Auxiliary Modules
The Metasploit Framework includes hundreds of auxiliary modules
that provide functionality such as protocol enumeration, port scanning,
fuzzing, sniffing, and more.
Auxiliary modules are useful for many tasks,
including information gathering, scanning and enumeration of various services,
and so on.
There are too many to cover here, but we will demonstrate the syntax and operation
of two very common auxiliary modules.
To list all auxiliary modules, we can run the show auxiliary command.
This will present a very long list of all auxiliary modules .
We can use search to reduce this considerable output,
filtering by app, type, CVE ID, operation, platform, and more.
For this first example, we want to obtain the SMB version of the previously scanned
system BRUTE2 by using a Metasploit auxiliary module.
To find the correct module, we can search for all SMB auxiliary modules by entering
search type: auxiliary smb.
The output shows us all SMB auxiliary modules the search has identified.
As stated before, to activate a module we can enter use followed by the module name,
or use the index provided from search results.
Let’s use the latter to activate the module
auxiliary/scanner/smb/smb_version with index 56.
The output shows we have activated the smb_version module as indicated
in the command-line prompt.
To get information about the currently activated module, we can enter info.
The module description provides information about the purpose
of the module as shown.
The output also contains the Basic options,
which are the arguments for the module.
We can also display the options of a module by entering show options.
The options contain a column named Required,
which specifies if a value needs to be set before the module can be launched.
We should note that in most modules,
Metasploit will already set some of the options for us.
The output shows the option RHOSTS has no value set but is required by the module.
We can add or remove values from options with set and unset.
Let’s set the value for the option RHOSTS to the IP of BRUTE2.
Instead of setting the value manually, we can also set the value of RHOSTS
in an automated fashion by leveraging the results in the database.
Before we do this, we’ll unset the current value we manually set.
We can set RHOSTS to all discovered hosts with open port 445
by entering services, the port number as argument to -p, and --rhosts
to set the results for this option.
The output shows that Metasploit set the value for the option RHOSTS
based on the stored results in the database, which, in our case,
is the IP of BRUTE2.
Now, that we have set all required options, we can launch the module.
Let’s do this by entering run.
We just executed our first module as shown in the output
which shows that the target system supports version 2 and 3 of SMB
and prefers SMB 3.1.1.
Next, let’s use the vulns command to show if Metasploit automatically detected
vulnerabilities based on the results of this module.
The output shows that our database contains one vulnerability entry
about SMB Signing is not required and further information about it.
This is a great way of quickly identifying vulnerabilities without the use
of vulnerability scanners.
Next, let’s use another module.
In the Password Attacks module, we successfully identified credentials
on BRUTE by leveraging a dictionary attack against SSH.
Instead of Hydra, we can also use Metasploit to perform this attack.
To begin, we’ll search for SSH auxiliary modules.
The output lists an auxiliary module named auxiliary/scanner/ssh/ssh_login
with a fitting description.
We can activate it by using the index 15.
Once the module is activated, we can display its options.
There are various options to set in this module.
Fortunately, Metasploit already set several for us.
As with Hydra’s options, we can set a single password and user,
or provide files containing users, passwords, or both.
As in the example in Password Attacks,
we assume we already identified the username george.
We can specify rockyou.txt for the option PASS_FILE.
Finally, we set RHOSTS to our target IP and RPORT to 2222.
Now, all required options are set and we can launch the module with run.
By performing a dictionary attack with the activated auxiliary module,
Metasploit could determine the correct password as shown in the output.
Unlike Hydra, Metasploit not only displays the valid credentials,
but also opens a session.
We’ll explore what sessions are and how we can use them
in the following Learning Unit, but for now, we should understand that Metasploit
already provides us with interactive access to the target automatically.
As with the vulnerability displayed by the vulns command,
we can display all valid credentials we gathered up to this point
by entering creds.
Nice!
Metasploit stores the valid credentials automatically for us in the database.
It also shows us the related host, the service, and the type of credential.