provides several easy-to-use GUIs, primarily Armitage. These GUIs let you perform common penetration testing functions such as managing vulnerabilities and creating workspaces at the click of a button.
7 Components of Metasploit Framework
The Metasploit Framework contains a large number of tools that enable penetration testers to identify security vulnerabilities, carry out attacks, and evade detection. Many of the tools are organized as customizable modules. Here are some of the most commonly used tools:
- MSFconsole—this is the main Metasploit command-line interface (CLI). It allows testers to scan systems for vulnerabilities, conduct network reconnaissance, launch exploits, and more.
- Exploit modules—allow testers to target a specific, known vulnerability. Metasploit has a large number of exploit modules, including buffer overflow and SQL injection exploits. Each module has a malicious payload testers can execute against target systems.
- Auxiliary modules—allow testers to perform additional actions required during a penetration test which are not related to directly exploiting vulnerabilities. For example, fuzzing, scanning, and denial of service (DoS).
- Post-exploitation modules—allow testers to deepen their access on a target system and connected systems. For example, application enumerators, network enumerators and hash dumps.
- Payload modules—provide shell code that runs after the tester succeeds in penetrating a system. Payloads can be static scripts, or can use Meterpreter, an advanced payload method that lets testers write their own DLLs or create new exploit capabilities.
- No Operation (NOPS) generator—produces random bytes that can pad buffers, with the objective of bypassing intrusion detection and prevention (IDS/IPS) systems.
- Datastore—central configuration that lets testers define how Metasploit components behave. It also enables setting dynamic parameters and variables and reuse them between modules and payloads. Metasploit has a global datastore and a specific datastore for each module.
After installing Metasploit, you can locate all Metasploit modules in one of the following file paths:
- Installing from binary: /path/to/metasploit/apps/pro/msf3/modules
- Cloning repo from GitHub: /path/to/metasploit-framework-repo/modules
Tools Offered by Metasploit
MSFconsole
MSFconsole is the default Metasploit interface. It provides all the commands needed to interact with the framework and tab-completion for common commands. It may take a while to learn how to use the CLI, but it becomes easier to use once you get familiarized with the tool.
msfdb
msfdb is a database management tool that supports PostgreSQL databases. The msfdb database stores information, including host data, exploit results and loot. You can use msfdb to import scan results from external tools like Nessus or Nmap. It provides a list of commands you can use to export and import scan results.
MsfVenom
Msfvenom enables you to generate custom payloads for specific targets. The tool was created by combining two previous Metasploit tools—msfencode and msfpayload.
Msfvenom can help get past the security of a target protected by a firewall or an antivirus. You can use msfvenom to customize payloads for a specific target and achieve higher success rates during a penetration test.
Meterpreter
Meterpreter is an advanced Metasploit payload. In general, Metasploit payloads perform a specific function. However, Meterpreter is dynamic, letting you script it on the fly. Once you successfully exploit a system, you can inject Meterpreter as the payload.
Here is what you can do once you have successfully injected the Meterpeter payload:
- Set up encrypted communication between the target and your system.
- Obtain dump password hashes from target system
- Locate files on the filesystem of the target
- Download or upload files
- Take snapshots from the webcam of the target system
Meterpreter exists and works from within the target’s memory. This stealthiness of Meterpeter makes it extremely difficult to detect. Even forensic tools can find it difficult to trace Meterpreter.
You can use Ruby to write Meterpreter scripts that execute custom functions. Meterpreter also provides a Python module that provides additional commands you can use to execute python scripts on a target machine.
Armitage
Armitage is a Java-based graphical user interface. The main advantage of this interface is that it can visualize targets and recommend exploits. It is also scriptable, allowing you to automate redundant tasks, such as host discovery.
Armitage is ideal for scenarios including networks with a large number of systems. The tool lets you browse files, escalate privileges, dump password hashes, and more.
How to Use Metasploit
Metasploit can integrate seamlessly with elements such as Windows patch enumeration, SNMP scanning during the information collection phase of a penetration test. It also provides a bridge to Tenable’s vulnerability scanner, Nessus. Metasploit integrates with almost any reconnaissance tool, allowing you to identify the vulnerability you want.
When you find a vulnerability, you can search the extensible Metasploit database for an exploit that cracks it open. For example, the Shadow Brokers released the NSA EternalBlue exploit in 2017, packaged for Metasploit, which can help you handle an unpatched legacy Windows system.
You match the exploit to an appropriate payload for the task. For example, Meterpreter is an interactive, in-memory-only shell, making it suitable for attacking a Windows system, given that most people want a shell. There are specific shellcodes for Linux boxes depending on the exploits used.
Once you’ve hacked the target machine, Metasploit provides a full set of post-exploitation tools, with new features added each year. For example, one option is to create a persistent backdoor that remains on the machine even after a reboot. Other tools include packet sniffing, privilege escalators, screen capture, pivoters, and keyloggers. Metasploit also offers a fuzzer for identifying potential security flaws in binary and an expanding selection of auxiliary modules.
Metasploit is an easily extensible, modular framework supported by an active community. While this is just a high-level description of Metasploit’s capabilities, you can almost always tweak it to accomplish the exact pentest you want once you have a deeper understanding of it.
Metasploit Challenges
Like any other security tool, the Metasploit framework can be used both legally and illegally. Users are responsible for using the tool in a legitimate way. In general, if you don’t have a contract with an organization allowing you to test a specific system, don’t use Metasploit on it. Even during an approved penetration test, ensure you are using Metasploit within the client’s approved scope and following the tool’s permitted terms of use.
Another issue to be aware of is that using Metasploit can produce unwanted results. Many exploits are designed to apply buffer overflows, race conditions, or other software vulnerabilities. These exploits pose a risk because vulnerabilities could destabilize the target system. Many exploits could lead to unexpected denial of service, application crashes, system restarts, and unexpected application behavior. Ensure the organization ordering the penetration test have an emergency response plan to prepare for these situations.
Finally, take into account that while Metasploit offers over 2,000 exploits, these are only a fraction of the number of real exploits available to attackers. Always consider the most pertinent threats facing your client or organization. If necessary, develop a custom Metasploit module or use additional tools to ensure you are covering all relevant threats.
Exploit Protection with Imperva
Imperva provides a Web Application Firewall that can prevent exploits and code injections, such as those tested by Metasploit. The WAF can intercept malicious traffic and block it in real time.
In addition, Imperva Runtime Application Self-Protection (RASP) provides real-time attack detection and prevention from your application runtime environment. RASP can stop external attacks and injections and reduce your vulnerability backlog.
Beyond exploit protection, Imperva provides comprehensive protection for applications, APIs, and microservices:
API Security – Automated API protection ensures your API endpoints are protected as they are published, shielding your applications from exploitation.
Advanced Bot Protection – Prevent business logic attacks from all access points – websites, mobile apps and APIs. Gain seamless visibility and control over bot traffic to stop online fraud through account takeover or competitive price scraping.
DDoS Protection – Block attack traffic at the edge to ensure business continuity with guaranteed uptime and no performance impact. Secure your on premises or cloud-based assets – whether you’re hosted in AWS, Microsoft Azure, or Google Public Cloud.
Attack Analytics – Ensures complete visibility with machine learning and domain expertise across the application security stack to reveal patterns in the noise and detect application attacks, enabling you to isolate and prevent attack campaigns.
Client-Side Protection – Gain visibility and control over third-party JavaScript code to reduce the risk of supply chain fraud, prevent data breaches, and client-side attacks.
