Standard Shell to Meterpreter Shell in Metasploit

TL;DR: sessions -u 

As we use various exploit modules we may or may not be able to employ a meterpreter payload directly with the module.  Inside the exploit module context, the show payloads command while show which payloads are available. Once a session is established without meterpreter, the sessions -u command can be used to upgrade the basic shell to a meterpreter shell.  You can see the play-by-play in screenshots on YouTube, complete with narration.

Enjoy, and good luck.

OpenVAS for my home network

I have been playing with OpenVAS now and then for a few years now.  I thought I would try it on my own network to see what I could find.  I had set up the system before (covered here), so I simply ran openvas-feed-update and navigated over to the main page in Iceweasel, as in the following picture:

After clicking on the 'Start Scan' button, I was treated to this view:

I clicked on 'Scan Management --> Reports' to see the result, as here:

In the picture above, you can see the worst result is the result in the 'Security' field.

Taking a look at the report:

We can see there is one host responsible for most of the flaws, while a 'TCP timestamps' flaw is seen on four other hosts.  The host with IP address 192.168.1.24 is my Cisco switch.  I may go on a separate quest to see if I can squash these flaws.  But, for now, they can stay.  On, and TCP timestamps? One is my small router, one is a printer, one is my Mac Mini, and one is my iPhone.

Sites I have Stumbled Upon

http://www.invoke-ir.com/  -- PowerShell for Incident Response
http://www.powershellempire.com/ -- PowerShell for everything offense 

New Book Out

Dan Dieterle wrote a new book, which is an update on his old book.  I did review a couple chapters for him, and he was kind enough to give a reviewer acknowledgement to me.  Check it out if you would like to use a book, or maybe give one to one of your nerd friends / relations that are interested in the topic.

Windows 2008 to Debian

There comes a limit to how many virtual machines you can run on a Mac Mini.  I bought a server for about $500 from savemyserver.com.  It has 1.2 TB of hard drive, 48 GB RAM, and 8 cores of processor.  I have not put any VMs on there yet, but did replace Windows 2008 Server that came pre-installed with Debian.  From experience, I can tell you if Debian is complaining about needing some firmware to continue, you should probably figure out how to get that before you go on.  I found this site to be pretty helpful when looking for individual files of firmware, rather than Debian packages which include firmware.

I'll update as I go, my dream is to use xen as my hypervisor.

John the Mangler

When using the password cracking tool John the Ripper, I have many times used it against the LM passwords, and cracked them with a bit of time.  Of course the NT passwords are (usually) just a case permutation of the LM password.  So, there must be an easy way to get John to do case permutations for you.  I went in to the configuration file -- /etc/john/john.conf to see if I could figure out how john word mangling rules are made.  I did not, but discovered there is already a rule to get NT passwords from LM passwords.  To use it, simply specify the mangling rule.

In sequence, I did this (assume the hashes are in a file called hashes) --

time john --format=LM hashes (this took about two hours)


john --format=LM --show hashes | cut -d : -f 2 | sort | tail -n 5 > word.txt

time john --format=nt --rules=NT -w:word.txt hashes (this took less than 0.1 seconds).

No video this time, comment if there's a part you don't understand, and I'll break it down.

Beef with a Side of Kali

Many folks learn how to work with metasploit, and some folks also learn to work with BeEF.  I wanted to figure out how to use them together.  It took me more than 10 minutes to figure it out, so I thought I would write it down.  Thanks to Sathish Arthars for his post, which was very helpful with regard to integration, and to InfoSec Institute, who had a nice write-up on getting started with BeEF.

In a nutshell, BeEF and Metasploit are meant to work together.  But, they do not by default.  To get them to work, you will need to change the configuration of two files.  First, the file /usr/share/beef-xss/config has a pair of lines that read metasploit: enable: false, and that false will need to change to true. Secondly, change the /usr/share/beef-xss/extensions/metasploit/config.yaml file so the host and callback_host change to your actual IP address.

Finally, before starting BeEF you will need to use the load msgrpc ServerHost=<IP> Pass=<pass> command in the metasploit framework console.  The IP should be the same one you put in the configuration files.  Note that both the ServerHost and Pass parameters are case sensitive. Once you have the two working together, you can use a host of coordinated tactics.

I have a video of the highlights here.