Skip to content

Commit

Permalink
update most dev.metasploit.com references
Browse files Browse the repository at this point in the history
  • Loading branch information
busterb committed May 7, 2020
1 parent c987434 commit d74aea8
Show file tree
Hide file tree
Showing 4 changed files with 9 additions and 11 deletions.
2 changes: 1 addition & 1 deletion How-to-get-started-with-writing-an-exploit.md
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ The Metasploit Framework has seven different rankings to indicate how reliable a

### Template

If you have read this far, we think you are pretty impressive because it's a lot to digest. You are probably wondering why we haven't had a single line of code to share in the write-up. Well, as you recall, exploit development is mostly about your reversing skills. If you have all that, we shouldn't be telling you how to write an exploit. What we've done so far is hopefully get your mindset dialed-in correctly about what it means to become a Metasploit exploit developer for the security community, the rest is more about how to use our mixins to build that exploit. Well, there are A LOT of mixins so it's impossible to go over all of them in a single page, so you must either read the [API documentation](https://dev.metasploit.com/api/), existing [code examples](https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits), or look for more wiki pages we've written to cover specific mixins.
If you have read this far, we think you are pretty impressive because it's a lot to digest. You are probably wondering why we haven't had a single line of code to share in the write-up. Well, as you recall, exploit development is mostly about your reversing skills. If you have all that, we shouldn't be telling you how to write an exploit. What we've done so far is hopefully get your mindset dialed-in correctly about what it means to become a Metasploit exploit developer for the security community, the rest is more about how to use our mixins to build that exploit. Well, there are A LOT of mixins so it's impossible to go over all of them in a single page, so you must either read the [API documentation](https://rapid7.github.io/metasploit-framework/api/), existing [code examples](https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits), or look for more wiki pages we've written to cover specific mixins.

For example, if you're looking for a writeup about how to interact with an HTTP server, you might be interested in: [How to send an HTTP Request Using HTTPClient](https://github.com/rapid7/metasploit-framework/wiki/How-to-Send-an-HTTP-Request-Using-HTTPClient). If you're interested in browser exploit writing, definitely check out: [How to write a browser exploit using BrowserExploitServer](https://github.com/rapid7/metasploit-framework/wiki/How-to-write-a-browser-exploit-using-BrowserExploitServer), etc.

Expand Down
8 changes: 4 additions & 4 deletions How-to-use-Powershell-in-an-exploit.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
PowerShell is a scripting language developed by Microsoft. It provides API access to almost everything in a Windows platform, less detectable by countermeasures, easy to learn, therefore it is incredibly powerful for penetration testing during post exploitation, or exploit development for payload execution. Take Metasploit's [windows/smb/psexec_psh.rb](https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/smb/psexec_psh.rb) module for example: it mimics the psexec utility from SysInternals, the payload is compressed and executed from the command line, which allows it to be somewhat stealthy against antivirus. There's only less than 30 lines of code in psexec_psh.rb (excluding the metadata that describes what the module is about), because most of the work is done by the Powershell mixin, nothing is easier than that.

The command line will automatically attempt to detect the architecture (x86 or x86_64) that it is being run in, as well as the payload architecture that it contains. If there is a mismatch it will spawn the correct PowerShell architecture to inject the payload into, so there is no need to worry about the architecture of the target system.
The command line will automatically attempt to detect the architecture (x86 or x86_64) that it is being run in, as well as the payload architecture that it contains. If there is a mismatch it will spawn the correct PowerShell architecture to inject the payload into, so there is no need to worry about the architecture of the target system.

### Requirements

Expand Down Expand Up @@ -43,7 +43,7 @@ $si.CreateNoWindow = $True;
$p = [System.Diagnostics.Process]::Start($si);
```

A number of options can be used to adjust the final command depending on the circumstances of the exploit. By default the script is compressed but no encoding takes places of the wrapper. This produces a small command of around ~2000 characters (depending on the payload).
A number of options can be used to adjust the final command depending on the circumstances of the exploit. By default the script is compressed but no encoding takes places of the wrapper. This produces a small command of around ~2000 characters (depending on the payload).

Of these `encode_final_payload` is the most noteworthy as it will Base64 encode the full payload giving a very simple command with very few bad characters. However, the command length will increase as a result. Combining this with `remove_comspec` means the payload would very simply be:

Expand All @@ -53,8 +53,8 @@ Check out the other advanced options in the API documentation below.

### References

https://dev.metasploit.com/api/Msf/Exploit/Powershell.html
https://rapid7.github.io/metasploit-framework/api/Msf/Exploit/Powershell.html

https://github.com/rapid7/metasploit-framework/blob/master/lib/msf/core/exploit/powershell.rb

https://github.com/rapid7/metasploit-framework/blob/master/data/exploits/powershell/powerdump.ps1
https://github.com/rapid7/metasploit-framework/blob/master/data/exploits/powershell/powerdump.ps1
8 changes: 3 additions & 5 deletions How-to-use-Railgun-for-Windows-post-exploitation.md
Original file line number Diff line number Diff line change
Expand Up @@ -63,10 +63,10 @@ The best way to try Railgun is with irb in a Windows Meterpreter prompt. Here's

```
$ msfconsole -q
msf > use exploit/multi/handler
msf > use exploit/multi/handler
msf exploit(handler) > run
[*] Started reverse handler on 192.168.1.64:4444
[*] Started reverse handler on 192.168.1.64:4444
[*] Starting the payload handler...
[*] Sending stage (769536 bytes) to 192.168.1.106
[*] Meterpreter session 1 opened (192.168.1.64:4444 -> 192.168.1.106:55148) at 2014-07-30 19:49:35 -0500
Expand Down Expand Up @@ -141,8 +141,6 @@ https://www.youtube.com/watch?v=AniR-T0AnnI

https://www.defcon.org/images/defcon-20/dc-20-presentations/Maloney/DEFCON-20-Maloney-Railgun.pdf

https://dev.metasploit.com/redmine/projects/framework/wiki/RailgunUsage

https://github.com/rapid7/metasploit-framework/tree/master/lib/rex/post/meterpreter/extensions/stdapi/railgun

http://msdn.microsoft.com/en-us/library/ms681381(VS.85).aspx
Expand All @@ -151,4 +149,4 @@ http://msdn.microsoft.com/en-us/library/aa383749

http://undocumented.ntinternals.net/

http://source.winehq.org/WineAPI/
http://source.winehq.org/WineAPI/
2 changes: 1 addition & 1 deletion Meterpreter.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
Meterpreter is an advanced payload that has been part of Metasploit since 2004. Originally written in C by Matt "skape" Miller, dozens of contributors have provided additional code, including implementations in PHP, Python, and Java. The payload continues to be frequently updated as part of Metasploit development.

Meterpreter development occurs in [the metasploit-payloads repository](https://github.com/rapid7/metasploit-payloads) and the compiled results are published as part of the [metasploit-payloads gem](https://rubygems.org/gems/metasploit-payloads). For a detailed understanding of the Meterpreter architecture, please review the [original specification](https://dev.metasploit.com/documents/meterpreter.pdf).
Meterpreter development occurs in [the metasploit-payloads repository](https://github.com/rapid7/metasploit-payloads) and the compiled results are published as part of the [metasploit-payloads gem](https://rubygems.org/gems/metasploit-payloads). For a detailed understanding of the Meterpreter architecture, please review the [original specification](http://www.hick.org/code/skape/papers/meterpreter.pdf).

Additional documentation about Meterpreter can be found on this wiki:
* [[Meterpreter Reliable Network Communication]]
Expand Down

0 comments on commit d74aea8

Please sign in to comment.