Using The Metasploit Framework on Mac OS X

One of the best open source and free pen testing applications available on the Internet today is The Metasploit Project. Metasploit is a very good tool to use to check and see if any services on your network are vulnerable for any one of the numerous publicly available exploits available in the Metasploit Framework. The reason you may want to use a utility like The Metasploit Framework can be summed up by this quote from Sun Tzu:

If you know the enemy and know yourself, you need not fear the result of a hundred battles. If you know yourself but not the enemy, for every victory gained you will also suffer a defeat. If you know neither the enemy nor yourself, you will succumb in every battle.

To be able to protect our networks from individuals with malicious intent we need to think like those individuals. We also need to know how to use their tools or what types of exploits we may be vulnerable to. We are essentially using fire to fight fire by burning ourselves before they burn us.

The Metasploit Framework also has a command line interface for those of you who are command line junkies (like me). It also has a pretty good web interface that makes it easy to test your network even if you do not know your way around the command line.

The current version 2.5 was just released on October 18th has added many new exploits and maintains compatibility with older versions of the Metasploit Framework. One of the best things about Metasploit is that it is very easy to set up and get running on Mac OS X.

To install Metasploit on your Mac all you need to do is download the current version of The Metasploit Framework.

Make sure you download the Unix Compressed Tar Archive and then use Stuffit or on the command line use: tar xzf framework-2.5.tar.gz to extract the archive file

I will get you started by helping you set up the Metasploit Framework web interface.

Note: All command line commands are in italics.

Open up Terminal and cd to the directory where you un-archived the file.

Now:

1. Go into the unarchived directory.

cd framework-2.5

2.Now start the Metasploit Framework web server.

./mfsweb

Leave this window open or you will kill the webserver.

3. Now open up your web browser and go to the URL: http://127.0.0.1:55555

You will now be able to browse the exploit lists. By using the filter modules drop down menu, you can filter the exploits by application, architecture, and operating system. I suggest getting to know the Metasploit command line mfscli. It is a very powerful way to be able to use Metasploit. I also suggest reading the included documentation in the framework-2.5/docs folder.

Remember these exploits are the real thing and if you go around trying them on other networks without their permission you could get yourself in a lot of trouble. Remember that all actions have their consequences.

Have Fun!

Getting Started with PenTesting

One of the first steps in PenTesting is scanning. Today I am going to write a little about nmap for OS X. For those of you who don’t know what a scanner is, it is a program that will scan a range of IP addresses and return the IP addresses that have open ports available on them. Each open port represents a listening program or daemon running on that computer. This is of interest to pentesters because these ports can sometimes be used to gain unauthorized access to your computer via an exploit. So by finding these ports and making sure the processes listening have no vulnerabilities you are able to keep the bad guys out.

One of the greatest tools available for this type of scanning is Nmap which was written by Fyodor. Nmap is a great tool and is originally a command line/terminal utility. It is a very powerful scanner and it can even try and determine the OS of the remote host being scanned if you use the -O option when running the program. For those of you that are not command line savy, there is a GUI available for Nmap named NmapFe or Nmap Frontend.

I highly suggest getting to know the Mac Terminal program, many of the tools used in pentesting do not have the luxury of a GUI frontend.

To install Nmap you have three options. You can download install Nmap via DarwinPorts, or Fink. Both of Darwin Ports and Fink are package managers for Mac OS X. To install either of them please consult the documentation on their respective sites. The third way to install Nmap is via the source code. This is the best but also the hardest way to install Nmap. You will need to follow the directions included in the archive file the Nmap sources come in to properly configure and install Nmap on your Mac.

Once you have got it installed you can now have some fun scanning your own local area network. Nmap will also give you the type of service that is found on known ports. A list of known ports can be found here. Remember to consult the documentation to find out all of the features available from this great program. Keep in mind that some IDS will see your Nmap scans as a threat so remember to only scan network addresses that you have permission to scan before hand.