[ELECTRONIC NOISES]
Introduction to the Metasploit Framework--
now, before we can actually get started with the Metasploit
Framework and before we can start
exploring the various ways we can utilize it for penetration
testing, we actually need to get a good idea
of what the Metasploit Framework is, a bit of its history,
and furthermore some key terminology that
surrounds the framework.
And all of this information will come in handy as we progress
through the course and, again, will contextualize everything
that we're going to be learning.
So this video will give you an introduction to the Metasploit
Framework if you have never heard of it
and will give you an idea of how it works.
So the first question that we need
to ask ourselves is, what is the Metasploit Framework?
So simply put, the Metasploit Framework
is an open-source, robust penetration testing
and exploitation framework that is
used by penetration testers and security researchers worldwide.
And it's pretty much the de facto standard
when it comes down to the exploitation
framework of choice for penetration testers.
So this begs the question, what makes the Metasploit Framework
so special or so popular?
Well, one of the key elements or the key features that
makes it so popular is its ability
to automate almost every stage of the penetration testing
lifecycle.
So if we are talking about information gathering,
Metasploit can automate that.
If we are talking about exploitation,
Metasploit can automate that.
If we are talking about post-exploitation and privilege
escalation, the Metasploit Framework
can automate all of that.
Now, the Metasploit Framework is not
exclusive to just penetration testers and security
researchers.
It's also used by exploit developers
to develop and to test their new exploits.
And as a result, the Metasploit Framework
now has one of the world's largest database
of public, tested exploits.
So whenever you hear of a vulnerability being disclosed
and some companion exploit code being released
to the public, within two weeks to a month
you will see a Metasploit module that
will be created to actually test or exploit
that particular vulnerability.
And as I said, as a result, the Metasploit Framework
pretty much has the largest database
of publicly tested exploits.
So you can actually test out various vulnerabilities,
or you can actually check whether a target is
vulnerable to a particular exploit really simply.
Now, when it comes down to automation,
you might be asking yourself, well, why would
I want to automate something?
Why would I want to automate a penetration test?
Well, when we talk about automation with Metasploit,
we're specifically referring to exploitation
and post-exploitation.
When it comes down to exploiting a target system,
if you're doing it manually it will essentially
involve downloading exploit code,
modifying it, compiling the exploit, maybe if you're
of course transferring it over to the target,
and then of course launching it.
And all of this takes time.
And repeated over time, again, it's not really
time and performance efficient.
And this is where, again, Metasploit
comes into play, in that you can easily test targets
as to whether or not they're vulnerable to a particular
exploit within a few seconds.
All you need to do is load up the module,
provide the various parameters associated with the exploit,
and just hit run.
And you'll get verification as to whether the exploit worked
or it didn't work.
And if there are any errors, the Metasploit Framework
will essentially tell you what happened.
Now, I've mentioned modules very briefly.
The Metasploit Framework is designed to be modular.
What does this mean?
Well, it means that if I want to add
a new piece of functionality to the Metasploit Framework,
I can do so in the form of a module.
And all functionality within the Metasploit Framework
is handled in the form of a module.
I'll give you an example.
Let's say I want to perform port scanning, TCP port scanning
to be specific.
Well, the Metasploit Framework already
has an auxiliary module.
And I'll explain what an auxiliary module
is in the next video when we'll be exploring the architecture.
It has an auxiliary module that's
used to perform port scanning.
So someone developed a module to perform that specific task.
If I wanted to, again, maybe perform some enumeration
on SMB, the Metasploit Framework has an SMB module,
an auxiliary module that again will enumerate information
from SMB.
So you can see that with this modular structure,
exploit developers are able to easily create and test
their new exploits and, of course,
have them as part of the Metasploit Framework database.
And furthermore, you also have the ability
to create your own modules and integrate them really quickly
with ease.
So I've spoken a little bit about the Metasploit Framework,
but let's also talk about one of really cool aspects
of the Metasploit Framework, which
is the fact that it's open source which consequently
means that the source code is available on GitHub.
So you can actually check that out for yourself.
The core development team usually posts updates in
regards to the new features they'll be releasing
within the next release.
And, again, you can also engage with the community
of developers that are improving the framework, submitting
new modules, et cetera, et cetera.
So definitely check that out if you
are interested in learning more about the Metasploit
Framework as a project.
Now, let's explore a little bit of the history
of the Metasploit Framework.
The Metasploit Framework was developed
by a security researcher called HD Moore in 2003.
And it was originally developed in the Perl programming
language and was later rewritten in Ruby in 2007.
In 2009, it was acquired by Rapid7, which
is a cybersecurity company.
And what that meant is that they actually
started supporting and funding the project.
And as a result, we got two new commercial versions
of the Metasploit Project, rather.
And I'll get to that in a second.
And in 2019, we saw the major release,
a long-awaited, major release, which was Metasploit 5.0.
And in 2020 we essentially had Metasploit 6.0
released to the public, which is, again,
quite a major release.
And that's what we're going to be
using throughout the course of this particular course.
So that's a little bit of a history
as to how the Metasploit Framework started
and where it's going.
Now, the additions of Metasploit, this
is where a lot of people seem to get confused.
But it's really very simple to understand.
As I said, once the Metasploit Project,
as it was called at the time, was acquired by Rapid7 in 2009
they essentially pushed for the development
of commercial versions of the Metasploit Project.
And we had two commercial versions
released, one of them being Metasploit Pro, which
requires a license.
We then have Metasploit Express, which
is, again, a commercial version that also requires a license.
And then you have the Metasploit Framework,
which is the community version which, again, is open source
and is available to us all.
And that's what we are going to be using
for the rest of this course.
That's what's adopted by all penetration testers worldwide.
So we are primarily focused on the Metasploit Framework,
also known as MSF.
So when it comes down to the Metasploit Framework,
there really is a few key pieces of terminology
that you need to be aware of if you want
to be comfortable with the framework
or if you want to be comfortable using the framework.
One of them is the interface.
Now, these are going to be relative to the Metasploit
Framework.
When we talk about the interface,
we are essentially referring to the methods of interacting
with the Metasploit Framework.
So an example of this would be the Metasploit console,
the Metasploit command line, et cetera, et cetera.
So what is a module?
Well, a module, simply put, is a piece of code
that performs a particular task.
An example of the module is an exploit.
And of course, this is in reference
to the Metasploit Framework.
What's a vulnerability?
A vulnerability is a weakness or flaw
in a computer system or network that can be exploited.
So that's fairly simple.
What's an exploit?
Well, an exploit is a piece of code
or a Metasploit module that's used
to take advantage of a vulnerability
within a system, service, or application.
You then have a payload, which is quite important when
it comes down to Metasploit.
And I'll be getting into all of this as we move along.
A payload is essentially a piece of code delivered to the target
system by an exploit.
So an exploit takes advantage of a vulnerability,
and then the payload is what is dropped onto the target.
And the objective of a payload is
either to execute arbitrary commands on the target
or to provide remote access to an attacker
in the form of a reverse shell.
What's a listener?
A listener is essentially a utility
that listens for an incoming connection from a target
system.
So let's say we have an exploit that we want to use,
and this particular exploit takes advantage of a buffer
overflow on the target system.
And, again, the exploit also is coupled with the payload.
And the payload will, again, provide us
with a reverse shell on the target system.
So when we launch the exploit, it
takes advantage of the vulnerability
or exploits the buffer overflow vulnerability
and then drops the payload onto the target system, which
is then executed in memory.
And the payload, again, is executing
a Netcat reverse shell command that then connects back
to our listener.
And as a result, we get a reverse shell
on the target system.
So that's some key terminology that you
need to be aware of if you're going to be utilizing
the Metasploit Framework.
Now, let's talk about the Metasploit Framework
interfaces.
This is very, very important because you'll always
hear of the various interfaces available
that allow you to interact with the Metasploit Framework.
So first and foremost, we have the Metasploit Framework
console, also known as MSFconsole.
Now, MSFconsole is an easy-to-use, all-in-one
interface that provides you with access to all the functionality
of the Metasploit Framework.
So this is your command center.
Whenever you want to use a module, launch an exploit,
perform some scanning, take a look at your imported scans,
this is where you do it.
And you can easily initiate it by typing
in MSFconsole on your offensive distribution
or your system of choice.
And, again, it's fairly simple to use,
and we'll be exploring how to utilize the MSFconsole as we
progress through this course because this
is the primary interface that we're going to be utilizing.
You also have the Metasploit Framework CLI.
The Metasploit Framework CLI is essentially
used to facilitate the creation of automation scripts
that utilize Metasploit modules.
So, again, I can give you an example of this.
The Metasploit Framework CLI is essentially
used to import or to load Metasploit modules
into other scripts or other tools that you're creating.
So, again, it's used to essentially facilitate
the communication between other tools and the Metasploit
Framework.
And as it says here, it can be used
to redirect output from other tools
into the MSF CLI and vice versa.
Now it's important to note that the MSF
CLI was discontinued in 2015.
However, the same functionality of redirecting output
to and from the Metasploit Framework
can be leveraged through the Metasploit Framework
console, or MSFconsole.
We will not be taking a look at how
to do this because it's beyond the scope of this course.
But we'll probably be exploring this
as we move along or in another course.
Now, the other interface that we have available to us
is the Metasploit Community Edition,
which is essentially a web-based GUI
front-end for the Metasploit Framework
and is used to simplify network discovery and vulnerability
identification.
So, again, this essentially interacts with the Metasploit
Framework and provides you with a graphical user
interface that's web based.
So you can access it through your browser.
And as it says right over here, it essentially
simplifies or provides you with a visual overview
of the hosts that you have currently scanned
and the various vulnerabilities that you've
been able to identify.
So we'll also be taking a look at how
to use this at the end of this course
as we explore the Metasploit graphical user interfaces.
The next interface that we have is the Armitage interface.
Now, the Armitage interface is very, very important.
It is essentially a free, Java-based GUI front-end
for the Metasploit Framework that
is used to simplify network discovery
exploitation and post-exploitation.
So what you can think of Armitage as
is a visual or a graphical user interface
for the Metasploit Framework console, or MSFconsole.
So literally anything that you can do within the MSFconsole,
you can do with Armitage.
And as you can see from this screenshot here,
it allows you to pretty much visualize the hosts
that you've exploited.
You can search for modules.
You can get more information from a target.
You can open up a Meterpreter session, so on and so forth.
So that is the final interface that we're
going to be exploring.
And, again, we'll take a look at how
to utilize it at the end of this course
when we'll be exploring the Metasploit GUIs.
That's going to be it for this video.
In the next video, we will be exploring the Metasploit
Framework architecture, and we will
be taking a look at the various modules
or the various Metasploit Framework modules
and where they're stored and how they work
and what their purpose is.
So I'll see you in the next video.