Top
Search n00bz.net
  • South Florida Security Resources
    • HackMiami.org
      HackMiami is made up of information security professionals, hardware engineers, network administrators, students, and those who simply enjoy technology.
    • South Florida ISSA
      The Information Systems Security Association is, "the pre-eminent trusted global information security community".
  • PenTest Solutions
    • Rapid7 Metasploit Express
      Metasploit Express is an affordable, easy-to-use penetration testing solution that provides full network penetration testing capabilities, backed by the world’s largest, fully tested and integrated public database of exploits.
    • Core Impact PRO
      Core Impact is designed to evaluate the whole of the security in an office ecosystem. It allows the user to probe for and exploit security vulnerabilities in computer networks, endpoints and web applications.
« Using Metasploit to remove Malware | Main | Quick PS3 Backup Managers Tutorial for 3.55 KMEAW CFW »
Tuesday
Mar082011

Metasploit 3.6 Review

DateTuesday, March 8, 2011 at 11:33AM

Yesterday Rapid7 released Metasploit 3.6.  This edition of the Professional version of Metasploit has added some key features.

@sussuro has some great video walk-through you can find here: http://www.ethicalhacker.net/content/view/357/1/

Below I am going to highlight my favorite updates

PCI Reporting

Over the past 2 days, I have received 2 great resources for PCI compliance.  The first is this You-Tube video.  It helps to laugh in-between the tears.

The 2nd is the new report that Metasploit Pro includes.  This is a key report that could not come too soon.

I fired up a test Windows 2000 SP4 to test the report.  Below is an except.

As noted above, the following PCI requirements are tested with a result of pass/fail.  Included in the report if further information.  Looking at 6.1 we can see this box was not patched. 

Post Exploitation

A month ago there was a move from post exploitation scripts to modules.  Seeing the 3.6 update, I understand the method to the madness.  The say "shell is only the beginning."   With the new Post-Exploitation Modules, this saying has more truth then ever.

Once a session is generated on a box, the available Post-Exploitation Module is available on the Session tab.  The use of the modules are extremely easy.  Point, Click, Pwn!

 

A hidden gem feature is the ability to run Post-Exploitation Modules on all sessions generated.

Running the Module generates the results that my test machine was a VMware machine.

 

Revisiting my favorite Post-Exploit trick, UAC Protection Bypass.  I generated a session on a Windows 7 machine.

Before the module we are #Losing.

After the module, we are #Winning.

 

Exploit Features

A hidden gem that I noticed is with the Exploit Button.  It has been described as Super AutoPwn.  A new feature at the end of the Exploit Menu is the addition of a "Choose Exploits" button.

This allows the PenTester to customize which exploits are going to be fired at the target allowing for a focused attack. 

 

Conclusion

Version 3.6 of Metasploit has many features and hidden gems. Abe Lincoln said "If I had eight hours to chop down a tree, I’d spend six sharpening my axe."

 

Version 3.6 is razor sharp out of the box!

 Try it for 7 days with a full featured demo: http://www.rapid7.com/downloads/metasploit-pro.jsp

 

 

 

Authorn00bz Network | CommentPost a Comment | Reference3 References |
tagged in

References (3)

References allow you to track sources for this article, as well as articles that were written in response to this article.
  • Response
    Response: windows 7 ultimate 64 bit product key
    at windows 7 ultimate 64 bit product key on April 14, 2013
    Anyway, I'm gonna subscribe for your feed and I hope you write extremely articles once more soon.
  • Response
    Response: YksTWoCY
    at YksTWoCY on April 14, 2013
    Metasploit 3.6 Review - Blog - n00bz Network
  • Response
    Response: D.J. Williams Jersey
    at D.J. Williams Jersey on November 4, 2013
    Football is seriously 1 of the most significant sports in America. It has a major following.

Reader Comments

There are no comments for this journal entry. To create a new comment, use the form below.

PostPost a New Comment

Enter your information below to add a new comment.

My response is on my own website »
Author Email (optional):
Author URL (optional):
Post:
 
Some HTML allowed: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <code> <em> <i> <strike> <strong>

Notify me of follow-up comments via email.