Using The Metasploit Framework on Mac OS X

One of the best open source and free pen testing applications available on the Internet today is The Metasploit Project. Metasploit is a very good tool to use to check and see if any services on your network are vulnerable for any one of the numerous publicly available exploits available in the Metasploit Framework. The reason you may want to use a utility like The Metasploit Framework can be summed up by this quote from Sun Tzu:

If you know the enemy and know yourself, you need not fear the result of a hundred battles. If you know yourself but not the enemy, for every victory gained you will also suffer a defeat. If you know neither the enemy nor yourself, you will succumb in every battle.

To be able to protect our networks from individuals with malicious intent we need to think like those individuals. We also need to know how to use their tools or what types of exploits we may be vulnerable to. We are essentially using fire to fight fire by burning ourselves before they burn us.

The Metasploit Framework also has a command line interface for those of you who are command line junkies (like me). It also has a pretty good web interface that makes it easy to test your network even if you do not know your way around the command line.

The current version 2.5 was just released on October 18th has added many new exploits and maintains compatibility with older versions of the Metasploit Framework. One of the best things about Metasploit is that it is very easy to set up and get running on Mac OS X.

To install Metasploit on your Mac all you need to do is download the current version of The Metasploit Framework.

Make sure you download the Unix Compressed Tar Archive and then use Stuffit or on the command line use: tar xzf framework-2.5.tar.gz to extract the archive file

I will get you started by helping you set up the Metasploit Framework web interface.

Note: All command line commands are in italics.

Open up Terminal and cd to the directory where you un-archived the file.

Now:

1. Go into the unarchived directory.

cd framework-2.5

2.Now start the Metasploit Framework web server.

./mfsweb

Leave this window open or you will kill the webserver.

3. Now open up your web browser and go to the URL: http://127.0.0.1:55555

You will now be able to browse the exploit lists. By using the filter modules drop down menu, you can filter the exploits by application, architecture, and operating system. I suggest getting to know the Metasploit command line mfscli. It is a very powerful way to be able to use Metasploit. I also suggest reading the included documentation in the framework-2.5/docs folder.

Remember these exploits are the real thing and if you go around trying them on other networks without their permission you could get yourself in a lot of trouble. Remember that all actions have their consequences.

Have Fun!