Many folks learn how to work with metasploit, and some folks also learn to work with BeEF. I wanted to figure out how to use them together. It took me more than 10 minutes to figure it out, so I thought I would write it down. Thanks to Sathish Arthars for his post, which was very helpful with regard to integration, and to InfoSec Institute, who had a nice write-up on getting started with BeEF.
In a nutshell, BeEF and Metasploit are meant to work together. But, they do not by default. To get them to work, you will need to change the configuration of two files. First, the file /usr/share/beef-xss/config has a pair of lines that read metasploit: enable: false, and that false will need to change to true. Secondly, change the /usr/share/beef-xss/extensions/metasploit/config.yaml file so the host and callback_host change to your actual IP address.
Finally, before starting BeEF you will need to use the load msgrpc ServerHost=<IP> Pass=<pass> command in the metasploit framework console. The IP should be the same one you put in the configuration files. Note that both the ServerHost and Pass parameters are case sensitive. Once you have the two working together, you can use a host of coordinated tactics.
I have a video of the highlights here.
No comments:
Post a Comment