You don't have to reinvent the wheel to exploit systems use methods methods Floyd is a framework that
contains an extensive collection of exploits and it's one of the very most popular open source free
tools for security professional.
There is a commercial version available as well.
And this tutorial will cover the basic structure of mythos brought along with some techniques on how
to use it.
So on the screen you can see the framework architecture.
You can access metal Floyd using its interfaces either through console using MSF console or command
line interface or the web version or other goofy tools that we will discuss later.
The underlying modules of metal employed are mainly five.
They are payloads exploits encoders knobs and egg yolks.
So let's start here with basic definitions before going into the details.
What's a module module is actually a piece of software that can be used by methods employed to frame
and what is a vulnerability.
Vulnerability as a weakness in the target system such as the system is not patched or it doesn't have
an antivirus etc..
Through this vulnerability or this weakness a successful penetration will occur.
What is an exploit.
So once a vulnerability is known in the system an attacker will take advantage of it and breaks into
the system using a certain code or script written which is known as an exploit it payload a set of tasks
that are initiated by the attacker.
Subsequent to the exploit in order to maintain access or do other tasks on the compromised system you
can call these listeners rootkit etc. But in our case here and in most of the cases and methods boy
this is called Method letter which is a shell that the user gets in order to control the system remotely.
What is a shell code.
As we said it's set of instruction used as a payload.
One exploitation occurs which results in the command shell or mortar predator that we will see in the
next video while doing the demo encoder is a module that if I use the right word here the technical
work it's obfuscate.
So actually it's someone use that pesky payload so that it doesn't get detected by intrusion detection
systems or antivirus.
So it kind of wraps the payload in an iterative way so that it doesn't get easily detected by antivirus
or other systems auxiliary is.
It provides additional functionality to the system such as scanning recon and U.S. attacks.
And lastly not actually a piece of software that prevents a payload from crashing on 86 systems by using
jump systems.
So that just aren't done.
Don't worry about that.
So going further it is important that you understand how are things stored on metal splurge system.
And because this will help you using the framework in a better way.
So let's go back to the colony machine and run let us play from there.
So from here you can go to the direct G user and then share then meet us ploy.
Dash framework and you will see all the files related to the metal support framework.
You can see the modules if you go through the modules you can see that they are Ozil free in quarters.
As we explained earlier and you can as well see that plug are here.
What else the MSF console command.
Other scripts tools etc..
So actually they're all arranged on this verdict.
He'd met exploit the framework so if you want to run a meta split you just as you said earlier it has
different platforms to run but we will use the MSF console is my favourite way console to run the split
so it'll take some time to initiate the database and connect to it.
So let's just give it some time here to run.
As you can see the cursor change and we are in the metal split framework now.
Before going further in the previous architecture we saw that it has libraries as well.
We have three main libraries which are recs MSF core and MSF base their Rex library is the basic library
for most of the attacks and tenders operations like protocols text transformation sockets etc. the MSF
course is the core library that provides basic API and the MSF base provides like additional or friendly
API.
So here we are at the MSF command line.
I will give you some tips on how to get familiar with it and how to use it.
First of all you can search exploits so as you can see this framework has around seventeen hundred exploits
9 8 6 0 0 these 5 0 7 payload payloads 14 quarters etc. So have to search these can use these commands
search search type exploit and search search a search type x Lloyd and it will all the exploits that
are available in the framework at the time being at will is the date the description of the exploit
the name of the exploit etc. and the rank and file that we can use as well we can fine grained this
search by specifying the platform such as Can you search.
Let's go to the command previously and you can here specify the platform that we are looking for exploits
into so we can say when goes and hit run you will get all its exploits related to the Windows system
which are many a better example can be if we narrowed the search to go on to and here you can see that
it returns the exploits that are pertained that pertain to to to open to as well search.
Come on vulnerabilities.
CV e I want to come on the vulnerabilities that occurred in 2017 and here you go.
It lists all the com vulnerabilities.
I want to attack a specific system or say WordPress to name word press and it will turn all the vulnerabilities
related to WordPress.
So if we want to go further and select and exploit just for the sake of giving this demo we can say
like Qs and we can reference the exploit.
So let's say that we want to use whatever this exploit for example.
So just copy and paste it after the use and just hit enter.
As you can see that the cursor changed and we get into this exploit now.
So once you get into this exploit we can issue a couple of commands like sure targets.
So it will show you the targets that this exploit will work on in this case it's what press people inside
you can see it you can use it as well as show in full until describe this exploit.
As you can see here this this module explodes speech.
Equal injection will be against WordPress plugin.
3 total casual full versions of 2 including etc. So all of these exploits come up with real description
debt and can as well show options.
And these are the options related to the exploits and you can set these options by using because.
So here we have the target advice that we targeting and we have the remote address and remote board
so we can set these in our exploit module and then invoke a payload and then send the payload to the
target.
So for example if I want to send the remote host IP you can use this command set our host and then one
choice.
Edit 2 on the twins when I'm putting the IP of the windows machine.
And here you go.
IP has been said you can't issue the show options again.
You can see that here the IP has been set up and going further we can use short payloads that are related
to this exploit and meet us point where return on the payloads that are related to this exploit.
Here you go.
So you can use this payload along with the exploit you can again use come in and let's see here we are
using PSP method to reverse CCP.
Just use and based.
OK.
So a few issues show options.
Again you will see that so you use show payloads and it will return all the payloads associated with
this attack.
So if you want to use this BHP payload issue this command used BHP forward slash metal pressure and
reverse underscore DCP and the payload is no use.
If you show the command show options it will show the options of the payload and you can as well set
local host IP and the local port.
Again if you use this local host setting the local's IP to my IP 130 and here you go.
So I think you do all the settings of these options and the module and in the payload you just press
on the right exploit and the attack will be invoked.